Add a Redshift Source Datastore
A source datastore is a storage location Qualytics connects to so it can profile, scan, and monitor data. Adding Redshift as a source lets Qualytics read tables through the Redshift JDBC driver and run quality operations on the data they contain.
Before you start, review the Redshift Permissions and the available Authentication methods.
Tip
Redshift can also hold an enrichment datastore, where Qualytics writes anomalies and metadata. Link one during creation via Link Enrichment on Datastore Creation, or afterwards via Link Enrichment Datastore.
Field reference
The Add Datastore page shows the sections below when Redshift is selected. When reusing an existing connection, the Connection Properties, Authentication, and Secrets Management sections come already filled in and read-only: Qualytics has already validated those credentials, so you fill in only the Datastores Extraction and the Datastore Properties. To change a saved connection's credentials, edit the connection through the Manage Connections page; edits there apply to every datastore that reuses the connection.
Connection Properties
These fields define the Redshift cluster endpoint Qualytics connects to. They belong to the connection: when reusing an existing connection, they come already filled in and read-only.
| FIELD | REQUIRED | TYPE | DESCRIPTION |
|---|---|---|---|
| Connection Name | Text | A label for the saved connection (e.g., acme_redshift_warehouse), so other datastores can reuse it later. |
|
| Host | Text | The cluster endpoint hostname (e.g., acme-cluster.123456789012.us-east-1.redshift.amazonaws.com). Redshift Serverless is recognized from the hostname. |
|
| Port | Number | The port the cluster accepts connections on. Defaults to 5439. |
Authentication
Choose how Qualytics authenticates to Redshift. Setting Type changes the credential fields shown below it, so pick the tab that matches your choice. These fields also belong to the connection: already filled in and read-only when reusing one. See Authentication for how each method works.
| FIELD | REQUIRED | TYPE | DESCRIPTION |
|---|---|---|---|
| Type | Option | Set to Password, which is the default (BASIC in the API). |
|
| User | Text | The Redshift database user Qualytics connects as. It needs the grants listed in Permissions. | |
| Password | Text | The password for that user. |
| FIELD | REQUIRED | TYPE | DESCRIPTION |
|---|---|---|---|
| Type | Option | Set to IAM Role (IAM_ROLE in the API). Qualytics assumes the role and uses short-lived database credentials that refresh on their own. |
|
| Role ARN | Text | The ARN of the IAM role to assume (e.g., arn:aws:iam::123456789012:role/MyRole). |
|
| External ID | Text | Fill this in only when the role's trust policy requires an external ID. |
AWS-only
IAM Role appears in Type only on AWS and local deployments. On Azure and GCP deployments, only Password is offered.
| FIELD | REQUIRED | TYPE | DESCRIPTION |
|---|---|---|---|
| Type | Option | Set to Assumed Role (ASSUMED_ROLE in the API). It takes the same fields as IAM Role and follows the same assume-role flow. |
|
| Role ARN | Text | The ARN of the IAM role to assume (e.g., arn:aws:iam::123456789012:role/MyRole). |
|
| External ID | Text | Fill this in only when the role's trust policy requires an external ID. |
AWS-only
Assumed Role appears in Type only on AWS and local deployments, the same as IAM Role.
Secrets Management
This group is optional: use it only if you want Qualytics to pull credentials from a secrets manager instead of typing them into the form. Turn on HashiCorp Vault to show the fields below. Despite the label, any secrets manager that exposes a compatible REST API works, not only HashiCorp Vault; see Secrets Management. It also belongs to the connection: read-only when reusing an existing connection.
| FIELD | REQUIRED | TYPE | DESCRIPTION |
|---|---|---|---|
| Login URL | Text | The Vault endpoint Qualytics uses to authenticate (e.g., https://vault.example.com/v1/auth/approle/login). |
|
| Credentials Payload | Text | A JSON body containing the credentials Vault expects (e.g., {"role_id":"...","secret_id":"..."}). |
|
| Token JSONPath | Text | The JSONPath that extracts the client token from Vault's response. Defaults to $.auth.client_token. |
|
| Secret URL | Text | The Vault path where the secret is stored (e.g., https://vault.example.com/v1/secret/data/redshift). |
|
| Token Header Name | Text | The HTTP header name used to send the token. Defaults to X-Vault-Token. |
|
| Data JSONPath | Text | The JSONPath that extracts the secret payload from Vault's response. Defaults to $.data. |
Note
Once the secrets manager is configured, reference any secret from a Connection Properties or Authentication field with ${key}, for example ${password}. Qualytics resolves it each time the connection is opened, so a changed value takes effect on the next connection.
