Skip to content

Update from code changes: Redshift IAM previews and AWS credentials #947

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
mintlify wants to merge 1 commit into from
Closed

Update from code changes: Redshift IAM previews and AWS credentials #947

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 22 additions & 1 deletion guides/cli/how-to-use-lightdash-preview.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,4 +32,25 @@ While your preview is running, you can run `dbt compile` in a separate terminal
**Problems with credentials?**

When you create preview projects, Lightdash will use the same warehouse connection settings you have in your `profiles.yml` file for your current dbt project. This can be a problem if you're using a local database that your laptop can reach but your Lightdash instance cannot.
</Info>
</Info>

### Redshift with `method: iam`

If your dbt Redshift profile authenticates with `method: iam`, `lightdash preview` resolves an AWS identity from your local AWS credential chain and forwards the resulting access key ID, secret access key, and (if present) session token to the backend. The backend then uses them to mint short-lived Redshift credentials per query, but **only for the preview project**.

- If `iam_profile` is set on the dbt target, the CLI resolves credentials from that profile (`fromIni`), matching dbt's own precedence. This covers AWS SSO profiles.
- Otherwise the CLI walks the default provider chain (`fromNodeProviderChain`): environment variables, the default profile, SSO, then an instance role.
- If the chain resolves nothing, `lightdash preview` fails fast with an actionable error pointing at `aws sso login` (or configuring a profile) rather than creating a broken preview.

The common workflow is signing in with SSO and then starting a preview — no long-lived per-user AWS keys required:

```bash
aws sso login --profile my-redshift-profile
lightdash preview
```

Because SSO and role credentials are short-lived, the CLI prints a warning showing the expiry when it forwards temporary credentials. Queries in the preview project will stop working once the session expires — re-run `aws sso login` and `lightdash preview` to refresh them.

<Note>
This applies to ephemeral preview projects created from your local dbt profile. For a durable, persistent project connection to Redshift with IAM, use a role the Lightdash backend assumes (`assumeRoleArn`) — see [Connect Redshift](/get-started/setup-lightdash/connect-project#redshift).
</Note>
Loading