Amazon Redshift will no longer support the creation of new Python UDFs starting Patch 198. Existing Python UDFs will continue to function until June 30, 2026. For more information, see the [ blog post ](https://aws.amazon.com/blogs/big-data/amazon-redshift-python-user-defined-functions-will-reach-end-of-support-after-june-30-2026/).
# Workgroups and namespaces
To isolate workloads and manage different resources in Amazon Redshift Serverless, you can create namespaces and workgroups and manage storage and compute resources separately.
A namespace is a collection of database objects and users. The storage-related namespace groups together schemas, tables, users, or AWS Key Management Service keys for encrypting data. Storage properties include the database name and password of the admin user, permissions, and encryption and security. Other resources that are grouped under namespaces include datashares, recovery points, and usage limits. You can configure these storage properties using the Amazon Redshift Serverless console, the AWS Command Line Interface, or the Amazon Redshift Serverless APIs for the specific resource.
Workgroup is a collection of compute resources. The compute-related workgroup groups together compute resources like RPUs, VPC subnet groups, and security groups. Properties for the workgroup include network and security settings. Other resources that are grouped under workgroups include access and usage limits. You can configure these compute properties using the Amazon Redshift Serverless console, the AWS Command Line Interface, or the Amazon Redshift Serverless APIs.
You can create one or more namespaces and workgroups. Each namespace can have only one workgroup associated with it. Conversely, each workgroup can be associated with only one namespace.
## Workgroups and namespaces using the console
Setting up Amazon Redshift Serverless involves walking through several configuration steps. When you follow the steps to set up Amazon Redshift Serverless, you create a namespace and workgroup, and associate them with each other. To get started setting Amazon Redshift Serverless configuration using the Amazon Redshift Serverless console, you can choose **Get started with Amazon Redshift Serverless** to set up Amazon Redshift Serverless and begin to interact with it. You can choose an environment with default settings, which makes for quicker setup, or explicitly configure the settings per your organization's requirements.During this process, you specify settings for your workgroup and namespace.
After you set up the environment, [Workgroup properties](serverless-console-workgroups.md#serverless-workgroup-describe) and [Namespace properties](serverless-console-configure-namespace-working.md#serverless-console-namespace-config) help you get familiar with the settings.
## Workgroups and namespaces using the AWS Command Line Interface and Amazon Redshift Serverless API
Aside from using the AWS console, you can also use the AWS CLI or the Amazon Redshift Serverless API to interact with workgroups and namespaces. The table below lists the API and CLI operations you can use to manage snapshots and recovery points.
| API operation | CLI command | Description |
| --- | --- | --- |
| [CreateNamespace](https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_CreateNamespace.html) | create-namespace | Creates a namespace. By default, Amazon Redshift Serverless creates namespaces with a default AWS Key Management Service key, but you can specify another key to encrypt your data. You can also create a namespace by restoring a snapshot. See [Working with snapshots and recovery points](https://docs.aws.amazon.com/redshift/latest/mgmt/serverless-snapshots-recovery.html) for more information. |
| [UpdateNamespace](https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_UpdateNamespace.html) | update-namespace | Updates a namespace. |
| [GetNamespace](https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_GetNamespace.html) | get-namespace | Retrieves information about a namespace |
| [ListNamepaces](https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_ListNamespaces.html) | list-namespaces | Retrieves information about a list of namespaces. |
| [DeleteNamespace](https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_DeleteNamespace.html) | delete-namespace | Deletes a namespace. |
| [CreateWorkgroup](https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_CreateWorkgroup.html) | create-workgroup | Creates a workgroup. When creating a workgroup, make sure that you have an existing namespace that you can associate with the workgroup. When creating the workgroup, you can specify compute resources such as subnets, security groups, and RPUs. |
| [UpdateWorkgroup](https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_UpdateWorkgroup.html) | update-workgroup | Updates a workgroup. |
| [GetWorkgroup](https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_GetWorkgroup.html) | get-workgroup | Retrieves information about a workgroup. |
| [ListWorkgroups](https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_ListWorkgroups.html) | list-workgroups | Retrieves information about a list of workgroups. |
| [DeleteWorkgroup](https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_DeleteWorkgroup.html) | delete-workgroup | Deletes a workgroup. |
# Workgroups
With Amazon Redshift Serverless, you can create and manage workgroups to isolate and control compute resources for different workloads or users. Workgroups allow you to set configuration options like memory and concurrency scaling limits, and prioritize query execution across workloads. The compute-related workgroup groups together compute resources like RPUs and VPC subnet groups.
