Amazon Redshift Connector – IAM Connection vs Basic Connection

Basic connection :
The basic connection type authenticates directly to the Redshift database using a static username and password. No AWS IAM layer is involved. While simple to configure, this approach relies on long-lived static credentials, which is generally considered less secure than token-based alternatives.

IAM connection:
The IAM connection type introduces an AWS identity layer on top of the standard database connection. Instead of using static database credentials, the connector uses IAM credentials or an IAM Role ARN to generate temporary credentials via the AWS Security Token Service (STS). Both connection types ultimately connect to Redshift via JDBC, so database-level details such as host, port, and database name are always required regardless of which type is used.

Why Access Key and Secret Key appear in IAM connection: 
The Access Key and Secret Key fields in the IAM connection configuration are a legacy UI requirement. When a Role ARN is configured, the connector uses the AssumeRole mechanism via AWS STS to obtain temporary credentials automatically, and the manually entered keys are not used at runtime.

The connector handles two internal scenarios. Without a Role ARN, it uses the provided AWS credentials directly to retrieve temporary database credentials. With a Role ARN, it first assumes the specified IAM role to obtain new temporary AWS credentials, then uses those to retrieve temporary database credentials.