Amazon Redshift DSR integration

Missing an action you need, or an integration we don't support yet? Contact your Customer Success Manager.

This integration automates privacy requests for Amazon Redshift. MineOS runs the queries you define against your cluster, using the requester's email address, so you can preview, delete or copy their records.

To scan Redshift for personal data, see Amazon Redshift data classification integration.

How It Works

• Preview: before MineOS deletes or copies anything, it runs your search query so you can preview the records it found for the requester.
• Delete: MineOS runs your delete query for the requester's email address. The search query is also used to check that the data was deleted.
• Get a copy: MineOS runs your copy query and sends the requester a copy of the records it returns.

You write one query for each action. Each query must contain the {{endUserEmail}} variable, which MineOS replaces with the requester's email address.

Choose the right integration type

Both types use the same AWS role and policy, set up in Step 1.

Before You Start

• You need permission to create IAM roles and policies in your AWS account.
• The database user MineOS signs in as must already exist in Redshift, with SELECT on the tables you query and DELETE on the tables you want MineOS to delete from.
• MineOS must be able to reach your clusters. Whitelist the MineOS IPs in the inbound rules of your VPC security group (IP & Email Whitelisting), or, if your clusters aren't publicly accessible, connect through a VPN tunnel.

📘

Test your queries first

MineOS runs your queries exactly as you write them and doesn't check them. Test each one in your own database before you save.

Setting Up

In the Request Handling section, make sure Handle this data source in privacy requests is selected.

Step 1: Create a role for MineOS in AWS

1. Log in to your AWS account and go to IAM → Roles → Create Role.

2. Under Trusted entity type, choose AWS account, then Another AWS account, and enter the account ID 595379680669.

3. Under Options, mark Require External ID and enter an External ID of your choice. Keep it; you'll need it in MineOS.

4. Click Next, skip the Add Permissions page, and click Next again.

5. Add a Role Name and Description, and create the role.

6. Open the new role. Under Permissions policies, click Add Permissions → Create Inline Policy.

7. Click JSON and paste the following policy, replacing your-account-id and your-db-user:

   JSON

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "DescribeClusters",
         "Effect": "Allow",
         "Action": ["redshift:DescribeClusters"],
         "Resource": ["*"]
       },
       {
         "Sid": "GetClusterCredentials",
         "Effect": "Allow",
         "Action": ["redshift:GetClusterCredentials"],
         "Resource": ["arn:aws:redshift:*:your-account-id:dbuser:*/your-db-user"]
       }
     ]
   }

   Keep the wildcards for regions and clusters so MineOS can scan all your clusters.

8. Click Next, name the policy and click Create Policy.

Step 2: Connect in MineOS

1. Log in to MineOS. On the left sidebar, click Inventory → Data Sources. Click Add Data Source, search for Amazon Redshift and click Add.

2. Open the data source → Integrations tab → Request Handling section → select Integration, and choose Redshift or Redshift Direct Connection.

3. Fill in your External ID, Account ID, Role Name, DB User and Region.

4. For Redshift Direct Connection, also fill in the Cluster URL: your cluster's endpoint address. If your cluster doesn't use the default Redshift port (5439), add the port after a colon.

5. Click Test & Save. The connection succeeds when at least one database has been discovered and accessed.

Step 3: Add your privacy request settings

In the same Request Handling section, fill in the settings that only privacy requests use, then click Save:

• Cluster Identifier and Database Name: the cluster and database MineOS runs your queries in. Fill in both, or leave both empty.
• Query used for search records & delete validation: finds the requester's records, for example SELECT id, name, email FROM "your_db"."your_schema"."your_table" WHERE email = '{{endUserEmail}}';
• Copy Query: returns everything to include in the copy, for example SELECT * FROM "your_db"."your_schema"."your_table" WHERE email = '{{endUserEmail}}';
• Delete Query: deletes the requester's records, for example DELETE FROM "your_db"."your_schema"."your_table" WHERE email = '{{endUserEmail}}';

You're done! MineOS has been connected to your Redshift clusters.

Using the Integration in Requests

To handle requests automatically, add the Redshift integration to the workflows of the privacy rights it should handle, such as deletion or get a copy.

Need Help?

If you need any help with this integration, please contact your Customer Success Manager. They will be happy to assist you!