# Creating a workgroup with a namespace
Complete the following steps to create a workgroup. For more information about workgroup configuration, see [Workgroup properties](serverless-console-workgroups.md#serverless-workgroup-describe).
1. Choose the **Serverless dashboard**. Then choose **Create workgroup**.
1. Enter the workgroup name.
1. Choose an **IP address type** for the workgroup. Choices include:
+ **IPv4** – With this option, your AWS resources only communicate over the IPv4 addressing protocol.
+ **Dual-stack mode** – With this option, your AWS resources can communicate over the IPv4, IPv6, or both addressing protocols. Also, you must associate an IPv6 CIDR block with the VPC and subnets used for your workgroup in the Amazon VPC. You can use the Amazon VPC console to create an Amazon VPC or update an existing Amazon VPC to use IPv6 addressing. For more information, see [IPv6 support for your VPC;](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-migrate-ipv6.html) in the *Amazon VPC User Guide*.
1. Choose a **Virtual private cloud (VPC)** for Amazon Redshift Serverless. This assigns the workgroup to a specific virtual network in your AWS environment. When using **dual-stack mode**, the Amazon VPC you choose must support IPV6 addressing. For more information about an Amazon VPC, see [Overview of VPCs and subnets](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html).
1. Choose one or more **VPC security groups**. For more information, see [Control traffic to resources using security groups](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html).
1. Choose whether to enable extra compute resources for automatic optimizations. For more information, see [ Allocating extra compute resources for automatic database optimization ](https://docs.aws.amazon.com/redshift/latest/dg/t_extra-compute-autonomics.html) in the *Amazon Redshift Database Developer Guide*.
1. Under **Subnet**, specify one or more subnets to associate with your database. These subnets are contained in the Amazon VPC you chose previously and must be in three distinct Availability Zones. For more information, see [Considerations when using Amazon Redshift Serverless](https://docs.aws.amazon.com/redshift/latest/mgmt/serverless-usage-considerations.html).
1. Select the base RPU capacity that conforms with your requirements.
## Choose a namespace
1. Choose either **Create a new namespace**, and enter the namespace name, or **Add to an existing namespace**, and select the namespace from the drop-down list.
1. For **Database name and password**, specify the name of the first database. You can also specify an admin other than your default console admin, by editing the **Admin user credentials**.
1. For **Permissions**, you choose **Associate IAM role **to associate specific IAM roles with your namespace and workgroup. For more information about associating IAM roles with Amazon Redshift, see [Identity and access management in Amazon Redshift](https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-iam-authentication-access-control.html).
1. You can customize your encryption settings by creating a new key or choosing a key other than the default. For **Audit logging**, choose the logs to export. Each log type specifies different metadata. Choose **Continue** to review your choices.
## Review workgroup selections
1. Review your settings under **Review and create**. It shows the settings you chose in the previous steps.
1. Choose **Save**.
After you create the workgroup, it's added to the **Workgroups** list.
# Viewing properties for a workgroup
In Amazon Redshift Serverless, a workgroup is a collection of compute resources available for use. When you choose Amazon Redshift Serverless, in the AWS console, you can choose **Workgroup configuration** from the navigation menu to view a list. You can use the **Search** box to find workgroups that meet your search criteria. Each workgroup entry has a few properties displayed:
+ **Workgroup** - The name of the workgroup. You can select it to view and edit the workgroup's properties.
+ **Status** - Shows whether the workgroup is available.
+ **Namespace** - The namespace associated with the workgroup. Each workgroup is associated with one namespace.
+ **Creation date** - The date (UTC) that the workgroup was created.
+ **Tags** - Tags associated with the workgroup.
