[Epic] Add connection impersonation to Redshift

[luizarakaki]

We support connection impersonation for Snowflake and Postgres. We can extend support to Redshift too.

It behaves slightly differently from Postgres as it uses SET SESSION AUTHORIZATION and passes usernames instead of roles.

Product doc

Tasks

Beta Give feedback

1. [BE] Tweak driver to use set session authorization
2. [FE] Change copy: replace "role" with "user"

[marcoquerque]

In general, what are your thoughts on requiring the redshift user in the metabase connection be a super user to use this?

[luizarakaki]

Redshift connection impersonation uses SET SESSION AUTHORIZATION.
https://docs.aws.amazon.com/redshift/latest/dg/r_SET_SESSION_AUTHORIZATION.html

To run this command, the connection must use superuser

[marcoquerque]

And what is our general thoughts on the metabase redshift user being a superuser? are we concerned from a security perspective - can we confidently say every query will use this?

[luizarakaki]

Queries from users in groups with impersonated connection, yes. But admins are never impersonated, so at least queries run by admin won't use this.

[calherries]

Pretty sure this is closed by #38530, so I'm closing this to get it into the release notes. Please yell at me if not