Example Policies for Amazon Redshift
Example 1: Allow an IAM user full access to all Amazon Redshift API actions
The following policy allows access to all Amazon Redshift actions.
{
"Statement": [
{
"Action": [
"redshift:*"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
The value
redshift:*
in the Action element indicates all the actions in the Amazon Redshift API. This
allows the user access all the Amazon Redshift actions. However, if the user is going to access Amazon
Redshift using the console, you might need to grant additional access permissions as shown in the
following example 2 in which you grant access to Cloudwatch metrics the console provides.
By default, all permissions are denied. Sometimes, however, you need to explicitly deny access to a
specific action. The following policy allows access to all the Amazon Redshift actions and then explicitly
denies access to the
DescribeEvents
action.
{
"Statement": [
{
"Action": [
"redshift:*"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"redshift:DescribeEvents"
],
"Effect": "Deny",
"Resource": "*"
}
]
}
API Version 2012-12-01
93
Amazon Redshift Management Guide
Example Policies for Amazon Redshift
