# Connect Amazon Redshift to your AI client

> Connect Amazon Redshift to Bonnard through a read-only user and an IP allowlist, the first step to querying it from Claude, ChatGPT or another AI client.

Updated: 2026-10-12

To chart Amazon Redshift data in Claude, ChatGPT or another AI client, connect it here, then create an app on it.
Bonnard reads Amazon Redshift through a read-only user, so your apps query only what you grant.

[Video: Connecting Amazon Redshift: the Data page, the Amazon Redshift form, Test & connect, the tenancy choice, and Connection saved]

## Requirements

- The Admin role in your Bonnard workspace.
- A Redshift user that can create users, such as a superuser.
- A cluster or Serverless workgroup that is publicly accessible.

## 1. Create a read-only user

Bonnard connects as this user. Agents can query only the tables it can read.

```sql
-- A user that can log in but cannot create databases or users
CREATE USER mcp_reader PASSWORD '<password>' NOCREATEDB NOCREATEUSER;

-- Run these two lines once for each schema apps should query
GRANT USAGE ON SCHEMA <schema> TO mcp_reader;
GRANT SELECT ON <schema>.<table_1>, <schema>.<table_2> TO mcp_reader;
```

Replace `<password>`, `<schema>` and the table names with your own. Grant tables you add later the same way.

## 2. Allow Bonnard's IP addresses

If your database limits who can connect, allow Bonnard's IP addresses on port `5439`. The connect form lists them
under **Allow our IP addresses**. Bonnard cannot reach databases on a private network. On Redshift, add them as
inbound rules to the VPC security group of the cluster or workgroup.

## 3. Add the connection

1. In the console at `app.bonnard.ai`, select **Data**, then **Redshift**.
   [Image: The Data page with Redshift under Databases]
2. Enter a **Connection name** and the user's details from the table below.
   [Image: The Amazon Redshift connection form]
3. Select **Test & connect**. Bonnard logs in as the user and reads the tables it can see.

Table: Amazon Redshift connection fields

| Field | Enter |
| --- | --- |
| **Connection name** | A name for this database in Bonnard, such as `Production`. |
| **Endpoint** | The cluster or workgroup endpoint, without the port or database. |
| **Port** | `5439`, unless your cluster or workgroup uses another port. |
| **Database** | The database to read, such as `dev`. |
| **User** and **Password** | The read-only user from step 1, such as `mcp_reader`. |
| **SSL mode** | Keep `verify-full`. |

## 4. Choose the tenancy

Choose how callers see the data, then select **Save & continue**.

Table: Tenancy options

| Option | Use it when |
| --- | --- |
| **No tenancy** | Every caller should see the same data. |
| **Multi-tenant (RLS)** | Your row-level security policies decide each caller's rows. They read the caller's tenant (the customer they belong to) from `current_setting('app.tenant_id')`. |
| **Schema per tenant** | Each tenant's tables sit in their own schema, named by a pattern such as `customer_{tenant}`. |

[Image: The tenancy step for Amazon Redshift]

**Connection saved** shows the number of tables discovered.

[Image: Connection saved, with the tables discovered]

## Troubleshooting

- `Host resolves to a private or reserved address.` Turn on public accessibility for the cluster or workgroup.
- The test times out. Check that Bonnard's IP addresses are allowed (step 2).
- `Connected, but introspect failed: <message>` The user cannot read the table list. Fix what the message names.
- A table is missing. Grant `SELECT` on it, then select **Re-introspect** on the database's **Tables** tab.
- Any other error is Redshift's own message. Check the field it names, then select **Test & connect** again.

## Charts in your AI client

[Create an app](https://bonnard.ai/docs/apps/create-an-app.md) on this database, so AI clients such as Claude and ChatGPT can query it and draw charts.