> ## Documentation Index
> Fetch the complete documentation index at: https://docs.genloop.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Redshift

> Connect an Amazon Redshift cluster to Genloop with cluster endpoint and read-only credentials, optionally through an SSH tunnel, and query your warehouse in natural language.

Genloop connects to Amazon Redshift over a direct connection using a read-only user. It reads your schema and the tables you select, and never writes to your cluster.

## Before you connect

* A Redshift user with read access to the tables you want to query.
* Network access from Genloop. If your cluster is in a VPC, allow Genloop's regional IP address in the cluster's security group. See [Before you begin](/using-genloop/connections/connect-a-database#before-you-begin).

## Connection fields

| Field               | Description                                                   |
| ------------------- | ------------------------------------------------------------- |
| **Connection name** | A name to identify this connection in Genloop                 |
| **Host**            | Your Redshift cluster endpoint                                |
| **Port**            | The port your Redshift cluster listens on. Defaults to `5439` |
| **Database**        | Name of the Redshift database to connect                      |
| **Username**        | Redshift user Genloop connects as                             |
| **Password**        | Password for that user                                        |

## Connect through an SSH tunnel

If the cluster is not reachable directly, reach it through a bastion or jump host. Turn on **Connect via SSH tunnel** in the connection form and complete these fields.

| Field                   | Description                                                                               |
| ----------------------- | ----------------------------------------------------------------------------------------- |
| **SSH host**            | Public IP or DNS of the bastion. Cannot be `localhost`                                    |
| **SSH port**            | SSH port on the bastion. Default is `22`                                                  |
| **SSH username**        | User Genloop signs in to the bastion as                                                   |
| **PEM key**             | Your private key file. Sent encrypted with the rest of the credentials                    |
| **Remote bind address** | Cluster host as seen from the bastion. Use `127.0.0.1` if the cluster runs on the bastion |
| **Remote bind port**    | Cluster port as reached from the bastion                                                  |

## Permissions

Genloop only reads your data and never writes to your cluster. You can connect with any user that already has read access to the tables you select.

If you want a dedicated read-only user for Genloop, ask your database administrator to set one up.

<Accordion title="Minimal read-only grant (for your database administrator)">
  Run this in your Redshift database:

  ```sql theme={null}
  GRANT USAGE ON SCHEMA public TO genloop_user;
  GRANT SELECT ON ALL TABLES IN SCHEMA public TO genloop_user;
  ```
</Accordion>

## Next steps

<CardGroup cols={2}>
  <Card title="Connect a database" icon="database" href="/using-genloop/connections/connect-a-database">
    Back to the full connection flow.
  </Card>

  <Card title="Context Hub" icon="brain" href="/using-genloop/context-hub">
    View and edit the memory built from your connection.
  </Card>
</CardGroup>