Amazon Redshift

Keel connects with Npgsql to the cluster or serverless endpoint. Redshift relies on grants for read-only access.

Read-only role script

-- Run as an administrator, then use keel_reader in Keel.
CREATE USER keel_reader PASSWORD 'Choose-a-strong-password1';
GRANT USAGE ON SCHEMA public TO keel_reader;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO keel_reader;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO keel_reader;
-- Optional, for usage-based inference: every user's query history in SYS_QUERY_HISTORY.
ALTER USER keel_reader SYSLOG ACCESS UNRESTRICTED;

Before you run it:

• Replace public with each schema Keel should see. Redshift passwords need upper and lower case letters and a digit.
• ALTER DEFAULT PRIVILEGES covers tables created later by the role that runs the script; add FOR USER <owner> for other owners.
• SYSLOG ACCESS UNRESTRICTED is optional: it lets Keel read every user's query history in SYS_QUERY_HISTORY (usage-based inference).

In Keel

Sources › Connect source › Amazon Redshift: Endpoint, port (5439), database, user and password; TLS. Then Test: Keel checks the network, authentication, metadata access, least privilege and query-log access, and warns if the principal can write.

How this script is verified

No Redshift engine runs in CI. The script is run against PostgreSQL 17 as Redshift's compatible subset (the connector suite for Redshift runs there too): the new user passes Test connection, harvests and profiles, and is refused an INSERT and a CREATE TABLE. SYSLOG ACCESS is Redshift-only and is not run; the live checklist in docs/10-devops.md covers it. See Connect sources.