Amazon Redshift

Connect Querri to your Amazon Redshift data warehouse, choose the tables to load, and ask questions about them in plain language.

Overview

The Redshift connector copies the tables you choose into Querri’s own storage, and Querri runs its analysis on that copy. It works with provisioned clusters and Redshift Serverless workgroups, connects by host and credentials, and can reach private clusters through an OpenVPN tunnel.

For very large tables, Redshift has per-table sync options that other database connectors don’t (see Large tables).

Setup

Prerequisites

• An active Redshift cluster or Redshift Serverless workgroup
• A database user, ideally read-only (see Database user setup)
• Network access from Querri to the cluster endpoint, or an OpenVPN tunnel

Network access

If your cluster only accepts connections from known addresses, add Querri’s outbound IP address to the cluster’s VPC security group, on TCP port 5439.

If the cluster isn’t publicly accessible, you can either:

1. Enable public accessibility on the cluster and restrict access with security group rules, or
2. Connect through OpenVPN, using Connect via VPN (Advanced) in the form with your .ovpn config and certificates.

To enable public accessibility on a provisioned cluster:

1. Open the Amazon Redshift console and select your cluster.
2. Choose Actions > Modify publicly accessible setting.
3. Turn on Publicly accessible.
4. Add an inbound rule for Querri to the security group.

For Redshift Serverless, go to Serverless dashboard > Workgroups, select your workgroup, and review the VPC security group under Network and security.

Finding your endpoint

Provisioned cluster

1. Open the Amazon Redshift console.
2. Click Clusters and select your cluster.
3. Under General information, find Endpoint, for example my-cluster.abc123xyz.us-east-1.redshift.amazonaws.com:5439/mydb.
4. The host is everything before the colon.

Redshift Serverless

1. Open the Amazon Redshift console and click Serverless dashboard.
2. Select your workgroup.
3. Under General information, find Endpoint, for example my-workgroup.123456789012.us-east-1.redshift-serverless.amazonaws.com:5439/dev.
4. The host is everything before the colon.

Creating the connector

1. Open the connector. Click Connect in the app rail and pick Amazon Redshift under Connect a data source, or click Connect on it in Settings → Connectors (admins).

2. Enter connection settings:

   Field	Default
   Connector Name	Redshift
   Host *	Your cluster or workgroup endpoint
   Port	5439
   Username *
   Password
   Database	dev
   Require SSL Connection	On
   Connect via VPN (Advanced)	Off

3. Test the connection. Click Test connection and discover access. This creates the connector, then tests it and lists the databases and schemas the user can read.

4. Select data. Pick a database and schema (the schema defaults to public). All Tables is on by default; turn it off to choose tables. Add Custom SQL Queries to load a query’s result as its own source.

5. Set large-table options if you need them (see Large tables).

6. Load your data. Click Save and Load Data. A progress card shows each table loading, then offers View in Library and Sync daily.

Caution

Pressing Enter in the dialog saves it. Opening a saved Redshift connector runs discovery against the cluster again.

Large tables

When you pick tables yourself, each table has an Advanced section:

Option	What it does
Sync mode	Cursor (default), or Chunked keyset, which loops paged SELECTs ordered by the cursor column. Chunked keyset is recommended for tables over 10 million rows
Cursor column	The column rows are ordered and tracked by
Tiebreaker column (optional)	A second column for rows that share a cursor value
Chunk size (rows)	How many rows each page reads

The section also shows column hints, such as whether the cursor column is a primary key, whether it lines up with the table’s sort key, and whether it allows nulls.

Under Advanced Settings, Limit rows per table is off by default, so every row loads.

