Prepare source database

Prepare your source database, network setup, and database credentials for Data integration.

Redis Cloud

Prepare source database

Prepare every source database before adding it to a pipeline. Each source needs its own change data capture (CDC) configuration, connectivity, and credentials. See Prerequisites for a list of supported source databases and database versions.

See Prepare source databases to find steps for your database type:

See the RDI architecture overview for more information about CDC.

Supabase

You can use a hosted Supabase PostgreSQL database as the source for an RDI pipeline on Redis Cloud. The integration was validated with RDI 1.19.0 and hosted Supabase PostgreSQL 17.6.

First, follow the steps in Prepare Supabase for RDI to create the database role, grant table access, account for Row Level Security, and create a publication. Then complete the Redis Cloud-specific steps below.

Warning:

Supabase AWS PrivateLink connectivity isn't supported. Supabase shares a Resource Configuration through AWS Resource Access Manager and requires a Resource-type VPC endpoint. This differs from the AWS PrivateLink endpoint-service connectivity supported by RDI on Redis Cloud, so you can skip Set up AWS Private Link connectivity and use the Supabase public direct database endpoint instead.

Configure public connectivity

Supabase logical replication requires the direct database endpoint. Don't use a Supavisor transaction or session pooler endpoint.

The direct endpoint uses IPv6 by default, but RDI on Redis Cloud requires an IPv4 endpoint, so you must enable the Supabase dedicated IPv4 add-on (you need a paid Supabase plan to do this).

When you create the RDI pipeline:

Select PostgreSQL as the source type.
Select Public endpoint.
Copy every Redis Cloud outbound IP address displayed by the setup flow.
In Supabase, open Database settings > Network restrictions.
Add every Redis Cloud outbound address as a /32 CIDR.

If you recreate the RDI workspace, its outbound addresses can change. Add the new addresses to Supabase before starting the replacement pipeline, and remove the old addresses after the new connection succeeds.

Configure secrets

Follow the steps in Share source database credentials to create and share:

A credentials secret containing the dedicated Supabase username and password.
A plaintext CA certificate secret containing the certificate downloaded from Supabase Database settings > SSL configuration.

Encrypt both secrets with the customer-managed AWS KMS key configured for the RDI workspace. Use the AWS region that contains your Redis Cloud subscription.

In the pipeline's Secrets section:

Enter the credentials secret ARN.
Select TLS under Transit security.
Enter the CA certificate secret ARN.
Select Validate.

RDI on Redis Cloud uses TLS and validates the Supabase CA certificate.

Configure the source

In the RDI pipeline setup flow, open the source configuration and enter the following values:

Field	Value
Source IP address / Hostname	`db.<project-ref>.supabase.co`
Port	`5432`
Database	`postgres`

Under Collector properties, set:

Property	Value
`plugin.name`	`pgoutput`
`publication.name`	`rdi_publication`
`publication.autocreate.mode`	`disabled`
`slot.name`	A unique value, such as `rdi_supabase`

The publication name must match the publication you created in Supabase. Use a unique replication slot name for each active pipeline connected to the project.

Select Test source. After the test succeeds, select the schemas and tables to capture and deploy the pipeline.

Monitor the pipeline

After deployment:

Confirm the initial snapshot reaches zero pending and rejected records.
Insert, update, and delete test records in Supabase.
Confirm the corresponding counters increase in the pipeline metrics.

Supabase logical replication slots retain write-ahead log (WAL) while the pipeline is stopped. Follow the steps in Monitor replication slots to monitor retained WAL and prepare for Supabase PostgreSQL upgrades.

Get cluster account ID

Before you can set up your source connectivity and secrets, you need the AWS Account ID for your Redis Cloud cluster so that you can give it access to your connectivity and secrets.

On the Redis Cloud console, open your target database's Data Integration tab.
Select Add pipeline, or resume an existing draft. To add a source to a running pipeline, select Add source on its Dashboard.
For a new pipeline, complete Settings, including the target database, and select Continue.
In Add sources, select the source type and enter a unique Source name. This name identifies the source in the pipeline configuration and transformation jobs. See Add sources for naming rules.
Select Continue to open Configure source.
Under Source connectivity, copy the Role ARN and extract its AWS account ID.

The account ID is the number after arn:aws:iam::. For example, arn:aws:iam::123456789012:role/redis-data-pipeline contains account ID 123456789012.
For a source using Public Endpoint, also copy the Redis Cloud outbound IP address to add to the source database's allowlist.
Select Save & exit to return to setup after preparing connectivity and secrets.

