Skip to content

Commit

Permalink
docs(tutorial): clarify connection methods for IdP and Auth_profile (#…
Browse files Browse the repository at this point in the history 
…144)

* clarify connection methods for IdP and Auth_profile

* improve tutorial
  • Loading branch information
@jiezhen-chen
jiezhen-chen committed Feb 9, 2023
1 parent 1b0f134 commit 910be71
Showing 1 changed file with 30 additions and 129 deletions.
159 changes: 30 additions & 129 deletions tutorials/001 - Connecting to Amazon Redshift.ipynb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,7 @@
{
"cell_type": "markdown",
"metadata": {
"collapsed": true,
"pycharm": {
"name": "#%% md\n"
}
"collapsed": true
},
"source": [
"# Connecting to Amazon Redshift"
Expand All @@ -22,11 +19,7 @@
},
{
"cell_type": "markdown",
"metadata": {
"pycharm": {
"name": "#%% md\n"
}
},
"metadata": {},
"source": [
"## Using Database credentials\n",
"Raw database credentials can be used for establishing a connection to an Amazon Redshift cluster. While straight forward, this approach lack the strong security and user access controls provides by Identity and access management (IAM) and identity provider (IdP) plugins."
Expand All @@ -35,11 +28,7 @@
{
"cell_type": "code",
"execution_count": null,
"metadata": {
"pycharm": {
"name": "#%%\n"
}
},
"metadata": {},
"outputs": [],
"source": [
"import redshift_connector\n",
Expand Down Expand Up @@ -79,11 +68,7 @@
},
{
"cell_type": "markdown",
"metadata": {
"pycharm": {
"name": "#%% md\n"
}
},
"metadata": {},
"source": [
"## Using IAM Credentials\n",
"IAM Credentials can be supplied directly to ``connect(...)`` using an AWS profile. This approach allows users the option of using temporary credentials and limiting the permissions the connected user has."
Expand All @@ -92,11 +77,7 @@
{
"cell_type": "code",
"execution_count": null,
"metadata": {
"pycharm": {
"name": "#%%\n"
}
},
"metadata": {},
"outputs": [],
"source": [
"import redshift_connector\n",
Expand All @@ -122,11 +103,7 @@
},
{
"cell_type": "markdown",
"metadata": {
"pycharm": {
"name": "#%% md\n"
}
},
"metadata": {},
"source": [
"`~/.aws/credentials`\n",
"```\n",
Expand All @@ -144,23 +121,15 @@
},
{
"cell_type": "markdown",
"metadata": {
"pycharm": {
"name": "#%% md\n"
}
},
"metadata": {},
"source": [
"Alternatively, IAM credentials can be supplied directly to ``connect(...)`` using AWS credentials as shown below:"
]
},
{
"cell_type": "code",
"execution_count": null,
"metadata": {
"pycharm": {
"name": "#%%\n"
}
},
"metadata": {},
"outputs": [],
"source": [
"import redshift_connector\n",
Expand All @@ -182,11 +151,7 @@
},
{
"cell_type": "markdown",
"metadata": {
"pycharm": {
"name": "#%% md\n"
}
},
"metadata": {},
"source": [
"# Connecting using an Amazon Redshift Authentication Profile\n",
"An Amazon Redshift authentication profile can be used for authentication with Amazon Redshift via ``redshift_connector``. This approach allows connection properties to be stored in the server side and retrieved by ``redshift_connector``. Any connection parameter which appears in both the authentication profile and is directly provided to ``redshift_connector.connect(...)`` will be overriden by the value provided in the authentication profile.\n",
Expand All @@ -201,11 +166,7 @@
{
"cell_type": "code",
"execution_count": null,
"metadata": {
"pycharm": {
"name": "#%%\n"
}
},
"metadata": {},
"outputs": [],
"source": [
"import boto3\n",
Expand All @@ -221,7 +182,7 @@
"}\n",
"\n",
"try:\n",
" client = boto3.client(\"redshift\")\n",
" client = boto3.client(\"redshift\", \"us-east-2\")\n",
" client.create_authentication_profile(\n",
" AuthenticationProfileName=\"QAProfile\",\n",
" AuthenticationProfileContent=json.dumps(authentication_profile_contents)\n",
Expand All @@ -232,11 +193,7 @@
},
{
"cell_type": "markdown",
"metadata": {
"pycharm": {
"name": "#%% md\n"
}
},
"metadata": {},
"source": [
"The Redshift authentication profile, named ``QAProfile`` has been created. This profile is intended for use by a QA team who would like to avoid hard-coded references to a specific cluster in their projects. Its contents are in JSON format and contain fields such as ``host`` and ``cluster_identifier``.\n",
"\n",
Expand All @@ -246,11 +203,7 @@
{
"cell_type": "code",
"execution_count": null,
"metadata": {
"pycharm": {
"name": "#%%\n"
}
},
"metadata": {},
"outputs": [],
"source": [
"import redshift_connector\n",
Expand All @@ -270,13 +223,9 @@
