docs / destinations / redshift

Amazon Redshift

Redshift

deployable todaymerges

COPY from your S3 staging prefix into Redshift, with native MERGE for upserts.

Ingest lands typed, deduplicated tables in Redshift from any API it connects, including Abilene TX 311, Albany NY 311, Ann Arbor MI 311 and Anne Arundel County MD 311. You own the Redshift account and the credentials; Ingest keeps no copy of the data.

Every destination receives the same layout; see the tables Ingest creates.

Setup

Before you start

You need a Redshift administrator and an S3 bucket in the same region. Ingest uploads files; Redshift loads them with COPY. Each uses its own IAM role.

1. Create a database login

  • As an administrator, run this SQL with your Redshift Database filled in and Replace-With-Your-Strong-Password1 replaced by a new password for the ingest login: The password is never filled in for you. On the public docs page, replace your_database yourself too.
CREATE USER ingest PASSWORD 'Replace-With-Your-Strong-Password1';
GRANT CREATE ON DATABASE your_database TO ingest;
  • Fill Password at the bottom with that password, and Username with ingest.

2. Give Ingest S3 access

  • Enter s3://your-bucket/ingest-staging in S3 staging prefix at the bottom. Replace your-bucket with your existing S3 bucket's name. ingest-staging is the folder prefix for temporary files; keep it or choose another.
  • IAM → Roles → Create role → Custom trust policy. Paste this from your signed-in Ingest panel; name the role IngestAccess-redshift. The IngestAccess- prefix is required. Public docs show workspace placeholders; the signed-in panel fills your role and external ID.
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "AWS": "<ingest-tenant-role-arn>" },
    "Action": "sts:AssumeRole",
    "Condition": { "StringEquals": { "sts:ExternalId": "<your-workspace-slug>" } }
  }]
}
  • Attach this policy, with the bucket and folder prefix of your S3 staging prefix filled in. Ingest needs read, write, and delete access to stage files, inspect Parquet metadata, and clean up. On the public docs page, replace your-bucket and your-prefix yourself.
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload"],
      "Resource": "arn:aws:s3:::your-bucket/your-prefix/*"
    },
    {
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::your-bucket",
      "Condition": { "StringLike": { "s3:prefix": ["your-prefix", "your-prefix/*"] } }
    },
    {
      "Effect": "Allow",
      "Action": "s3:GetBucketLocation",
      "Resource": "arn:aws:s3:::your-bucket"
    }
  ]
}
  • Paste the role ARN into IAM role Ingest assumes to stage (IngestAccess-…) at the bottom.

3. Give Redshift S3 access

  • Create a Redshift reader role. Attach this policy, which uses the same bucket and prefix. This second role trusts the Redshift service. It is separate from the role that trusts Ingest.
{
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow", "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::your-bucket" },
    { "Effect": "Allow", "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::your-bucket/your-prefix/*" }
  ]
}
  • Associate it with your cluster, or your Serverless namespace. For Serverless: Namespace configuration → Security and encryption. Creating the role in IAM alone does not make it available to COPY.
  • Paste its ARN into IAM role Redshift assumes to read it at the bottom. These roles are not interchangeable. Check the first if staging fails; check the second if COPY reports access denied.
  • As your Redshift administrator, run this SQL with that role's ARN filled in: On the public docs page, replace the whole example ARN inside the quotes yourself.
GRANT ASSUMEROLE ON 'arn:aws:iam::your-aws-account-id:role/your-redshift-reader-role'
TO ingest FOR COPY;
  • Using KMS? Grant both roles key access. Ingest needs kms:GenerateDataKey and kms:Decrypt; Redshift needs kms:Decrypt. The key policy must allow both roles.

4. Allow the connection

  • Paste your Redshift hostname into Endpoint at the bottom (no port).
  • Allow 184.193.60.160/32 and 44.194.102.221/32 on port 5439. Use a publicly reachable endpoint. This form cannot configure a different port, SSH tunnel, or private connection.