Datastores Extraction
Pick the database and the schema or schemas Qualytics should read from. You fill these in on both flows.
| FIELD | REQUIRED | TYPE | DESCRIPTION |
|---|---|---|---|
| Database | Option | The database to read from. Click the refresh icon to load the databases the connection can reach. | |
| Schema | Option | One or more schemas inside the selected database. Each schema you pick becomes its own Qualytics datastore. Defaults to public. |
One datastore per schema
Selecting more than one schema creates one source datastore per schema, named from the Name Template. See Multi-Schema Source Datastore Creation for details.
Datastore Properties
Common fields for every source datastore, shown below the Datastores Extraction section. You fill these in on both flows.
| FIELD | REQUIRED | TYPE | DESCRIPTION |
|---|---|---|---|
| Name Template | Text | Defines the naming pattern for each source datastore being created. Use {{schema}} as a placeholder that gets replaced with the actual schema name (e.g., redshift_{{schema}} becomes redshift_public). Left empty, the datastore is named from the connection name and the schema. |
|
| Group | Option | Organizes your datastores under a shared group in the navigation tree. Select an existing group or create a new one with the Add New Group toggle. | |
| Teams | Option | Select one or more teams to associate with this source datastore. | |
| Initiate Sync | Checkbox | Automatically sync the datastore to detect containers and fields after creation. |
Allowlisting
A banner at the bottom of the form shows the IP address the connection is established from. Add it to your cluster's security group inbound rules so the connection can be opened.
Steps
There are two ways to set up the connection: reuse a connection you already saved (Existing Connection) or create a new one from scratch (New Connection). The tabs below walk through each option; pick the one you want to follow. Each field is described in the Field reference above.
Step 1: Navigate to the Source Datastores page.
Step 2: Click the Add Source Datastore button at the top-right corner.
Step 3: The Add Datastore page opens.
Step 4: Select New Connection next to the Search field.
Step 5: Select Redshift from the connector grid. Use the search field to filter connectors by name.
Step 6: Fill in the Connection Properties: the Connection Name, Host, and Port.
Step 7: Fill in the Authentication fields for the Type you choose.
Step 8: Optionally, expand Secrets Management to retrieve credentials from a secrets manager.
Step 9: Fill in the Datastores Extraction fields (Database and Schema) and the Datastore Properties.
Step 10: Click Test connection. A success message confirms that the connection has been verified.
Info
The Finish and Next buttons stay disabled until the connection test passes on the current values. If the test fails, see Troubleshooting.
Step 11: Click Finish to create the datastore.
Tip
To link an enrichment datastore so Qualytics can store anomalies and metadata from the first operation, click Next instead of Finish. See Link Enrichment on Datastore Creation.
Step 12: A success dialog confirms that your datastore has been added. Click Go to your datastore to open its page.
Step 1: Navigate to the Source Datastores page.
Step 2: Click the Add Source Datastore button at the top-right corner.
Step 3: The Add Datastore page opens.
Step 4: Select Existing Connection next to the Search field.
Step 5: Select the saved Redshift connection from the grid. Use the search field to filter connections by name. The Connection Properties, Authentication, and Secrets Management sections come already filled in and read-only.
Start a new connection from this one
To use the selected connection as a starting point for a brand-new connection instead, click the Duplicate as a new connection button on the selected connection. The form switches to New Connection mode with the connection's settings already filled in for you to adjust.
Step 6: Fill in the Datastores Extraction fields (Database and Schema) and the Datastore Properties. These are the only fields left to fill in.
Step 7: Click Test connection. A success message confirms that the connection has been verified.
Info
The Finish and Next buttons stay disabled until the connection test passes on the current values. If the test fails, see Troubleshooting.
Step 8: Click Finish to create the datastore.
Tip
To link an enrichment datastore so Qualytics can store anomalies and metadata from the first operation, click Next instead of Finish. See Link Enrichment on Datastore Creation.
Step 9: A success dialog confirms that your datastore has been added. Click Go to your datastore to open its page.