Repeat the preparation for each source. Keep track of which endpoint service and secrets belong to each source; configuring one source does not configure the others.

Set up AWS Private Link connectivity

Note:

If your source database is accessible via a public endpoint and you want to use public connectivity for your data pipeline, proceed to Share source database credentials.

If your source database is not accessible via a public endpoint, you need to set up an endpoint service through AWS PrivateLink to be able to connect to it. For how traffic flows over PrivateLink, how to connect to an on-premises database over AWS Direct Connect, and how to keep the connection available during failover, see the AWS PrivateLink reference.

The following diagrams show the network setup for the different database setups:

Database hosted on an AWS EC2 instance:
Database hosted on AWS RDS or AWS Aurora:

Select the steps for your database setup.

EC2 instance AWS RDS or Aurora MongoDB Atlas

To set up PrivateLink for a database hosted on an EC2 instance:

Create a network load balancer that will route incoming HTTP requests to your database.
Create an endpoint service through AWS PrivateLink.

Create network load balancer

In the AWS Management Console, use the Services menu to locate and select Compute > EC2. Create a network load balancer with the following settings:

In Basic configuration:
- Scheme: Select Internal.
- Load balancer IP address type: Select IPv4.
In Network mapping, select the VPC and availability zone associated with your source database.
In Security groups, select the security group associated with your source database, or another security group that allows traffic from PrivateLink and allows traffic to the database.
In Listeners and routing:
1. Select Create target group to create a target group with the following settings:
  1. In Specify group details:
    - Target type: Select Instances.
    - Protocol : Port: Select TCP, and then enter the port number where your database is exposed.
    - The IP address type and VPC should be selected already and match the VPC you selected earlier.
  2. In Register targets, select the EC2 instance that runs your source database, enter the port, and select Include as pending below. Then, select Create target group to create your target group. Return to Listeners and routing in the Network Load Balancer setup.
2. Set the following Listener properties:
  - Protocol: Select TCP.
  - Port: Enter your source database's port.
  - Default action: Select the target group you created in the previous step.
Review the network load balancer settings, and then select Create load balancer to continue.
After the network load balancer is active, select Security.

If you selected the same security group as your source database, you must not enforce security group rules on PrivateLink traffic. Select Edit and then deselect Enforce inbound rules on PrivateLink traffic, and then select Save changes.
Select the security group ID to open the Security group settings.
Select Edit inbound rules, then Add rule to add a rule with the following settings:
- Type: Select HTTP.
- Source: Select Anywhere - IPv4. Select Save rules to save your changes.
Select Actions > Edit Load Balancer Attributes.
- Under Load balancer targets selection policy select Enable cross-zone load balancing. Click the Save Changes button.

Create endpoint service

In the AWS Management Console, use the Services menu to locate and select Networking & Content Delivery > VPC. There, select PrivateLink and Lattice > Endpoint services. Create an endpoint service with the following settings:

In Available load balancers, select the network load balancer you created.
In Additional settings, choose the following settings:
- Require acceptance for endpoint: Select Acceptance required.
- Supported IP address types: Select IPv4.
Select Create to create the endpoint service.

After you create the endpoint service, you need to add Redis Cloud as an Allowed Principal on your endpoint service VPC permissions.

In the Redis Cloud Console, copy the Amazon Resource Name (ARN) provided in the Setup connectivity section.
Return to the endpoint service list on the Amazon VPC console. Select the endpoint service you just created.
Navigate to Allow principals tab.
Add the Redis Cloud ARN you copied and choose Allow principals.
Save the service name for later.

For more details on AWS PrivateLink, see Share your services through AWS PrivateLink.

To set up PrivateLink for a database hosted on AWS RDS or AWS Aurora:

To connect to your RDS or Aurora database, we recommend using a Lambda function approach. This provides a reliable and secure connection method for all database types.

Create a network load balancer that will route incoming requests to your database.
Create an endpoint service through AWS PrivateLink.
Set up Lambda function connectivity to route requests to your database.

Note:

If you have specific requirements that necessitate using RDS Proxy instead of the recommended Lambda function approach, see the RDS Proxy setup guide. Note that RDS Proxy is not recommended and does not work with PostgreSQL.

