Pro · Lesson 2 of 9
Create a Serverless workgroup or an RA3 cluster, then connect without leaving the endpoint open to the world.
Sign in to save your place.
A Redshift warehouse is a room full of people who each own a slice of the filing cabinets. You either rent a fixed room, a provisioned cluster, or you ask Amazon to open a room only while you are asking questions, which is Redshift Serverless. Both rooms read the same kind of SQL. The bill and the knobs differ.
Start in the AWS console in the region where the data already lives. Redshift Serverless creates a workgroup and a namespace. You set a base capacity in Redshift Processing Units and a maximum so a curious query cannot scale the bill without a ceiling. A provisioned cluster is a leader node plus compute nodes that exist until you pause or delete them. New work should use RA3 nodes, which keep compute and managed storage separate, or Serverless. DC2 is a previous dense-compute generation. Do not copy an old tutorial that starts you on DC2 unless you are maintaining a cluster that already uses it.
This course does not quote a price. Node sizes, RPU rates, and regions change. Read the current Amazon Redshift pricing page before you leave a warehouse running.
| Choice | You size | Idle behavior |
|---|---|---|
| Serverless workgroup | Base and max RPU | Scales with usage, within the limits you set |
| RA3 provisioned | Node type and node count | The cluster exists until you pause or delete it |
| DC2 provisioned | Older fixed local disks | Keep it only if you already run it |
Put the warehouse in a VPC subnet group. For a lesson, a publicly reachable endpoint plus a security group that allows your IP on port 5439 is enough. For anything real, keep it private and reach it through a bastion, a VPN, or the Query Editor v2 inside AWS. Create an admin password or use IAM, and do not reuse a personal password from another system.
Query Editor v2 is the fastest first client. DBeaver, DataGrip, and psql also work because the wire protocol is PostgreSQL-like. The default database name on a new cluster is often dev. Rename your real database to something you can say out loud.
psql "host=your-workgroup.account.region.redshift-serverless.amazonaws.com port=5439 dbname=dev user=admin sslmode=require"A provisioned cluster bills while it exists. Pause or delete it. On Serverless, set a low base and a max, and delete the workgroup if you will not return this week.
A connection fails if any one of these is closed.
Step 1 of 3Your IAM user or role must be allowed to create the cluster or workgroup and to get credentials for it.
IAM → Policies → AmazonRedshiftFullAccess (lab only)
Step 2 of 3The security group must allow inbound traffic on port 5439 from your IP. If it doesn't, the connection simply times out.
Security group → Inbound rule → TCP 5439 → My IP
Step 3 of 3Only then can a database user connect from Query Editor v2 or a SQL client and run a query.
SELECT current_user, version();Run SELECT current_user, current_database(); from Query Editor v2. If it hangs, the security group or the route is wrong. If it refuses the password, fix the credential before you change the node type.
Checked against vendor documentation in October 2026. Screens and plan names still change, so confirm the control in your own instance.