Database user setup

Read-only user (recommended)

-- Create user
CREATE USER querri_readonly PASSWORD 'SecurePassword123!';

-- Grant usage on the schema
GRANT USAGE ON SCHEMA public TO querri_readonly;

-- Grant select on all existing tables
GRANT SELECT ON ALL TABLES IN SCHEMA public TO querri_readonly;

-- Grant select on future tables
ALTER DEFAULT PRIVILEGES IN SCHEMA public
GRANT SELECT ON TABLES TO querri_readonly;

Restricting access to specific schemas

CREATE USER querri_readonly PASSWORD 'SecurePassword123!';

-- Grant access to analytics schema only
GRANT USAGE ON SCHEMA analytics TO querri_readonly;
GRANT SELECT ON ALL TABLES IN SCHEMA analytics TO querri_readonly;
ALTER DEFAULT PRIVILEGES IN SCHEMA analytics
GRANT SELECT ON TABLES TO querri_readonly;

Restricting access to specific tables

GRANT USAGE ON SCHEMA public TO querri_readonly;
GRANT SELECT ON public.orders TO querri_readonly;
GRANT SELECT ON public.customers TO querri_readonly;
GRANT SELECT ON public.products TO querri_readonly;

See Database Best Practices for analytics views and access.

Verify permissions

-- Check user exists
SELECT usename, usesysid, usecreatedb, usesuper
FROM pg_user
WHERE usename = 'querri_readonly';

-- Check table permissions
SELECT
    schemaname,
    tablename,
    has_table_privilege('querri_readonly', schemaname || '.' || tablename, 'SELECT') as has_select
FROM pg_tables
WHERE schemaname = 'public'
ORDER BY tablename;

Sync scheduling

The connector’s owner can keep Redshift data up to date on the Schedule tab, with Full Refresh, Incremental, or both. For incremental syncs, use a TIMESTAMP or TIMESTAMPTZ column like updated_at. Tables that are loaded with COPY or truncated and reloaded by an ETL process should use Full Refresh instead.

Scheduled syncs use credits when they run. See the Sync Scheduling guide.

Troubleshooting

Cannot connect to cluster

1. Check that the cluster’s security group allows Querri’s address, or that the VPN files are loaded.
2. Check that the cluster is in Available status, and not paused.
3. Check the endpoint and port (5439).
4. If you’re connecting over the internet, check that Publicly accessible is on.
5. Check that the database name matches an existing database.

Authentication failed

1. Double-check the username and password.
2. Check the user exists: SELECT * FROM pg_user WHERE usename = 'your_username';
3. Check that the user isn’t locked or disabled.

Permission denied

1. Grant the permissions under Database user setup.
2. Check the schema name, and that GRANT USAGE ON SCHEMA has been run.
3. Run: SELECT has_schema_privilege('querri_readonly', 'public', 'USAGE');

SSL connection error

1. Redshift enables SSL by default, so keep Require SSL Connection on.
2. Check the cluster’s require_SSL parameter in its parameter group.

Slow data sync

Querri copies table data from Redshift into its own storage, so sync speed depends on table size and network throughput.

1. Sync only the tables you need with Table Selection.
2. Set Limit rows per table under Advanced Settings.
3. Use Chunked keyset sync mode for very large tables.
4. Create views in Redshift that pre-filter to recent data, and sync those instead.
5. Check the cluster isn’t paused or heavily loaded.

Security best practices

• Keep SSL on. Redshift clusters enable SSL by default too.

• Use read-only credentials. It prevents accidental changes and is easier to audit.

• Restrict schema access to what analysts need:

  CREATE SCHEMA analytics;
  GRANT USAGE ON SCHEMA analytics TO querri_readonly;
  GRANT SELECT ON ALL TABLES IN SCHEMA analytics TO querri_readonly;

• Monitor access:

  SELECT query, querytxt, starttime, endtime,
         elapsed / 1000000.0 as seconds
  FROM stl_query
  WHERE userid = (SELECT usesysid FROM pg_user WHERE usename = 'querri_readonly')
  ORDER BY starttime DESC
  LIMIT 20;

How Querri uses Redshift

Querri copies your Redshift table data into its own storage, then runs its analysis on that copy. This means:

• Querri doesn’t run analytical queries against your cluster when people ask questions.
• Your cluster only does work while tables sync.
• Redshift-side tuning (sort keys, distribution keys) affects sync speed, not analysis in Querri.

To keep sync load down:

• Schedule syncs for off-peak hours.
• Use concurrency scaling in your workload management settings.
• Sync only the tables analysts need.

Next Steps

• Database Best Practices: analytics views and access
• Connecting Databases: the shared database form in detail
• Managing Connections: change and refresh your connectors