Create network load balancer

In the AWS Management Console, use the Services menu to locate and select Compute > EC2. Create a network load balancer with the following settings:

In Basic configuration:
- Scheme: Select Internal.
- Load balancer IP address type: Select IPv4.
In Network mapping, select the VPC and availability zone associated with your source database.
In Security groups, select the security group associated with your source database, or another security group that allows traffic from PrivateLink and allows traffic to the database.
In Listeners and routing:
1. Select Create target group to create a target group with the following settings:
  1. In Specify group details:
    - Target type: Select IP Addresses.
    - Protocol : Port: Select TCP, and then enter the port number where your database is exposed.
    - The IP address type and VPC should be selected already and match the VPC you selected earlier.
  2. In Register targets, enter the static IP address of your database, enter the port, and select Include as pending below. Then, select Create target group to create your target group. Return to Listeners and routing in the Network Load Balancer setup.
    
    To get the static IP address of your database, run the following command on an EC2 instance in the same VPC as the database:
```
$ nslookup <database-endpoint>
```
    Replace <database-endpoint> with the endpoint of your RDS or Aurora database.
2. Set the following Listener properties:
  - Protocol: Select TCP.
  - Port: Enter your source database's port.
  - Default action: Select the target group you created in the previous step.
Review the network load balancer settings, and then select Create load balancer to continue.
After the network load balancer is active, select Security.

If you selected the same security group as your source database, you must not enforce security group rules on PrivateLink traffic. Select Edit and then deselect Enforce inbound rules on PrivateLink traffic, and then select Save changes.
Select the security group ID to open the Security group settings.
Select Edit inbound rules, then Add rule to add a rule with the following settings:
- Type: Select HTTP.
- Source: Select Anywhere - IPv4. Select Save rules to save your changes.
Select Actions > Edit Load Balancer Attributes.
- Under Load balancer targets selection policy select Enable cross-zone load balancing. Click the Save Changes button.

Create endpoint service

In Available load balancers, select the network load balancer you created.
In Additional settings, choose the following settings:
- Require acceptance for endpoint: Select Acceptance required.
- Supported IP address types: Select IPv4.
Select Create to create the endpoint service.

After you create the endpoint service, you need to add Redis Cloud as an Allowed Principal on your endpoint service VPC permissions.

In the Redis Cloud Console, copy the Amazon Resource Name (ARN) provided in the Setup connectivity section.
Return to the endpoint service list on the Amazon VPC console. Select the endpoint service you just created.
Navigate to Allow principals tab.
Add the Redis Cloud ARN you copied and choose Allow principals.
Save the service name for later.

For more details on AWS PrivateLink, see Share your services through AWS PrivateLink.

Set up Lambda function connectivity

Note:

Setting up the Lambda function is optional but recommended for production environments. The Lambda function provides automatic failover handling and a more robust connection to your RDS or Aurora database.

The Lambda function monitors RDS failover events and automatically updates the NLB Target Group to point to the new primary instance's IP address. This ensures RDI reconnects automatically after a failover.

Option 1: Use the Redis Terraform module

Redis provides a ready-to-use Terraform module that automates the Lambda function deployment. This is the recommended approach.

Prerequisites

Terraform >= 1.5.7
AWS CLI configured with credentials
The ARNs from the Network Load Balancer and Endpoint Service you created in the previous steps

Required variables

Before deploying the Lambda module, gather the following information:

Variable	Description	Where to find it
`identifier`	A unique name for the Lambda resources	Choose a descriptive name (e.g., `rdi-failover-handler`)
`db_endpoint`	Your RDS cluster or instance endpoint	AWS Console → RDS → Your database → Connectivity
`db_port`	Your database port	AWS Console → RDS → Your database → Connectivity (default: `5432` for PostgreSQL, `3306` for MySQL, `1433` for SQL Server)
`elb_tg_arn`	The NLB Target Group ARN	AWS Console → EC2 → Target Groups → Your target group
`rds_arn`	The RDS cluster or instance ARN	AWS Console → RDS → Your database → Configuration
`rds_cluster_identifier`	The RDS cluster identifier	AWS Console → RDS → Your cluster name

Deploy the Lambda module

Clone the Redis cloud automation repository:

git clone https://github.com/redis/rdi-cloud-automation.git
cd rdi-cloud-automation/modules/aws-rds-lambda

Create a terraform.tfvars file with your configuration:

identifier             = "rdi-failover-handler"
db_endpoint            = "your-cluster.cluster-xxxxxxxxx.us-east-1.rds.amazonaws.com"
db_port                = 5432
elb_tg_arn             = "arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/your-tg/xxxxxxxxx"
rds_arn                = "arn:aws:rds:us-east-1:123456789012:cluster:your-cluster"
rds_cluster_identifier = "your-cluster"

