Redshift driver: support AWS Identity Center trusted identity propagation for lake formation

[santiagousach-pomelo]

Is your feature request related to a problem? Please describe.

Cube's Redshift driver uses pg, which can't carry an AWS Identity Center (IdC) identity into Redshift. So Redshift always sees the shared IAM role Cube connects with, never the real user. That kills Lake Formation policies tied to IdC users/groups — even when trusted identity propagation is fully set up on AWS, Cube is the ceiling.

Describe the solution you'd like

A dataApi: true mode that swaps pg for @aws-sdk/client-redshift-data. The SDK supports IdC trusted identity propagation natively, so Redshift sees the real user and LF policies just work. Same pattern as the existing Athena driver.

Describe alternatives you've considered

• dataSources multi-role routing: per-group only, no user identity.
• Bypass Cube via Data API directly: loses the semantic layer.
• Custom driver fork: weeks of work, ongoing maintenance.

Additional context

TIP for Redshift · Redshift IdC auth · LF IdC integration. Affects anyone running Cube on JC/Okta/Entra → IdC → Redshift + LF. Happy to contribute a PR.

[santiagousach-pomelo]

Looking at the driver code, this is much smaller in scope than my original framing implied. The driver already has a RedshiftCredentialsProvider abstraction with two implementations (Plain, IAM), and pg doesn't need to change at all — it just consumes { user, password } from whichever provider is wired in.

So the work is really:

1. RedshiftServerlessIAMCredentialsProvider — same shape as the existing IAM provider, but using redshift-serverless:GetCredentials with WorkgroupName instead of the provisioned GetClusterCredentialsWithIAM. Needed first because the IdC path lives on Serverless.

2. RedshiftServerlessIdcCredentialsProvider — accepts an IdC identity context (e.g. an AssumeRoleWithWebIdentity token from an IdC trusted token issuer), calls GetCredentials with that credential chain, and returns { user, password } bound to the IdC user. Redshift then sees the real user on the pg connection and LF policies tied to IdC users/groups evaluate as expected.

Roughly ~250 lines total across the two classes, plus the constructor branching in RedshiftDriver to pick the right one based on env vars. No pg replacement, no Data API path required.

Happy to put up a PR. Two questions before I do:

• Naming: RedshiftServerless* as separate classes vs. a serverless: true flag on the existing IAM provider — preference?
• Env vars: open to a convention like CUBEJS_DB_REDSHIFT_WORKGROUP_NAME + CUBEJS_DB_REDSHIFT_IDC_TOKEN (or a function ref via driverFactory)?