AWS Redshift：在SQL代码中隐藏凭证

Question

I am loading tables in redshift using the copy command as below.

COPY tip_files
FROM 's3 path'
iam_role 'role arn'
FORMAT AS PARQUET;

The problem is my arn is hardcoded here which seems to be a problem as a bad programming practice. I tried storing the arn in cred table and using it as below:

COPY tipfile
FROM 's3 path'
iam_role (select arn from cred)
FORMAT AS PARQUET;

It did not work. Is there any way to achieve this?

Answer 1

This is not possible. The credentials need to be supplied within the COPY command. It is not possible to join to them elsewhere.

An Amazon Resource Name (ARN) should not be considered confidential. It does not expose any credentials.

You could choose to keep the ARN somewhere (eg in AWS SSM Parameter Store) and have your code insert the ARN into the command rather than storing it with the command. However, your program would need to do that manipulation, rather than doing it within Redshift.