Initialize and apply Terraform:
```
terraform init
terraform apply
```

How the Lambda function works

The deployed Lambda function:

Monitors RDS events: Subscribes to RDS failover events via SNS
Detects failover: When a failover occurs, RDS triggers an SNS notification
Resolves new IP: The Lambda function queries DNS to get the new primary's IP address
Updates NLB target: Automatically updates the NLB Target Group with the new IP

This process typically completes within 30-60 seconds for Aurora, or 60-120 seconds for standard RDS.

Verify the deployment

After deployment, verify the Lambda function is configured correctly:

Check the Lambda function in AWS Console → Lambda → Functions
Verify the environment variables are set correctly:
- Cluster_EndPoint: Your RDS endpoint
- RDS_Port: Your database port
- NLB_TG_ARN: Your NLB Target Group ARN
Check the SNS subscription in AWS Console → SNS → Subscriptions

Option 2: Full infrastructure deployment

For new deployments, Redis provides a complete Terraform example that deploys the entire infrastructure including the RDS database, NLB, PrivateLink, and Lambda function.

See the AWS RDS PrivateLink Failover Example for:

Multi-engine support (PostgreSQL, MySQL, SQL Server)
Automatic CDC user creation
Complete VPC and networking setup
Lambda-based failover handling

Option 3: Manual Lambda setup

For custom implementations, refer to the AWS documentation: Access Amazon RDS across VPCs using AWS PrivateLink and Network Load Balancer

To set up Private Link for a MongoDB Atlas source database:

MongoDB Atlas manages its own endpoint service. The flow is a two-way handshake — you get an endpoint service ID from Atlas, give it to Redis Cloud, and then take the VPC Endpoint ID that Redis Cloud returns back to Atlas to complete the connection.

Note:

Create the Atlas private endpoint in the same AWS region as your Redis Cloud target database.

Create a private endpoint in MongoDB Atlas

In the MongoDB Atlas UI, go to Security > Network Access.
Select the Private Endpoint tab, then select Dedicated Cluster.
Select Add Private Endpoint.
- Select AWS as the cloud provider.
- Select the AWS region that matches your Redis Cloud target database.
- Select Next.
Atlas displays an Endpoint Service ID (for example, vpce-svc-xxxxxxxxxxxxxxxxx). Copy this value.

Register the endpoint service with Redis Cloud

In the Redis Cloud console, in the pipeline creation flow, go to the Source connectivity step.
In the Private Link service name field, paste the Endpoint Service ID you copied from Atlas.
Redis Cloud creates a VPC endpoint and displays a VPC Endpoint ID (for example, vpce-xxxxxxxxxxxxxxxxx). Copy this value.

Complete the connection in MongoDB Atlas

Return to the Add Private Endpoint page in the Atlas UI. In the Your VPC Endpoint ID field, enter the VPC Endpoint ID you copied from the Redis Cloud console. Select Create.
Wait for the endpoint status to show as Available. This can take a few minutes.
In the Atlas UI, go to your cluster and select Connect > Private Endpoint.
Choose the private endpoint you just registered (the vpce- ID you entered above).
Choose a connection method, then select Shell.
Copy the connection string shown.

Note:

Copy the connection string from the Private Endpoint connection method only. The standard connection string does not route traffic through the private endpoint.

Finish pipeline setup

Return to the Redis Cloud pipeline creation flow and paste the connection string into the Source configuration section.

Share the credentials and certificates for each source through AWS Secrets Manager. Enter the matching secret ARNs when you configure that source in the console.

To do this, you need to:

Create an encryption key using AWS Key Management Service with the right permissions.
Create secrets containing the source database credentials encrypted using that key.

Create encryption key

In the AWS Management Console, use the Services menu to locate and select Security, Identity, and Compliance > Key Management Service. Create an encryption key with the following settings:

In Step 1 - Configure key:
- Key type: Select Symmetric.
- Key usage: Select Encrypt and decrypt.
- Under Advanced options, set the following:
  - Key material origin: Select KMS - recommended.
  - Regionality: Select Single-Region key.
In Step 2 - Add labels, add an alias and description for the key.
In Step 3 - Define key administrative permissions, under Key deletion, select Allow key administrators to delete this key.
In Step 4 - Define key usage permissions, under Other AWS accounts, select Add another AWS account. Enter the AWS account ID for the Redis Cloud cluster that you saved earlier.

