How to Audit Access in Amazon Redshift

What is Redshift access auditing?

Redshift access auditing captures login events and query activity so you can see who accessed what data and when.

How do I enable audit logging in Amazon Redshift?

Set enable_user_activity_logging = true in the cluster parameter group, configure an S3 log destination, then reboot. Redshift starts writing connection, user, and query logs to STL tables and copies them to S3 every five minutes.

Which system tables record access events?

stl_connection_log stores successful logins, stl_userlog captures failed logins, svl_qlog details table-level reads/writes, and svl_statementtext holds full SQL text. Join these tables for complete visibility.

How can I list the last 24 hours of logins?

SELECT event_time, username, remotehost, ssl FROM stl_connection_log WHERE event_time >= dateadd('hour',-24,current_timestamp) ORDER BY event_time DESC;

How can I find who queried the Customers table?

SELECT username,starttime,query FROM svl_qlog WHERE tbl = (SELECT oid FROM pg_table_def WHERE tablename='customers') AND starttime >= dateadd('day',-1,current_timestamp);

Example: detect abnormal reads on customer emails

The query below groups yesterday’s reads on Customers so you can spot outliers quickly.

Best practices for Redshift access auditing

Unload or copy audit logs to S3 daily, retain at least 90 days, monitor stl_userlog for repeated failures, and stream logs to CloudWatch/SIEM for real-time alerts.

Common mistakes

Not enabling logging: STL/SVL tables stay empty. Fix by turning on enable_user_activity_logging and rebooting.

Ignoring retention: STL tables purge after a few days. Schedule nightly UNLOAD jobs or automate S3 exports.

Need a faster way?

Galaxy’s AI copilot can generate these audit queries instantly, let you endorse them in Collections, and share with security teams—no more copy-pasting SQL in Slack.