IPv6 addressing with Amazon Redshift

As we witness the gradual transition from IPv4 to IPv6, Amazon Web Services (AWS) continues to expand its support for dual-stack networking across its service portfolio. In this post, we show how you can migrate your Amazon Redshift Serverless workgroup from IPv4-only to dual-stack mode, so you can make your data warehouse future ready.

An IP address serves as a digital identity for devices connected to the internet. This unique numerical identifier enables devices to communicate across IP-based networks, facilitating the exchange of data packets between source and destination.

Today’s internet operates on two IP versions:

• IPv4 – The traditional 32-bit addressing system (such as 192.168.0.22) that has powered internet communications for over three decades. With approximately 4 billion possible addresses (2³²), IPv4’s limitations have become increasingly apparent as our digital environment expands.
• IPv6 – The next-generation 128-bit addressing system (such as 2606:4700::6810:787f) offers an astronomical number of unique addresses (340 undecillion or 2¹²⁸). This virtually unlimited address space is designed to accommodate the explosive growth of internet-connected devices.

In the case of Amazon Redshift, dual-stack networking allows Redshift workgroups to communicate over both IPv4 and IPv6 protocols simultaneously. This networking architecture allows Redshift workgroups to be accessible using both IPv4 and IPv6 addresses, providing greater flexibility and future-proofing for network communications. Dual-stack networking provides the following advantages:

1. Future-proofing – Facilitates compatibility with both IPv4 systems and modern IPv6 networks
2. Enhanced connectivity – Provides more flexible networking options for diverse client applications

Enable dual-stack networking for Amazon Redshift

An Amazon Redshift workgroup operating in dual-stack mode has both IPv4 and IPv6 addresses associated with the database endpoints. We’ve introduced a new API field called ipAddressTypein the Amazon Redshift API that gives you direct control over your workgroup’s network configuration. You can now specifically choose whether your Amazon Redshift instance operates in IPv4-only mode or dual-stack mode. For complete implementation details, refer to the ipAddressType parameter in the Amazon Redshift API Reference.

Best practice

When implementing dual-stack networking in Amazon Redshift, deploy your workgroups in private subnets with virtual private cloud (VPC) endpoints for optimal security and compatibility. This approach aligns with the current Amazon Redshift support model, which requires dual-stack databases to operate in private mode only. Amazon Redshift doesn’t currently support databases with IPv6-only endpoints or publicly accessible dual-stack instances.

Prerequisites

To implement dual-stack networking in Amazon Redshift, you need to have the following prerequisites:

• An existing Amazon Redshift serverless workgroups running in IPv4-only mode that you want to convert to dual-stack mode
• Administrative permissions to modify Amazon Redshift workgroup network configurations
• VPC with both IPv4 and IPv6 CIDR blocks assigned

Enable IPv6 support in your VPC subnets

Before migrating your Amazon Redshift Serverless workgroup to dual-stack mode, you must first make sure your VPC subnets support IPv6 addressing. In this section, we walk through the process of enabling IPv6 CIDR blocks for your VPC.

Existing VPC Subnets

To enable dual-stack mode in your existing VPC follow these five high-level steps:

1. Access the VPC dashboard
2. Navigate to the subnet settings
3. Add the IPv6 CIDR block
4. Repeat for the required subnets
5. Verify IPv6 CIDR association

To access the VPC dashboard:

1. Sign in to your account on the AWS Management Console
2. In the search bar at the top, type VPC
3. Choose VPC from the dropdown list to navigate to the Amazon Virtual Private Cloud (Amazon VPC) dashboard

To navigate to subnet settings:

1. In the left navigation panel under Virtual private cloud, choose Subnets
2. From the subnet list, identify and select the subnet(s) that your Amazon Redshift Serverless workgroup uses or will use

To add the IPv6 CIDR block:

1. With your subnet selected, choose Actions in the dropdown list
2. Choose Edit IPv6 CIDRs from the available options
3. In the configuration panel that appears, choose Add IPv6 CIDR
4. The system will automatically suggest an appropriate IPv6 CIDR block allocation
5. Choose Save to apply the changes

Repeat for the required subnets. You must modify the subnets within the VPC that will be used by your Amazon Redshift resources. Repeat high-level steps 2–3 for each subnet in your Amazon Redshift subnet group.

Verify the IPv6 CIDR association. After completing the configuration, verify that each subnet displays both IPv4 and IPv6 CIDR blocks in the subnet details. Your subnet details should show something like the following snippet:IPv4 CIDR: 10.0.0.0/24IPv6 CIDR: 2600:1f16:c72:9d00::/64

After you’ve successfully configured IPv6 CIDR blocks for the relevant subnets, you’re ready to proceed with enabling dual-stack mode on your Amazon Redshift Serverless workgroup.