Review the key policy and key settings, and then select Finish to create the key.

Create database credentials secrets

To let Redis Cloud access your source database, you need to create AWS secrets for the source database's credentials and certificates.

The required secrets depend on your source database's security configuration. The following table shows the required secrets for each configuration:

Security configuration	Required secrets
Username and password only	Credentials secret (username and password for the RDI pipeline user)
Username and key pair only (Snowflake source databases only)	Credentials secret (username for the RDI pipeline user) Private key secret
TLS connection	Credentials secret (username and password for the RDI pipeline user) CA Certificate secret (server certificate)
mTLS connection	Credentials secret (username and password for the RDI pipeline user) CA Certificate secret (server certificate) Client certificate secret Client key secret
mTLS connection with client key passphrase	Credentials secret (username and password for the RDI pipeline user) CA Certificate secret (server certificate) Client certificate secret Client key secret Client key passphrase secret

Note:

When creating secrets for TLS or mTLS, ensure that all certificates and keys are in PEM format. The only exception to this is that for PostgreSQL, the source's private key secret must be in DER format. If you have a key in PEM format, you must convert it to DER before creating the secret using the command:

openssl pkcs8 -topk8 -inform PEM -outform DER \
    -in /path/to/myclient.pem \
    -out /path/to/myclient.pk8 -nocrypt

This command assumes that the private key is not encrypted. See the openssl documentation to learn how to convert an encrypted private key.

Select a tab to learn how to create the required secret.

Credentials secret CA Certificate secret Client certificate secret Client key secret Client key passphrase secret Private key secret

In the AWS Management Console, use the Services menu to locate and select Security, Identity, and Compliance > Secrets Manager. Create a secret of type Other type of secret with the following settings:

Key/value pairs: Enter the following key/value pairs.
- username: Database username for the RDI pipeline user
- password: Database password for the RDI pipeline user
Note:

Snowflake source databases that use user/key pair authentication should only enter the username for the database.
Encryption key: Select the encryption key you created earlier.
Resource permissions: Add the following permissions to your secret to allow the Redis data pipeline to access your secret. Replace <AWS ACCOUNT ID> with the AWS account ID for the Redis Cloud cluster that you saved earlier.

{
    "Version" : "2012-10-17",
    "Statement" : [ {
        "Sid" : "RedisDataIntegrationRoleAccess",
        "Effect" : "Allow",
        "Principal" : "*",
        "Action" : [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ],
        "Resource" : "*",
        "Condition" : {
            "StringLike" : {
                "aws:PrincipalArn" : "arn:aws:iam::<AWS ACCOUNT ID>:role/redis-data-pipeline-secrets-role"
            }
        }
    } ]
}

After you store this secret, you can view and copy the Amazon Resource Name (ARN) of your secret on the secret details page. Save the secret ARN to use when you define your source database.

Key/value pairs: Select Plaintext and enter the server certificate.
Encryption key: Select the encryption key you created earlier.
Resource permissions: Add the following permissions to your secret to allow the Redis data pipeline to access your secret. Replace <AWS ACCOUNT ID> with the AWS account ID for the Redis Cloud cluster that you saved earlier.

{
    "Version" : "2012-10-17",
    "Statement" : [ {
        "Sid" : "RedisDataIntegrationRoleAccess",
        "Effect" : "Allow",
        "Principal" : "*",
        "Action" : [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ],
        "Resource" : "*",
        "Condition" : {
            "StringLike" : {
                "aws:PrincipalArn" : "arn:aws:iam::<AWS ACCOUNT ID>:role/redis-data-pipeline-secrets-role"
            }
        }
    } ]
}

After you store this secret, you can view and copy the Amazon Resource Name (ARN) of your secret on the secret details page. Save the secret ARN to use when you define your source database.

Key/value pairs: Select Plaintext and enter the client certificate.
Encryption key: Select the encryption key you created earlier.
Resource permissions: Add the following permissions to your secret to allow the Redis data pipeline to access your secret. Replace <AWS ACCOUNT ID> with the AWS account ID for the Redis Cloud cluster that you saved earlier.

