Admin Access
Overview
At checkout the broker checks whether the requesting user exists in Redshift, and if not creates them with a strong random password and SUPERUSER privileges, then returns a connection command. At checkin the user is removed. Use this for temporary administrative access to a Redshift cluster.
This grants Redshift SUPERUSER. Require approval on the profile and keep the expiration short.
Before You Begin
- The Access Broker is deployed and connected
psqlandopensslon the broker host; connectivity to the Redshift endpoint- An admin database user able to
CREATE USERandALTER USER ... SUPERUSER
Environment Variables
| Variable | Notes |
|---|---|
user | Injected — target username |
host, port, db | Redshift connection details |
admin, pass | Admin database credentials |
Checkout Routine
Full script: Redshift/permissions/redshift-admin-checkout.sh
NEW_PASSWORD=$(openssl rand -base64 12)
psql "host=$host port=$port dbname=$db user=$admin password=$pass" <<EOF
DO \$\$
BEGIN
IF NOT EXISTS (SELECT 1 FROM pg_user WHERE usename = '$user') THEN
EXECUTE format('CREATE USER %I PASSWORD %L', '$user', '$NEW_PASSWORD');
EXECUTE format('ALTER USER %I WITH SUPERUSER', '$user');
END IF;
END \$\$;
EOF
echo "psql -h $host -p $port -d $db -U $user"
echo "Password: $NEW_PASSWORD"Checkin Routine
Full script: Redshift/permissions/redshift-admin-checkin.sh — drops the user created at checkout.
Configure in Britive
Create the permission
Resource Manager → Resource Type Permissions → New Permission. Language = Shell. Paste both scripts. Declare host, port, db, admin, pass (user is system-defined). Attach a response template surfacing the connection command and password.
Create a profile and policy
Create a profile with a short expiration, add the permission, and add a policy that requires approval.
Verify
-- during checkout
SELECT usesuper FROM pg_user WHERE usename = '<user>'; -- t
-- after checkin
SELECT 1 FROM pg_user WHERE usename = '<user>'; -- 0 rowsTroubleshoot
| Symptom | Cause | Fix |
|---|---|---|
permission denied to create user | Admin user lacks privilege | Use an admin user with CREATEUSER/superuser |
| User not dropped at checkin | User owns objects / active sessions | Terminate sessions and reassign owned objects before drop |