> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stigg.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Amazon Redshift Serverless

## Overview

Stigg's integration with Amazon Redshift Serverless allows you to export your product catalog, customer, and subscription data to a Redshift Serverless workgroup — without managing cluster capacity.

<Note>
  Stigg's native data export integrations are included in the Scale plan, and are also available as an optional add-on to the Growth plan. See Stigg's pricing for more details.
</Note>

<Card title="View the full entity schema" icon="sitemap" href="./schema">
  See every table and column exported to your destination, organized by entity group.
</Card>

## Setting up the integration

### Prerequisites

* A Redshift Serverless workgroup and namespace
* An S3 bucket in the same AWS region, used for staging data before it's loaded into Redshift Serverless
* An IAM role (recommended) or IAM user with permission to access the staging bucket and call `redshift-serverless:GetCredentials`

<Note>
  If your security posture requires IP allowlisting, Stigg connects from a static IP: `35.192.85.117/32` (US Cloud) or `104.199.49.149/32` (EU Cloud). For private or self-hosted deployments, [contact Stigg support](mailto:support@stigg.io) for the egress IP.
</Note>

<Steps>
  <Step title="Create the database user">
    Connect to your workgroup with a SQL client and create a user derived from the IAM identity Stigg will connect with. For the recommended IAM role method, the username takes the form `IAMR:<role-name>`:

    <CodeGroup>
      ```sql create-user.sql theme={null}
      CREATE USER "IAMR:<role-name>" PASSWORD DISABLE;
      GRANT CREATE, TEMPORARY ON DATABASE <database> TO "IAMR:<role-name>";
      ```
    </CodeGroup>

    <Note>
      Using an IAM user with HMAC access keys instead? Create the user as `IAM:<user-name>` and grant it the same way.
    </Note>

    <Note>
      If Redshift Serverless already auto-created the user, `CREATE USER` will error — skip it and just run the `GRANT`. If you're pre-creating the schema yourself rather than letting Stigg create it on first sync, also run `GRANT ALL ON schema <schema> TO "IAMR:<role-name>";`.
    </Note>
  </Step>

  <Step title="Allow network access">
    In the Redshift Serverless console, find your workgroup's endpoint under **Properties > General information**, then open its VPC security group and edit **Inbound rules** to add a custom TCP rule for the connecting IP:

    | Setting  | Value                                                 |
    | -------- | ----------------------------------------------------- |
    | Protocol | Custom TCP                                            |
    | Port     | The port your workgroup listens on. Typically `5439`. |
    | Source   | Stigg's static IP (see above)                         |
  </Step>

  <Step title="Create the S3 staging bucket">
    In the [S3 console](https://console.aws.amazon.com/s3/), create a bucket for staging data before it's loaded into Redshift Serverless. Optionally add a lifecycle rule to delete staged objects after 2 days.
  </Step>

  <Step title="Create the IAM access policy">
    Create an IAM policy granting the permissions Stigg needs, replacing `REGION_NAME`, `ACCOUNT_ID`, `WORKGROUP_NAME_OR_ID`, and `BUCKET_NAME` with your own values:

    <CodeGroup>
      ```json policy.json theme={null}
      {
          "Version": "2012-10-17",
          "Statement": [
              {
                  "Effect": "Allow",
                  "Action": ["redshift-serverless:GetCredentials"],
                  "Resource": ["arn:aws:redshift-serverless:REGION_NAME:ACCOUNT_ID:workgroup/WORKGROUP_NAME_OR_ID"]
              },
              {
                  "Effect": "Allow",
                  "Action": "s3:ListBucket",
                  "Resource": "arn:aws:s3:::BUCKET_NAME"
              },
              {
                  "Effect": "Allow",
                  "Action": ["s3:PutObject", "s3:GetObject", "s3:DeleteObject"],
                  "Resource": "arn:aws:s3:::BUCKET_NAME/*"
              }
          ]
      }
      ```
    </CodeGroup>

    <Note>
      If the bucket uses a customer-managed KMS key, also add a statement granting `kms:GenerateDataKey` and `kms:Decrypt` on `arn:aws:kms:REGION_NAME:ACCOUNT_ID:key/KEY_ID`.
    </Note>
  </Step>

  <Step title="Create the IAM role">
    In the [AWS IAM console](https://console.aws.amazon.com/iam/), create a role using **Custom trust policy**. The Stigg connect form shows a trust policy prepopulated with the identifiers for your account (based on Google federated identity) — paste it in as-is. Attach the access policy from the previous step, name the role something recognizable (e.g. `transfer-role`), and record its ARN.

    <Note>
      Alternatively, create an IAM user with programmatic access, attach the same access policy, and use its Access Key ID and Secret Access Key when connecting below.
    </Note>
  </Step>

  <Step title="Connect Stigg with Redshift Serverless">
    In [Stigg](https://app.stigg.io/), navigate to **Integrations > Apps > Amazon Redshift Serverless**.

    Enter the following information in the connection form:

    | Field          | Description                                                                                       |
    | -------------- | ------------------------------------------------------------------------------------------------- |
    | Host           | The Redshift Serverless workgroup endpoint                                                        |
    | Port           | The port Redshift Serverless listens on. Defaults to `5439`.                                      |
    | Database       | The name of the target database                                                                   |
    | Workgroup      | The Redshift Serverless workgroup name                                                            |
    | Schema         | The schema where Stigg will create and sync tables                                                |
    | Username       | The database user created above                                                                   |
    | IAM Role ARN   | The ARN of the IAM role created above (or Access Key ID / Secret Access Key if using an IAM user) |
    | Staging bucket | The S3 bucket name and region used for staging                                                    |

    Click **Test & connect**.
  </Step>

  <Step title="Select entities to export">
    After entering your connection details, expand the **Entities to export** section to choose which entity groups to include in the sync. All groups are selected by default.

    See [Exported entities](./overview#exported-entities) for a description of each group.
  </Step>
</Steps>


## Related topics

- [Exported entities](/documentation/importing-and-exporting-data/export/overview.md#exported-entities)
- [Sync process, schedule, manual sync, and sync history](/documentation/importing-and-exporting-data/export/overview.md#sync-process)