5. Test the connection

  • Click Test & configure at the bottom. Writes and reads temporary data, checks pipeline state, then attempts cleanup. Review any cleanup warning. If the test fails, fix the reported problem and choose Test again.

Staging

The worker uploads Parquet to your S3 staging prefix in the Redshift region. Redshift loads it with COPY, and Ingest removes the staged files after the load.

Conformance

Every adapter passes the same suite before it ships: create a table with every canonical type, append 100k rows, atomic replace, merge (latest dedup_sort wins; child tables delete-then-insert by root id), schema evolution, NULL-key rejection, package replay without duplicates, state and schema round-trip, row-count read-back, identifier edge cases, double-underscored table names (__quarantine, child tables), and rollback on a mid-load failure.

Questions

Can Ingest load data into Redshift?
Yes. Redshift is live on Ingest's hosted service: the adapter passes all 15 conformance cases against the real service, and the setup steps are on this page.
Does Ingest merge into Redshift, or only append?
Redshift merges on the resource's primary key, so re-running a sync updates existing rows rather than duplicating them. Append and full replace are available per resource.
What does Ingest need to connect to Redshift?
Endpoint, Database, Username, Password, S3 staging prefix, IAM role Ingest assumes to stage (IngestAccess-…) and IAM role Redshift assumes to read it. Secrets are entered in a form, never in a chat, and held in a secret store under your own path: only the key names ever reach Ingest's database.
Which sources can Ingest load into Redshift?
Every connector Ingest has certified (Abilene TX 311, Albany NY 311, Ann Arbor MI 311, Anne Arundel County MD 311, Anthropic, Asana, Auburn WA 311, Aurora IL 311, Austin TX 311, Baltimore MD 311, Baton Rouge LA 311, Beaumont TX 311, Bellevue WA 311, Bellingham WA 311, Berkeley CA 311, Bethlehem PA 311, Bloomington IN 311, Boca Raton FL 311, Boston MA 311, Bridgeport CT 311, Brockton MA 311, Brookline MA 311, Buffalo NY 311, Burlington VT 311, Cambridge MA 311, Cambridge MA Open Data, Charleston County SC 311, Charlotte NC 311, Chula Vista CA 311, Cincinnati OH 311, Chicago IL 311, New York City NY 311, Clayton County GA 311, Cleveland OH 311, Cobb County GA 311, Columbus OH 311, Corona CA 311, Dallas TX 311, Davenport IA 311, Denver CO 311, Detroit MI 311, Elgin IL 311, Encinitas CA 311, Everett WA 311, Federal Way WA 311, Fort Lauderdale FL 311, Gilbert AZ 311, Google Ad Manager, Google Analytics 4, Greenwich CT 311, Hartford CT 311, Honolulu HI 311, Houston TX 311, Howard County MD 311, Huntington WV 311, Huntsville AL 311, Indianapolis IN 311, Jersey City NJ 311, Jira, Kansas City MO 311, Kent WA 311, Knox County TN 311, Los Angeles CA 311, Lexington KY 311, Lincoln NE 311, LinkedIn Ads, Livonia MI 311, Louisville KY 311, Lubbock TX 311, Macon-Bibb County GA 311, Manchester NH 311, Maui County HI 311, Medford MA 311, Memphis TN 311, Miami FL 311, Miami-Dade County FL 311, Minneapolis MN 311, Montgomery County MD 311, Multnomah County OR 311, Naperville IL 311, Nashua NH 311, Nashville TN 311, Newark NJ 311, NOAA, New Orleans LA 311, Norfolk VA 311, Oakland CA 311, Omaha NE 311, Open Brewery DB, Paterson NJ 311, Peoria IL 311, Philadelphia PA 311, Pinellas County FL 311, Pittsburgh PA 311, PokéAPI, Portland ME 311, PostgreSQL, Prince George's County MD 311, Provo UT 311, Raleigh NC 311, Ramp, Renton WA 311, The Rick and Morty API, Sacramento CA 311, Salesforce, San Antonio TX 311, San Francisco CA 311, San Gabriel CA 311, San Jose CA 311, San Mateo County CA 311, San Rafael CA 311, Santa Fe NM 311, Scottsdale AZ 311, Seattle WA 311, Shopify, Somerville MA 311, Springfield MO 311, St. Petersburg FL 311, Tacoma WA 311, Toledo OH 311, Topeka KS 311, Vallejo CA 311, Washington DC 311, Wayne County MI 311, West Des Moines IA 311, Wichita KS 311, Worcester MA 311 and Youngstown OH 311), plus any API it authors on request. The data lands in a destination you own, under credentials you control. Ingest keeps no copy of it.