{
    "Version" : "2012-10-17",
    "Statement" : [ {
        "Sid" : "RedisDataIntegrationRoleAccess",
        "Effect" : "Allow",
        "Principal" : "*",
        "Action" : [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ],
        "Resource" : "*",
        "Condition" : {
            "StringLike" : {
                "aws:PrincipalArn" : "arn:aws:iam::<AWS ACCOUNT ID>:role/redis-data-pipeline-secrets-role"
            }
        }
    } ]
}

After you store this secret, you can view and copy the Amazon Resource Name (ARN) of your secret on the secret details page. Save the secret ARN to use when you define your source database.

Use the AWS CLI create-secret command or the AWS CreateSecret API endpoint to create a binary secret containing the client key.

For example, using the AWS CLI, run the following command:

aws secretsmanager create-secret \
    --name <secret-name> \
    --secret-binary fileb://<path-to-client-key> \
    --kms-key-id <encryption-key-arn>

Where:

<secret-name> - Name of the secret
<path-to-client-key> - Path to the client key file
<encryption-key-arn> - ARN of the encryption key you created earlier

After you create the secret, you need to add permissions to allow the data pipeline to access it.

In the AWS Management Console, use the Services menu to locate and select Security, Identity, and Compliance > Secrets Manager. Select the private key secret you just created and then select Edit permissions.

Add the following permissions to your secret. Replace <AWS ACCOUNT ID> with the AWS account ID for the Redis Cloud cluster that you saved earlier.

{
    "Version" : "2012-10-17",
    "Statement" : [ {
        "Sid" : "RedisDataIntegrationRoleAccess",
        "Effect" : "Allow",
        "Principal" : "*",
        "Action" : [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ],
        "Resource" : "*",
        "Condition" : {
            "StringLike" : {
                "aws:PrincipalArn" : "arn:aws:iam::<AWS ACCOUNT ID>:role/redis-data-pipeline-secrets-role"
            }
        }
    } ]
}

After you store this secret, you can view and copy the Amazon Resource Name (ARN) of your secret on the secret details page. Save the secret ARN to use when you define your source database.

Key/value pairs: Select Plaintext and enter the client key passphrase.
Encryption key: Select the encryption key you created earlier.
Resource permissions: Add the following permissions to your secret to allow the Redis data pipeline to access your secret. Replace <AWS ACCOUNT ID> with the AWS account ID for the Redis Cloud cluster that you saved earlier.

{
    "Version" : "2012-10-17",
    "Statement" : [ {
        "Sid" : "RedisDataIntegrationRoleAccess",
        "Effect" : "Allow",
        "Principal" : "*",
        "Action" : [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ],
        "Resource" : "*",
        "Condition" : {
            "StringLike" : {
                "aws:PrincipalArn" : "arn:aws:iam::<AWS ACCOUNT ID>:role/redis-data-pipeline-secrets-role"
            }
        }
    } ]
}

After you store this secret, you can view and copy the Amazon Resource Name (ARN) of your secret on the secret details page. Save the secret ARN to use when you define your source database.

This secret is required for Snowflake source databases that use key-pair authentication.

Key/value pairs: Select Plaintext and enter the private key in plain text PEM format.
Encryption key: Select the encryption key you created earlier.
Resource permissions: Add the following permissions to your secret to allow the Redis data pipeline to access your secret. Replace <AWS ACCOUNT ID> with the AWS account ID for the Redis Cloud cluster that you saved earlier.

{
    "Version" : "2012-10-17",
    "Statement" : [ {
        "Sid" : "RedisDataIntegrationRoleAccess",
        "Effect" : "Allow",
        "Principal" : "*",
        "Action" : [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ],
        "Resource" : "*",
        "Condition" : {
            "StringLike" : {
                "aws:PrincipalArn" : "arn:aws:iam::<AWS ACCOUNT ID>:role/redis-data-pipeline-secrets-role"
            }
        }
    } ]
}

After you store this secret, you can view and copy the Amazon Resource Name (ARN) of your secret on the secret details page. Save the secret ARN to use when you define your source database.

Next steps

After you have prepared connectivity and credentials for each source, resume your pipeline draft from the workspace and complete Configure source. Continue with Create data pipeline.

	Products	Version
	Develop with Redis Clients, data types, programmability, and Redis for AI. RedisVL is listed separately.
	Libraries and tools Client libraries, observability, and cloud integrations. Redis Data Integration is listed separately.
	RedisVL
	Redis Software
	Redis Cloud
	Redis for Kubernetes
	Redis Open Source
	Redis Iris context engine
	Redis Feature Form
	Redis Insight
	Redis Data Integration
	Glossary
	Command reference

Prepare source database