Amazon Redshift data classification integration

📘

Draft note (remove before publishing)

Combines the HubSpot articles "Redshift Integration" and "Redshift Direct Connection Integration" (classification parts only), updated to the current setup labels. Confirm the database user only needs SELECT for scanning, and add screenshots of the AWS policy and the MineOS integration form.

Automate data classification by integrating MineOS with Amazon Redshift

How It Works

MineOS connects to your AWS account through an IAM role you create, signs in to your Redshift clusters as a database user you specify, and classifies the personal data in every table that user can access.

Note: This article covers data classification. Setting up Redshift for privacy requests is covered in the Amazon Redshift DSR integration article.

Choose the right connection type

• Redshift: MineOS discovers and scans all clusters the database user is authorized for, in the region you choose.
• Redshift Direct Connection: MineOS connects to one cluster through its endpoint URL and scans all accessible tables in it.

Both types use the same AWS role and policy, set up in Step 1.

Before You Start

• You need permission to create IAM roles and policies in your AWS account.
• The database user MineOS signs in as must already exist in Redshift, with read (SELECT) access to the tables you want to scan.
• MineOS must be able to reach your clusters. Whitelist the MineOS IPs in the inbound rules of your VPC security group (IP & Email Whitelisting), or, if your clusters aren't publicly accessible, connect through a VPN tunnel.
• [Optional] Enable Preview mode to view sample PII values alongside classification results. You must enable Preview mode before running the scan.

Setting Up

Step 1: Create a role for MineOS in AWS

1. Log in to your AWS account and go to IAM → Roles → Create Role.

2. Under Trusted entity type, choose AWS account, then Another AWS account, and enter the account ID 595379680669.

3. Under Options, mark Require External ID and enter an External ID of your choice. Keep it; you'll need it in MineOS.

4. Click Next, skip the Add Permissions page, and click Next again.

5. Add a Role Name and Description, and create the role.

6. Open the new role. Under Permissions policies, click Add Permissions → Create Inline Policy.

7. Click JSON and paste the following policy, replacing your-account-id and your-db-user:

   JSON

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "DescribeClusters",
         "Effect": "Allow",
         "Action": ["redshift:DescribeClusters"],
         "Resource": ["*"]
       },
       {
         "Sid": "GetClusterCredentials",
         "Effect": "Allow",
         "Action": ["redshift:GetClusterCredentials"],
         "Resource": ["arn:aws:redshift:*:your-account-id:dbuser:*/your-db-user"]
       }
     ]
   }

   Keep the wildcards for regions and clusters so MineOS can scan all your clusters.

8. Click Next, name the policy and click Create Policy.

Step 2: Connect in MineOS

1. Log in to MineOS. On the left sidebar, click Inventory → Data Sources. Click Add Data Source, search for Amazon Redshift and click Add.
2. Open the data source → Integrations tab → Request Handling section → select Integration, and choose Redshift or Redshift Direct Connection.
3. Fill in your External ID, Account ID, Role Name, DB User and Region.
4. For Redshift Direct Connection, also fill in the Cluster URL: your cluster's endpoint address. If your cluster doesn't use the default Redshift port (5439), add the port after a colon.
5. Mark the Scan this source using Data Classifier checkbox.
6. Click Test & Save. The connection succeeds when at least one database has been discovered and accessed.

You're done! MineOS has been connected to your Redshift clusters.

Need Help?

If you need any help with this integration, please contact your Customer Success Manager. They will be happy to assist you!