},
{
"cell_type": "markdown",
"metadata": {
"pycharm": {
"name": "#%% md\n"
}
},
"metadata": {},
"source": [
"Noting the ``region`` parameter above, we can see that while the Amazon Redshift authentication profile lives in ``us-west-2``, ``examplecluster`` lives in ``us-west-1``. When retrieving temporary IAM credentials to connect to this cluster, the ``region`` provided in the authentication profile will be used.\n",
"Noting the ``region`` parameter above, we can see that while the Amazon Redshift authentication profile lives in ``us-west-2``, ``examplecluster`` lives in ``us-west-1``. When retrieving temporary IAM credentials to connect to this cluster, provide the ``region`` where the Redshift authentication profile lives and not the region of the cluster. ``region`` provided above is the region where the authentication profile is created as shown in `` client = boto3.client(\"redshift\", \"us-east-2\")``.\n",
"\n",
"Please see the ``redshift_connector.RedshiftProperty`` class for guidance on how to define the key and value contents of the JSON authentication profile contents.\n",
"\n",
Expand All @@ -286,11 +235,7 @@
{
"cell_type": "code",
"execution_count": null,
"metadata": {
"pycharm": {
"name": "#%%\n"
}
},
"metadata": {},
"outputs": [],
"source": [
"try:\n",
Expand All @@ -313,23 +258,15 @@
},
{
"cell_type": "markdown",
"metadata": {
"pycharm": {
"name": "#%% md\n"
}
},
"metadata": {},
"source": [
"## Authenticating using Active Directory Federation Service (ADFS) identity provider plugin"
]
},
{
"cell_type": "code",
"execution_count": null,
"metadata": {
"pycharm": {
"name": "#%%\n"
}
},
"metadata": {},
"outputs": [],
"source": [
"import redshift_connector\n",
Expand All @@ -348,11 +285,7 @@
},
{
"cell_type": "markdown",
"metadata": {
"pycharm": {
"name": "#%% md\n"
}
},
"metadata": {},
"source": [
"## Authenticating using Azure identity provider plugin\n",
"Values for `client_id`, `client_secret` can be created and found within the Enterprise Application created with Azure."
Expand All @@ -361,18 +294,15 @@
{
"cell_type": "code",
"execution_count": null,
"metadata": {
"pycharm": {
"name": "#%%\n"
}
},
"metadata": {},
"outputs": [],
"source": [
"import redshift_connector\n",
"\n",
"conn: redshift_connector.Connection = redshift_connector.connect(\n",
" iam=True,\n",
" database='dev',\n",
" region='us-east-1',\n",
" cluster_identifier='my-testing-cluster',\n",
" credentials_provider='AzureCredentialsProvider',\n",
" user='brooke@myazure.org',\n",
Expand All @@ -386,23 +316,15 @@
},
{
"cell_type": "markdown",
"metadata": {
"pycharm": {
"name": "#%% md\n"
}
},
"metadata": {},
"source": [
"## Authenticating using Azure Browser identity provider plugin"
]
},
{
"cell_type": "code",
"execution_count": null,
"metadata": {
"pycharm": {
"name": "#%%\n"
}
},
"metadata": {},
"outputs": [],
"source": [
"import redshift_connector\n",
Expand All @@ -421,11 +343,7 @@
},
{
"cell_type": "markdown",
"metadata": {
"pycharm": {
"name": "#%% md\n"
}
},
"metadata": {},
"source": [
"## Authenticating using Okta identity provider plugin\n",
"Values for `idp_host`, `app_id`, and `app_name` can be located within the Okta application created."
Expand All @@ -434,18 +352,15 @@
{
"cell_type": "code",
"execution_count": null,
"metadata": {
"pycharm": {
"name": "#%%\n"
}
},
"metadata": {},
"outputs": [],
"source": [
"import redshift_connector\n",
"\n",
"conn: redshift_connector.Connection = redshift_connector.connect(\n",
" iam=True,\n",
" database='dev',\n",
" region='us-east-1',\n",
" cluster_identifier='my-testing-cluster',\n",
" credentials_provider='OktaCredentialsProvider',\n",
" user='brooke@myazure.org',\n",
Expand All @@ -458,23 +373,15 @@
},
{
"cell_type": "markdown",
"metadata": {
"pycharm": {
"name": "#%% md\n"
}
},
"metadata": {},
"source": [
"## Authenticating using JumpCloud via generic Saml Browser identity provider plugin"
]
},
{
"cell_type": "code",
"execution_count": null,
"metadata": {
"pycharm": {
"name": "#%%\n"
}
},
"metadata": {},
"outputs": [],
"source": [
"import redshift_connector\n",
Expand Down Expand Up @@ -521,10 +428,7 @@
" pass"
],
"metadata": {
"collapsed": false,
"pycharm": {
"name": "#%%\n"
}
"collapsed": false
}
},
{
Expand Down Expand Up @@ -557,10 +461,7 @@
" pass\n"
],
"metadata": {
"collapsed": false,
"pycharm": {
"name": "#%%\n"
}
"collapsed": false
}
}
],
Expand Down

0 comments on commit 910be71

Please sign in to comment.