Summary and recommendation
Amazon Redshift supports SCIM 2.0 provisioning, but only through AWS IAM Identity Center (formerly AWS SSO) as an intermediary layer. This means IT teams must first configure their IdP (Okta, Entra, etc.) to provision users into IAM Identity Center, which then federates authentication to Redshift. While this architecture provides full user lifecycle management—including create, update, deactivate, and group sync—it introduces significant operational complexity. Teams must maintain SCIM tokens that expire annually, ensure stable external identifiers across systems, and navigate the multi-step IAM Identity Center setup process that many IT admins find cumbersome.
This federated approach creates a dependency chain where any misconfiguration in IAM Identity Center breaks access to all connected AWS services, including Redshift. For data teams that need reliable access to their data warehouse, this architectural complexity often leads to manual user management workarounds that undermine the entire purpose of automated provisioning. The yearly token expiration requirement also creates an ongoing maintenance burden that catches many teams off-guard.
The strategic alternative
Redshift has no native SCIM. Automate offboarding, user access reviews, and license workflows across every app, including the ones without APIs. We maintain the integration layer underneath. You focus on judgment, not plumbing.
Quick SCIM facts
| SCIM available? | No |
| SCIM tier required | N/A |
| SSO required first? | Yes |
| SSO available? | Yes |
| SSO protocol | SAML 2.0 |
| Documentation | Official docs |
Supported identity providers
| IdP | SSO | SCIM | Notes |
|---|---|---|---|
| Okta | ✓ | ❌ | Configure Okta as IdP for AWS IAM Identity Center, then enable SCIM provisioning. Users/groups sync to IAM Identity Center and access Redshift via federation. |
| Microsoft Entra ID | ✓ | ❌ | Configure Azure AD as IdP for AWS IAM Identity Center with SCIM provisioning. Users/groups sync automatically. |
| Google Workspace | Via third-party | ❌ | No native support |
| OneLogin | Via third-party | ❌ | No native support |
The cost of not automating
Without SCIM (or an alternative like Stitchflow), your IT team manages Redshift accounts manually. Here's what that costs:
The Redshift pricing problem
Redshift gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.
Tier comparison
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| Serverless | From $1.50/hour | Via IAM Identity Center only | |
| Provisioned | From $0.543/hour | Via IAM Identity Center only | |
| Reserved Instances | Up to 75% discount | Via IAM Identity Center only |
Pricing structure
| Plan | Price | SCIM Support |
|---|---|---|
| Serverless | From $1.50/hour | Via IAM Identity Center only |
| Provisioned | From $0.543/hour | Via IAM Identity Center only |
| Reserved Instances | Up to 75% discount | Via IAM Identity Center only |
Additional costs
What this means in practice
This third-party dependency creates a multi-step provisioning flow that's prone to delays and troubleshooting complexity:
1. Configure your IdP → IAM Identity Center integration 2. Set up SCIM between IdP and IAM Identity Center 3. Configure federated access from IAM Identity Center → Redshift 4. Map user attributes across three different systems
When provisioning fails, you're troubleshooting across AWS IAM Identity Center, your IdP, and Redshift simultaneously. A single misconfiguration in the IAM Identity Center SAML/SCIM setup breaks access for your entire data team.
Additional constraints
Summary of challenges
- Redshift does not provide native SCIM at any price tier
- Organizations must rely on third-party tools or manual provisioning
- Our research shows teams manually provisioning this app spend significant hidden costs annually
What Redshift actually offers for identity
SAML SSO + SCIM (via AWS IAM Identity Center)
Amazon Redshift doesn't have native SCIM. Instead, it relies entirely on AWS IAM Identity Center (formerly AWS SSO) for both authentication and provisioning:
| Feature | Details |
|---|---|
| Protocol | SAML 2.0 for SSO, SCIM 2.0 for provisioning |
| Supported IdPs | Okta, Azure AD, Google Workspace, OneLogin, PingIdentity |
| Configuration | Configure your IdP as external identity source in IAM Identity Center |
| User access | Users authenticate via IAM Identity Center, then access Redshift through federation |
What SCIM provides through IAM Identity Center:
Key limitations of this approach
Setup complexity: You're not just configuring Redshift—you're configuring an entire AWS identity infrastructure layer. This requires:
Operational overhead:
Lock-in: This architecture ties your Redshift identity management to AWS IAM Identity Center, making it harder to migrate to other data warehouse solutions.
The bottom line: While technically functional, Redshift's identity approach requires significantly more AWS expertise and ongoing maintenance compared to applications with native SCIM support.
What IT admins are saying
Community sentiment on Redshift's provisioning centers around AWS IAM Identity Center complexity and maintenance overhead:
- Setting up IAM Identity Center as an intermediary step adds architectural complexity
- SCIM tokens expire annually, requiring manual renewal to maintain provisioning
- The federated authentication model creates confusion about where users actually exist
- Teams need AWS expertise just to configure basic user provisioning for their data warehouse
Requires IAM Identity Center setup... SCIM token expires yearly
Configure IdP there, then users access Redshift via federation
The recurring theme
Redshift forces IT teams to become AWS identity experts just to provision data warehouse users. The IAM Identity Center requirement adds an extra layer of complexity that most teams didn't expect when choosing a data warehouse solution.
The decision
| Your Situation | Recommendation |
|---|---|
| Small data team (<10 analysts) | Manual user management via AWS Console |
| Growing analytics team with AWS expertise | Set up AWS IAM Identity Center with SCIM |
| Large data organization (30+ users) | Use Stitchflow: IAM Identity Center complexity not worth it |
| Multi-cloud environment with mixed IdPs | Use Stitchflow: works with any IdP without AWS lock-in |
| Enterprise with compliance requirements | Use Stitchflow: automation essential for data access audit trails |
The bottom line
Redshift's SCIM provisioning requires setting up AWS IAM Identity Center—a complex enterprise service that most teams don't need just for data warehouse access. For organizations that want Redshift user automation without AWS infrastructure overhead, Stitchflow provides the direct path.
Make Redshift workflows AI-native
Redshift has no native SCIM. We build complete offboarding, user access reviews, and license workflows across every app, including the ones without APIs.
Technical specifications
SCIM Version
Not specifiedSupported Operations
Not specifiedSupported Attributes
Not specifiedPlan requirement
Not specifiedPrerequisites
Not specifiedKey limitations
- Requires IAM Identity Center setup
- SCIM token expires yearly
- externalId must be stable identifier
- First/Last/Username/Display required
Configuration for Okta
Integration type
Okta Integration Network (OIN) app
Prerequisite
SSO must be configured before enabling SCIM.
Where to enable
Configure Okta as IdP for AWS IAM Identity Center, then enable SCIM provisioning. Users/groups sync to IAM Identity Center and access Redshift via federation.
Use Stitchflow for automated provisioning.
Configuration for Entra ID
Integration type
Microsoft Entra Gallery app
Prerequisite
SSO must be configured before enabling SCIM.
Where to enable
Configure Azure AD as IdP for AWS IAM Identity Center with SCIM provisioning. Users/groups sync automatically.
Use Stitchflow for automated provisioning.
Unlock SCIM for
Redshift
Redshift has no native SCIM. We still automate end-to-end workflows across every app, including the ones without APIs.
See how it works