Additionally, **Workgroup configuration** has another list for managed workgroups, which are Amazon Redshift Serverless workgroups managed by AWS Glue. For more information on managed workgroups, see [Managed workgroups](https://docs.aws.amazon.com/redshift/latest/dg/iceberg-integration-managed-workgroups.html) in the Amazon Redshift Database Developer Guide.
## Workgroup properties
You can list workgroups by choosing **Workgroup configuration** in the left menu. Then you can choose a workgroup from the list. Several panels show properties for the workgroup. You can also perform actions. **General information** displays the following:
+ **Workgroup** - The name of the workgroup.
+ **Namespace** - The namespace associated with the workgroup. You can choose it to view its properties. A workgroup is associated with a single namespace.
+ **Date created** - When the workgroup was created.
+ **Status** - Indicates if the workgroup resources are available. If it's available, you can connect with a client to the Amazon Redshift Serverless instance, in order to query data or create database resources, or you can connect with query editor v2.
+ **Endpoint** - The URL.
+ **JDBC URL** - The URL to establish JDBC client connections. You can use this URL to connect with a JDBC driver for Amazon Redshift. For more information, see [Configuring a connection for JDBC driver version 2.x for Amazon Redshift](https://docs.aws.amazon.com/redshift/latest/mgmt/jdbc20-install.html).
+ **ODBC URL** - The URL to establish ODBC client connections. It contains properties, like the database and user ID, and their values.
+ **Workgroup version and Patch version** - Amazon Redshift Serverless regularly releases new versions and patches. You can use the workgroup version and Patch version numbers to track software updates to your Amazon Redshift Serverless workgroup. For more information about changes and features in specific patches, see [Cluster versions for Amazon Redshift](https://docs.aws.amazon.com/redshift/latest/mgmt/cluster-versions.html).
+ **Workgroup ARN** ‐ The Amazon Resource Name for the workgroup.
+ **Extra compute resources for automatic optimizations** ‐ Whether Amazon Redshift is allocating extra compute resources to perform automatic optimizations, even during periods of heavy usage. For more information, see [ Allocating extra compute resources for automatic database optimization ](https://docs.aws.amazon.com/redshift/latest/dg/t_extra-compute-autonomics.html) in the *Amazon Redshift Database Developer Guide*.
The **Data access** tab contains several panels:
+ **Network and security** - You can see network properties, such as the **Virtual private cloud (VPC)** identifier, **VPC security group** list, **Enhanced VPC routing**, **IP address type**, and the **Publicly accessible** setting. If you choose **Edit**, you can change these settings. Additionally, you can select **Turn on enhanced VPC routing**, which routes network traffic between your serverless database and data repositories through a VPC, for enhanced privacy and security. You can also select **Turn on Public Accessible**, which makes the database publicly accessible from outside the VPC, allowing instances and devices to connect.
The **IP address type** can be set to dual-stack mode to support access to workgroups on both IPv4 an IPv6 at the same time. For more information about network layer communications Internet Protocols (IP), see [Internet Protocol](https://en.wikipedia.org/wiki/Internet_Protocol) in *Wikipedia*.
+ **Redshift managed VPC endpoints** - You can create managed VPC endpoints to access Amazon Redshift Serverless from another VPC.
The **Limits** tab has settings for controlling capacity and use limits for Amazon Redshift Serverless. It contains the following panels:
+ **Base capacity in Redshift processing units (RPUs)** - You can set the base capacity of the compute resources used to process your workload. For more information, see [Compute capacity for Amazon Redshift Serverless](serverless-capacity.md).
+ **Usage limits** - You can set up to four limits for the maximum compute resources that your Amazon Redshift Serverless instance can use in a time period, and select actions for Amazon Redshift Serverless to perform when reaching those limits. For example, you can set your workgroup to have two limits, one of 500 RPU hours and one of 900 RPU hours. You can have Amazon Redshift Serverless send you an alert when it reaches the first limit of 500 RPU hours, then turn off user queries when it reaches the second limit of 900 hours. These limits help control your costs and make them more predictable.
+ **Query limits** - You can set limits on queries, like the timeout setting. These limits help you optimize cost and performance.
The **Tabs** tab has the **Tags** panel, which shows any tags that you created for your workgroup. For more information about tagging resources, see [Tagging resources in Amazon Redshift Serverless](serverless-tagging-resources.md).
