Getting Started

Overview

This guide walks you through configuring the Britive Access Broker to manage just-in-time access to Amazon Redshift — creating a temporary database user at checkout and dropping it at checkin.

What you’ll accomplish:

Deploy and configure the Britive Access Broker with connectivity to your Redshift cluster
Configure checkout and checkin routines from the access-broker-examples repository
Register the Redshift cluster as a Resource Manager resource in Britive
Create a Resource Manager access profile
Check out database access and verify end-to-end

Prerequisites

Before you begin, make sure you have:

A Britive tenant with administrator access
A running Britive Access Broker with network access to the Redshift cluster endpoint (port 5439)
A Redshift superuser or a user with CREATE USER and GRANT privileges
psql or the Redshift JDBC driver available on the broker host

Never hardcode credentials. Use environment variables, your secret manager, or the Britive Secrets Store.

How It Works

The Access Broker runs SQL commands against Redshift to create and drop temporary users. At checkout, Britive creates a Redshift user derived from the requester’s email, grants the target group or superuser access, and returns credentials. At checkin, the user is dropped — no standing accounts remain.

User → Britive Console → Access Broker → psql/JDBC → CREATE USER / GRANT → DROP USER

Onboarding the Application

Configure the broker for Redshift access management. This is a one-time setup performed by an administrator.

Reference scripts are available in the britive/access-broker-examples repository under Redshift/permissions/.

Using the Britive Console

Deploy the Access Broker

Follow the Britive Access Broker deployment guide to install and register a broker. Ensure the broker’s security group allows outbound access to Redshift on port 5439.

Configure the broker scripts

git clone https://github.com/britive/access-broker-examples.git
# Copy Redshift/permissions/ scripts to your broker's scripts directory

Create a Redshift admin user for the broker

CREATE USER britive_admin PASSWORD 'StrongPassword!' CREATEUSER;

Store the credentials in the Britive Secrets Store.

Register the Redshift cluster in Resource Manager

Navigate to Resource Manager → Resources → Add Resource. Enter the cluster endpoint, port, database name, and admin credentials.

Using Shell

Key environment variables used by the broker scripts:

REDSHIFT_HOST=cluster.us-east-1.redshift.amazonaws.com
REDSHIFT_PORT=5439
REDSHIFT_DATABASE=dev
REDSHIFT_ADMIN_USER=britive_admin
REDSHIFT_ADMIN_PASSWORD=...   # From Britive Secrets Store
REDSHIFT_TARGET_GROUP=readonly_group
BRITIVE_USER_EMAIL=user@example.com

Refer to the britive/access-broker-examples Redshift/ directory for the full script set.

Using Terraform

resource "britive_resource_manager_resource_type" "redshift" {
  name        = "RedshiftCluster"
  description = "Amazon Redshift cluster"

  parameters {
    param_name   = "hostname"
    param_type   = "string"
    is_mandatory = true
  }
  parameters {
    param_name   = "port"
    param_type   = "string"
    is_mandatory = true
  }
  parameters {
    param_name   = "database"
    param_type   = "string"
    is_mandatory = true
  }
}

resource "britive_resource_manager_resource" "redshift_prod" {
  name          = "redshift-prod"
  resource_type = britive_resource_manager_resource_type.redshift.name

  parameter_values = {
    hostname = "cluster.us-east-1.redshift.amazonaws.com"
    port     = "5439"
    database = "dev"
  }

  resource_labels = {
    environment = "Production"
  }
}

Create Your First Access Profile

Using the Britive Console

Open Resource Manager

Navigate to Resource Manager → Profiles → Add Profile.

Configure the profile

Field	Value
Name	A descriptive name (e.g., `Redshift-Analyst`)
Expiration	Set a max session duration (e.g., `4h`)

Associate resources

Under Associations, select the Redshift cluster resource.

Add a permission

Under Permissions, select the checkout/checkin routine for the target access level.

Add a policy

Under Policies, assign members and configure conditions.

Save and activate

Click Save.

Using Terraform

resource "britive_resource_manager_profile" "redshift_analyst" {
  name                = "Redshift-Analyst"
  expiration_duration = 14400000

  associations {
    label_key = "environment"
    values    = ["Production"]
  }
}

resource "britive_resource_manager_profile_permission" "redshift_perm" {
  profile_id = britive_resource_manager_profile.redshift_analyst.id
  name       = "Redshift-Analyst-Access"
  version    = "latest"
}

Verify

Check out the profile

Navigate to My Access → find your profile → click Check Out. Britive returns temporary Redshift credentials.

Connect to the Redshift cluster

psql -h cluster.us-east-1.redshift.amazonaws.com -p 5439 -U <temp-user> -d dev

Confirm access

SELECT current_user;
SELECT pg_group_is_member('readonly_group', current_user);

Check in

Return to My Access → click Check In. Connecting with the same credentials should fail with FATAL: password authentication failed.

Troubleshoot

Symptom	Likely Cause	Fix
Checkout fails	Security group blocks port 5439 from broker	Update the Redshift cluster’s inbound security group rules
`ERROR: permission denied` for `britive_admin`	Admin user lacks `CREATEUSER`	Alter the user: `ALTER USER britive_admin CREATEUSER;`
User not dropped after checkin	Open connections hold the user	Close all connections from that user before checkin

Next Steps

Britive documentation

Last updated on July 8, 2026

Admin Access