New VPC Subnets

To enable dual-stack mode in a new VPC, follow these steps:

1. To create a dual-stack VPC, add the --amazon-provided-ipv6-cidr-block option to add an Amazon provided IPv6 CIDR block, as shown in the following example:

   aws ec2 create-vpc --cidr-block 10.0.0.0/24 \
   --amazon-provided-ipv6-cidr-block \
   --query Vpc.VpcId \
   --output text

2. [Dual stack VPC] Get the IPv6 CIDR block that’s associated with your VPC by using the following describe-vpcs command:

   aws ec2 describe-vpcs --vpc-id vpcxxxxx \
   --query Vpcs[].Ipv6CidrBlockAssociationSet[].Ipv6CidrBlock \
   --output text

3. If you created a dual-stack VPC, you can use the --ipv6-cidr-block option to create a dual stack subnet, as shown in the following command:

   aws ec2 create-subnet --vpc-id vpc-xxx \
   --cidr-block 10.0.1.0/20 \
   --ipv6-cidr-block 2600:1f13:cfe:3600::/64 \
   --availability-zone us-east-2a \
   --query Subnet.SubnetId \
   --output text

Migrate an existing Amazon Redshift Serverless workgroup from IPv4 to IPv6

To enable dual-stack mode for your Amazon Redshift Serverless workgroup, follow these five high-level steps:

1. Access Amazon Redshift Serverless
2. Select your workgroup
3. Access network and security settings
4. Enable dual-stack mode
5. Verify the configuration

To access Amazon Redshift Serverless:

1. Sign in to AWS Management Console using your credentials.
2. In the search bar at the top of the console, enter Redshift.
3. Choose Amazon Redshift in the dropdown list. This will take you to the Amazon Redshift dashboard. Confirm Make sure you’re on the Redshift Serverless dashboard view

To select your workgroup:

1. In the Redshift Serverless dashboard, locate the Workgroups section
2. Select the name of the specific workgroup you want to modify

To access network and security settings:

1. On the workgroup details page, locate the horizontal navigation tabs
2. Next to the Query and database monitoring section, choose the Data access tab
3. Choose Edit to access the Edit network and security page

To enable dual-stack mode:

1. In the network settings section, locate the IP address type options
2. Choose Dual-stack mode. This enables connectivity for both IPv4 and IPv6
3. Choose Save changes at the bottom of the page

To verify the configuration:

After the changes are applied, you’ll be returned to the workgroup details page. Confirm that your workgroup now displays Dual-stack mode in its network settings, as shown in the following screenshot.

Your Amazon Redshift Serverless workgroup is now configured to support both IPv4 and IPv6 traffic. This configuration allows your Redshift Serverless workgroup to communicate over both IPv4 and IPv6 protocols, providing greater flexibility for your network connectivity options.

Access Redshift dual-stack serverless workgroups

Redshift dual-stack workgroups maintain the same access methods regardless of whether you’re connecting using IPv4 or IPv6. Your existing connection endpoints remain unchanged.

To access a Redshift dual-stack workgroups from an Amazon Elastic Compute Cloud (Amazon EC2) instance, follow these steps:

1. Create an IPv4 EC2 instance.
2. Add the associated EC2 security group to your Redshift workgroup’s security group inbound rules.
3. Connect to your EC2 instance. Log in to your EC2 instance on the AWS console to install the psql client to test the database connectivity. Enter the following commands from the terminal window:

   # Update your system packages
   sudo dnf update -y
   # Install the PostgreSQL 15 repository
   sudo dnf install -y postgresql15
   # Verify the installation
   psql –version

   Connect to your Redshift workgroup using application user

   psql -h your-redshift-endpoint -U your-username -d your-database -p 5439

   Enter password when prompted

4. Enter sample queries, as shown in the following:

   SELECT * FROM your_table LIMIT 10;

   

5. Validate the IPv4 connection using the following SQL by replacing your associated IPv4 EC2 instance IP address:

   SELECT * FROM sys_connection_log where user_name = 'admin' 
   and remote_host like '%172.31.83.132%' order by record_time desc;

   

6. Execute identical validation steps on your IPv6-enabled EC2 instance to verify that all functionality operates correctly with the IPv6 protocol stack using the preceding commands.

Create dual-stack mode in Amazon Redshift Serverless using AWS CLI

You can create a new dual-stack mode in Amazon Redshift Serverless using AWS Command Line Interface (AWS CLI). Follow these high-level steps:

1. Create a namespace
2. Create a workgroup
3. Verify the workgroup is set up in dual-stack mode

To create namespace, enter the following code:

export AWS_USE_DUALSTACK_ENDPOINT=true
aws redshift-serverless create-namespace \
--region us-east-1 \
--namespace-name ipv6-demo \
--admin-username xxx  \
--admin-user-password "yyyyyyy"

To create workgroup, enter the following code:

aws redshift-serverless create-workgroup \
--workgroup-name ipv6-demo-wg \
--namespace-name ipv6-demo \
--region us-east-1 \
--subnet-ids subnet-ppppppp subnet-qqqqqq \
--ip-address-type dualstack

To verify the workgroup is set up in dual-stack mode, refer to the steps in the previous section.

Clean up

To clean up your resources, complete the following steps:

1. On the Amazon Redshift Serverless console, delete the Amazon Redshift workgroups and namespaces
2. On the Amazon EC2 console, terminate the EC2 instances

Conclusion

In this post, we’ve explored the capability of Amazon Redshift Serverless to support IPv6 addressing through dual-stack mode, marking a significant advancement in the AWS data warehouse networking flexibility.

We’ve walked through the complete migration journey, from preparing your VPC subnets with IPv6 CIDR blocks to configuring your Amazon Redshift Serverless workgroup for dual-stack operation. The process is straightforward. Although IPv6-only configurations aren’t yet supported for Amazon Redshift, the dual-stack approach provides an ideal transition path, maintaining compatibility with existing IPv4 systems while introducing IPv6 capabilities. Remember that dual-stack configurations are currently limited to private access mode, with public accessibility not yet supported for dual-stack instances.

By migrating to dual-stack mode now, you can make sure your Amazon Redshift environment remains optimally connected, addressable, and ready to support your organization’s data analytics needs well into the future—regardless of how internet addressing protocols continue to evolve.

If you have questions or suggestions on the content covered in this post, leave them in the comments section.

About the authors