## Managed workgroup properties
You can also choose workgroups managed by the AWS Glue Data Catalog under the **Managed workgroups** list.
Managed workgroups have different properties from regular workgroups. For more information on managed workgroups, see [Managed workgroups](https://docs.aws.amazon.com/redshift/latest/dg/iceberg-integration-managed-workgroups.html) in the Amazon Redshift Database Developer Guide.
**General information** displays the following:
+ **Workgroup** - The name of the managed workgroup.
+ **Date created** - The date (UTC) that the managed workgroup was created.
+ **Catalog ARN** - The Amazon Resource Name (ARN) for the managed workgroup in the AWS Glue Data Catalog.
+ **Status** - Indicates if the managed workgroup's compute resources are available. If the resources are available, you can connect to the catalog that uses the managed workgroup with an Apache Iceberg-compatible SQL client in order to query data or create database resources. You can also connect to the catalog using the Amazon Redshift query editor v2.
**Query and database monitoring** contains the **Managed workgroup performance** graph, showing the average elapsed time of all queries from the workgroup over time.
The** Query history** tab is a list of all queries from the managed workgroup. Its details include information such as the user who ran the query, the client engine from which the query originated, and the query’s ID and status. The Users tab is a list of all the users in the workgroup. The **Performance metrics** tab shows various metrics such as average query time, number of completed queries, and percentage of storage capacity used.
# Deleting a workgroup
You can delete a workgroup using the console. Before you do this, make sure that you have your data backed up and snapshots in place. Resources deleted as part of the workgroup in many cases can't be retrieved.
Complete the following steps:
1. Choose **Amazon Redshift Serverless**, choose **Workgroup configuration** and choose **Delete Amazon Redshift Serverless instance**.
1. A dialogue opens. When you choose to delete the workgroup, all usage limits are removed, all VPC endpoints are removed, and access to VPC endpoints is removed.
Type *delete* and select **Delete** to confirm.
After you complete the steps, the status of the workgroup is *Deleting* and a banner indicates that the workgroup is being deleted. While the delete process is in progress, some features under the **Serverless dashboard** are disabled. But you can configure provisioned clusters on the **Provisioned clusters dashboard**.
After you delete the workgroup, it doesn't appear with the namespace. You can choose the **Create workgroup** button to create a new one.
You can delete an existing workgroup and associate a new workgroup with a different configuration to the same namespace. When creating the new workgroup, choose the base capacity that works with the size of the data associated with the namespace.
You can associate a workgroup with a namespace that was created with a customer-managed key (CMK). For more information about AWS KMS, see [AWS KMS concepts](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html).
# Namespaces
In Amazon Redshift Serverless, a namespace defines a logical container for database objects. It can hold tables, workgroups, and other database resources. If you haven't created a workgroup and a namespace, and you are looking for instructions in how to get started with Amazon Redshift Serverless, see [Setting up Amazon Redshift Serverless for the first time](https://docs.aws.amazon.com/redshift/latest/mgmt/serverless-console-first-time-setup.html).
## Namespace properties
In Amazon Redshift Serverless, a namespace defines a container for database objects. You can choose **Namespace configuration** from the navigation list, choose a namespace from the list, and edit its settings.
General information for the namespace includes the following:
+ **Namespace** - The name.
+ **Namespace ID** - The unique identifier.
+ **ARN** - A unique identifier used to specify the resource across AWS. It contains properties like the region and the service.
+ **Status** - The status, such as **Available**.
+ **Date created** - The date (UTC) that the namespace was created.
+ **Storage used** - The storage space used by the namespace and all of its objects.
+ **Admin user name** - The admin account. This is typically the account used to create the namespace.
+ **Database name** - The name of the database contained by the namespace.
+ **Total table count** - The count of tables in all schemas.
Additional settings and properties for the namespace are on several tabs. These include the following:
+ **Workgroup** - Shows the workgroup associated with the namespace.
+ **Data back up** - On this panel, you can configure and create snapshots, and configure recovery points.
