Example: Connect Redshift from the Monte Carlo cloud with Claude

This example connects a publicly reachable Redshift Serverless workgroup from Monte Carlo's cloud, with Monte Carlo storing the password. No agent is involved. If Redshift is private, or the credentials must stay in your own AWS Secrets Manager, see Connect Redshift through a collection agent.

Before you start

• Claude with the Agent Toolkit plugin, signed in to the Monte Carlo MCP server. See Agent Toolkit.
• The Monte Carlo CLI (montecarlo), with a profile for your account: montecarlo whoami shows it. The older montecarlodata Python CLI installs a command with the same name; montecarlo deployments --help succeeds only with the right one.
• Network access from Monte Carlo: the workgroup (or cluster) is publicly accessible, and its security group allows port 5439 from your account's Collection IPs, listed in Settings → Account information. Allow only those addresses.
• A Redshift user with the grants in Redshift, and at least one table.

1. Ask Claude

/monte-carlo-onboarding connect our Redshift Serverless workgroup from the Monte Carlo cloud deployment (no agent); Monte Carlo can store the password

Claude reads your account. In this example it listed the existing deployments, confirmed that the CLI can create Monte Carlo-managed Redshift credentials, and chose to reuse the existing cloud deployment, so nothing new was provisioned. It said up front that it never handles the password: you run one CLI command and send back only the id it prints. Because a Redshift connection already existed through an agent, it asked whether this was the same workgroup: a second connection would collect the same metadata and query logs twice. It also asked about network access and grants, and for the host, port, database, user and names.

2. Answer Claude's questions

Answers:
1. A different workgroup; nothing else monitors it.
2. It's publicly accessible; its security group allows 5439 only from our Collection IPs.
3. The user has the grants from the Redshift docs.
4. Host <workgroup>.<account-id>.<region>.redshift-serverless.amazonaws.com, port 5439,
   database <database>, user <monte-carlo-user>.
   Warehouse name <warehouse-name>, connection <connection-name>.
Approved, go ahead.

3. Validate and store the login

Claude gives you these commands. Validate first: it runs the checks from the cloud deployment and creates nothing. Create the credentials only if every check passed. --password-prompt asks for the password at a hidden prompt, so it isn't shown, saved in your shell history, or visible in the process list:

RS_HOST=<workgroup>.<account-id>.<region>.redshift-serverless.amazonaws.com
RS_PORT=5439
RS_DB=<database>
RS_USER=<monte-carlo-user>
DEP=<cloud-deployment-id>

montecarlo credentials validate redshift \
  --deployment-id "${DEP}" \
  --host "${RS_HOST}" --port "${RS_PORT}" \
  --db-name "${RS_DB}" --user "${RS_USER}" \
  --password-prompt

montecarlo credentials create redshift \
  --host "${RS_HOST}" --port "${RS_PORT}" \
  --db-name "${RS_DB}" --user "${RS_USER}" \
  --password-prompt

In this example the validation passed 14/14, with two non-blocking warnings (external tables and datashares, see below). Send Claude the result and the credentials id only, never the password.

Claude won't write a command that reads the password from a secret store for you, even piped into the CLI: a mistake in such a command prints the password. If you script it yourself, --password @/dev/stdin reads it from a pipe; @<path> reads it from a file.

To manage these credentials with Terraform instead, ask Claude for the Terraform version: it uses montecarlo_redshift_credentials with the password as a write-only argument (Terraform 1.11 or later), so it isn't stored in the Terraform state.

4. Claude finishes

Claude creates the warehouse only after your credentials exist, so a failed check doesn't leave an empty warehouse behind. In this example the connection passed 14/14. The default jobs are metadata, query_logs, sql_query, json_schema and direct_lineage. The run ends with:

Created in this run
  credentials   <id>  redshift  mc_managed  (created by you with the CLI)
  warehouse     <id>  <warehouse-name>  redshift
  connection    <id>  <connection-name>  redshift
  validation    <id>  passed  14/14 passed  (1 warning: External tables)

Reused (excluded from cleanup)
  deployment    <id>  Monte Carlo Cloud  CLOUD  enabled=true

Cleanup if you abandon this: delete_connection → delete_warehouse → delete_credentials.
Leave the cloud deployment: other connections use it.

Collection starts on its own; the first metadata appears within about an hour.

Warnings

Troubleshooting