Skip to main content
Delphina connects to Redshift with a dedicated database role that has read-only access to the data you want the agent to query. Pick the setup that matches your network and how you want Delphina to authenticate, then follow its guide from start to finish. Each guide covers both Redshift Serverless and provisioned clusters.

​
Choose your setup

Network
  • If your endpoint is already publicly accessible, use the public endpoint. To check, open your workgroup → Network and security (Serverless) or your cluster → Properties → Network and security settings (provisioned) and look at Publicly accessible.
  • If it’s private, use the VPC endpoint. You grant Delphina’s AWS account access with one setting, and Delphina connects over AWS’s private network, so your warehouse stays private. It works on Serverless and on provisioned RA3 or RG clusters with cluster relocation turned on or Multi-AZ, but not DC2 (see DC2 clusters). The port must be in the range 5431–5455 or 8191–8215; the default, 5439, qualifies.
  • Advanced: if you can’t use either, connect through an SSH tunnel via a bastion host that you run. It works with any node type, but you maintain the bastion.
Delphina uses native Redshift connections, which handle the large and wide results that data apps need. The Redshift Data API isn’t supported. Authentication
  • IAM role (recommended): Delphina assumes a role in your AWS account to get short-lived database credentials, so no long-lived secrets are shared.
  • Username/password: a database user with a password that you share with Delphina. Simplest to set up.

​
Setup guides

Public endpoint + IAM role

Publicly accessible endpoint, short-lived credentials. Recommended.

Public endpoint + password

Publicly accessible endpoint, database password.

VPC endpoint + IAM role

Private warehouse, short-lived credentials.

VPC endpoint + password

Private warehouse, database password.

SSH tunnel (advanced)

Private warehouse through a bastion host you run. IAM role or password.

​
DC2 clusters

To check your node type, open your cluster in the Redshift console → General information → Node type. DC2 clusters can’t use a Redshift-managed VPC endpoint. If your DC2 cluster is private, you can:
  • Upgrade to RA3 or RG. AWS recommends migrating DC2 clusters to newer node types, and both support VPC endpoints.
  • Make the endpoint publicly accessible, with the security group limited to Delphina’s IP addresses, as in the public endpoint guides.
  • Connect through an SSH tunnel via a bastion host in your VPC.

​
Good to know

  • Isolate Delphina’s workload (optional). On a provisioned cluster, give Delphina’s database user its own WLM queue to manage contention between agent queries and your ETL. With automatic WLM, set the queue’s priority relative to your other workloads: above batch ETL keeps interactive questions responsive, at the cost of giving them preferential resources. On Serverless, each namespace has exactly one workgroup, so full isolation means a separate namespace and workgroup for Delphina that reads your data through a datashare. That’s real setup work, so most teams start on their existing workgroup. A maximum RPU capacity limits compute scaling on a shared workgroup; it doesn’t isolate Delphina from ETL workloads.
  • Query timeout. Delphina sets a statement timeout on every query (120 seconds by default, configurable per connection).
  • Query history. During onboarding, Delphina reads recent query history to learn which tables and joins your team actually uses. Step 2 of each guide includes the grant that lets it see all users’ queries, not just its own.
  • Encryption. Delphina connects over TLS and verifies that Redshift’s server certificate is signed by a trusted certificate authority. To reject unencrypted connections from every client, set require_ssl to true in your cluster’s parameter group or your workgroup’s configuration.