Amazon Redshift

AWS managed data warehouse, wire-compatible with PostgreSQL. Read-only.

At a glance

• Category — Relational
• Query language — SQL
• Default port — 5439
• URI scheme — redshift

Amazon Redshift driver for DBFlux (read-only v1), built directly on the postgres wire client rather than on dbflux_driver_postgres.

Features

• Relational driver (DatabaseCategory::Relational, QueryLanguage::Sql) that speaks the PostgreSQL wire protocol against a Redshift cluster or Redshift Serverless endpoint.
• Connection form with host, port (default 5439), database, user, password, SSL/sslmode (disable/allow/prefer/require/verify-ca/verify-full), a connection-URI mode (redshift://..., normalized internally to postgresql://...), and SSH tunneling.
• Custom TLS trust and mutual TLS: for TLS-enabled modes a pinned private root CA (PEM) is added to the trust store on top of the system roots, and a client certificate + private key (PEM/PKCS#8) enable mutual TLS. Cert material is loaded per connection from the paths configured in the form; validation is never weakened (verify-ca/verify-full still reject an untrusted certificate). A missing, unreadable, or malformed cert/key file surfaces as a clear connection error instead of silently falling back to the system trust store, and private-key contents are never logged.
• Schema introspection over information_schema for databases, schemas, tables, views, and columns, with ColumnKind classification (timestamp/integer/float/text) mirroring standard PostgreSQL OIDs.
• Redshift-only extended types (SUPER, VARBYTE, GEOMETRY, GEOGRAPHY, HLLSKETCH) classify as ColumnKind::Text and render as text; any other unrecognized OID falls back to a defensive UTF-8 text decode instead of panicking.
• Table details surface Redshift-specific storage metadata through the generic TableInfo.storage_hints seam (read from SVV_TABLE_INFO and PG_TABLE_DEF): distribution key (KEY/EVEN/ALL/AUTO, with the key column when applicable) and sort key (compound or interleaved, with its ordered columns). Declared primary key, foreign key, and unique constraints are still surfaced through the standard core metadata shapes, each labeled advisory/non-enforced — Redshift accepts but never enforces these constraints, and no index list is fabricated from them.
• Query execution (SELECT/browse) returns rows with typed columns via the standard Connection::execute path; query cancellation is supported through the wire client’s cancel token.
• RedshiftErrorFormatter maps common connection and query failures (timeouts, refused connections, authentication failures, unreachable clusters, SQLSTATE-bearing query errors) to clear, driver-formatted messages instead of raw debug output.
• Reports application_name as dbflux/<version> on every connection, unless the connection URI already sets its own application_name query parameter.

Limitations

• Read-only: DriverMetadata.capabilities omits INSERT, UPDATE, DELETE, RETURNING, BULK_INSERT, TRUNCATE_TABLE, and all DDL/transactional-DDL flags. There is no inline grid edit and no mutation/visual-query builder for this driver. Connection::execute additionally rejects any non-read statement at the wire layer with an explicit error, so a write attempt never becomes a silent no-op.
• Single-statement only: Connection::execute runs one read-only statement at a time. Multi-statement input (e.g. SELECT 1; SELECT 2) is rejected with an explicit error before reaching the wire; a single optional trailing ; is allowed, and ; inside string literals, quoted identifiers, or comments is not treated as a separator.
• No INDEXES capability: Redshift has no true index structures, so TableDetails.indexes is always None rather than being synthesized from the (non-enforced) primary key.
• No triggers: Redshift does not support triggers, so none are discovered or surfaced.
• No IAM/SSO-based authentication. Only username/password (optionally via SSH tunnel) is supported; Redshift’s IAM-based GetClusterCredentials and browser SSO flows are not implemented.
• Client certificates for mutual TLS must be supplied as a PEM certificate plus a PKCS#8 PEM private key (the two are configured as separate file paths); a combined PKCS#12 bundle is not accepted. The PEM parsing and error handling of the root-CA / client-cert load path are covered by unit tests, but the end-to-end TLS handshake against a cluster fronted by a private CA or requiring a client certificate is validated only by an #[ignore]d live integration test (redshift_live_verify_full_with_private_ca_and_client_cert), since no local or Docker-based Redshift engine exists.
• No COPY/UNLOAD support and no data-transfer/bulk-export integration specific to Redshift.
• No query-plan visualization (EXPLAIN output is not parsed or rendered).
• No instance metrics or instance inspector (INSTANCE_METRICS/INSTANCE_INSPECTOR are not declared).
• The extended-type OID values used for SUPER/VARBYTE/GEOMETRY/GEOGRAPHY/HLLSKETCH, and the exact SVV_TABLE_INFO/PG_TABLE_DEF query shapes used for storage hints, are validated only by #[ignore]d live integration tests (crates/dbflux_driver_redshift/tests/live_integration.rs), since no local or Docker-based Redshift engine exists. Run them explicitly against a real cluster with cargo nextest run -p dbflux_driver_redshift --run-ignored all.
• NUMERIC/DECIMAL values ARE decoded: the driver parses the PostgreSQL binary NUMERIC wire format directly into an exact Value::Decimal string (integer/fractional reconstruction to the column’s declared scale, plus NaN/±Infinity). Malformed payloads fall back safely rather than corrupting data. The binary decoder is covered by unit tests over synthetic wire payloads; end-to-end fidelity is still validated only against a live cluster via the #[ignore]d integration tests.