Sources certified against a real API today: Abilene TX 311, Albany NY 311, Ann Arbor MI 311, Anne Arundel County MD 311, Anthropic, Asana, Auburn WA 311, Aurora IL 311, Austin TX 311, Baltimore MD 311, Baton Rouge LA 311, Beaumont TX 311, Bellevue WA 311, Bellingham WA 311, Berkeley CA 311, Bethlehem PA 311, Bloomington IN 311, Boca Raton FL 311, Boston MA 311, Bridgeport CT 311, Brockton MA 311, Brookline MA 311, Buffalo NY 311, Burlington VT 311, Cambridge MA 311, Cambridge MA Open Data, Charleston County SC 311, Charlotte NC 311, Chula Vista CA 311, Cincinnati OH 311, Chicago IL 311, New York City NY 311, Clayton County GA 311, Cleveland OH 311, Cobb County GA 311, Columbus OH 311, Corona CA 311, Dallas TX 311, Davenport IA 311, Denver CO 311, Detroit MI 311, Elgin IL 311, Encinitas CA 311, Everett WA 311, Federal Way WA 311, Fort Lauderdale FL 311, Gilbert AZ 311, Google Ad Manager, Google Analytics 4, Greenwich CT 311, Hartford CT 311, Honolulu HI 311, Houston TX 311, Howard County MD 311, Huntington WV 311, Huntsville AL 311, Indianapolis IN 311, Jersey City NJ 311, Jira, Kansas City MO 311, Kent WA 311, Knox County TN 311, Los Angeles CA 311, Lexington KY 311, Lincoln NE 311, LinkedIn Ads, Livonia MI 311, Louisville KY 311, Lubbock TX 311, Macon-Bibb County GA 311, Manchester NH 311, Maui County HI 311, Medford MA 311, Memphis TN 311, Miami FL 311, Miami-Dade County FL 311, Minneapolis MN 311, Montgomery County MD 311, Multnomah County OR 311, Naperville IL 311, Nashua NH 311, Nashville TN 311, Newark NJ 311, NOAA, New Orleans LA 311, Norfolk VA 311, Oakland CA 311, Omaha NE 311, Open Brewery DB, Paterson NJ 311, Peoria IL 311, Philadelphia PA 311, Pinellas County FL 311, Pittsburgh PA 311, PokéAPI, Portland ME 311, PostgreSQL, Prince George's County MD 311, Provo UT 311, Raleigh NC 311, Ramp, Renton WA 311, The Rick and Morty API, Sacramento CA 311, Salesforce, San Antonio TX 311, San Francisco CA 311, San Gabriel CA 311, San Jose CA 311, San Mateo County CA 311, San Rafael CA 311, Santa Fe NM 311, Scottsdale AZ 311, Seattle WA 311, Shopify, Somerville MA 311, Springfield MO 311, St. Petersburg FL 311, Tacoma WA 311, Toledo OH 311, Topeka KS 311, Vallejo CA 311, Washington DC 311, Wayne County MI 311, West Des Moines IA 311, Wichita KS 311, Worcester MA 311, Youngstown OH 311.

Other destinations Ingest writes to: Amazon S3, Google Cloud Storage, Azure Blob Storage, Apache Iceberg, Ingest Managed Lakehouse, MotherDuck, Postgres, Amazon Athena, Databricks, BigQuery, ClickHouse, MySQL / generic SQL, Snowflake.

Get your API data into Redshift