+ **Security and encryption** - You can manage IAM role permissions and view or edit your security and encryption settings. These include your encryption key status, and the setting to turn on audit logging. For more information about audit logging for Amazon Redshift Serverless, see [Audit logging for Amazon Redshift Serverless](https://docs.aws.amazon.com/redshift/latest/mgmt/serverless-audit-logging.html).
+ **Datashares** - Shows datashares. With data sharing, you can provide access to data without the need to copy it or move it. For more information about data sharing, see [Data sharing in Amazon Redshift Serverless](https://docs.aws.amazon.com/redshift/latest/mgmt/serverless-datasharing.html).
# Searching for a namespace
From the Amazon Redshift menu, you can choose from the **Namespaces** list in order to view or edit the properties for a namespace. Information on the console includes the namespace name, the admin name, and other properties.
A namespace's settings and properties are on several tabs. These include the following:
+ **Workgroup** - Shows workgroups associated with the namespace.
+ **Data back up** - You can configure and create snapshots, and configure recovery points.
+ **Security and encryption** - You can manage IAM role permissions and view or edit your security and encryption settings. These include your encryption key status and your audit logging settings.
+ **Datashares** - Shows datashares.
# Editing security and encryption
Amazon Redshift Serverless is secured by means of KMS encryption. You can update encryption settings via the console:
1. Choose **Namespace configuration** from the main menu on the console, choose the namespace to edit, and choose **Edit** on the **Security and encryption** tab. A dialog appears.
1. You can select **Customize encryption settings** and then **Choose an AWS customer managed key** to change the key used to encrypt your resources.
1. For **Audit logging**, choose the logs to export. Each log type specifies different metadata.
1. To complete the configuration update, choose **Save changes**.
# Changing the AWS KMS key for a namespace
In Amazon Redshift, encryption protects data at rest. Amazon Redshift Serverless uses AWS KMS key encryption automatically to encrypt both your Amazon Redshift Serverless resources and snapshots. As a best practice, most organizations review the type of data they store and have a plan to rotate encryption keys on a schedule. The frequency for rotating keys can vary, depending on your policies for data security. Amazon Redshift Serverless supports changing the AWS KMS key for the namespace so you can adhere to your organization's security policies.
When you change the AWS KMS key, the data remains unchanged.
## Changing an AWS KMS key using the console
In Amazon Redshift, encryption protects data at rest. Amazon Redshift Serverless uses AWS KMS key encryption automatically to encrypt both Amazon Redshift Serverless and snapshots. As a best practice, most organizations review the type of data they store and have a plan to rotate encryption keys on a schedule. The frequency for rotating keys can vary, depending on your policies for data security. Amazon Redshift Serverless supports changing the AWS KMS key for the namespace so you can adhere to your organization's security policies.
When you change the AWS KMS key, the data remains unchanged.
1. Sign in to the AWS Management Console and open the Amazon Redshift console at [https://console.aws.amazon.com/redshiftv2/](https://console.aws.amazon.com/redshiftv2/).
1. On the navigation menu, choose **Namespace configuration**. Choose your namespace from the list.
1. From the **Security and encryption** tab, choose **Edit**.
1. Choose **Customize encryption settings** and then choose a key for the namespace. You can optionally create a new key.
## Changing AWS KMS encryption keys using the AWS CLI
Use `update-namespace` to change the AWS KMS key for the namespace. The following shows the syntax for the command:
```
aws redshift-serverless update-namespace
--namespace-name
[--kms-key-id ]
// other parameters omitted here
```
You must have a namespace created or the CLI command results in an error.
The time it takes to change the key depends on the amount of data in Amazon Redshift Serverless. This typically takes fifteen minutes per 8TB of stored data.
## Limitations
You can’t change from a customer managed KMS Key to an AWS KMS key. In this case, you have to create a new namespace.
You can’t perform other actions while the key is being changed.
# Deleting a namespace
If you want to delete a namespace with an associated workgroup, you have to first delete the workgroup.
On the Amazon Redshift Serverless console, complete the following steps:
1. Choose **Namespace configuration** from the left menu and then choose the namespace you want to delete from the list.
1. Choose **Actions** and select **Delete namespace**.
1. A dialogue box opens. You can keep your data by creating a manual snapshot prior to completing the delete operation.
Type *delete* and select **Delete** to confirm.