Documentation +

Static IP guide

Connecting to Amazon Redshift with a static IP from a Python app on Heroku

Python analytics workers on Heroku typically hit Redshift with psycopg2 or redshift_connector on port 5439 — and hit a security-group wall, because dyno IPs are unpredictable. A Fixie-Wrench tunnel gives those drivers a localhost endpoint that exits to AWS from two addresses you can allowlist once.

RuntimePython
PlatformHeroku
DestinationAmazon Redshift
Fixie productFixie Socks Heroku add-on

Recommended setup

Use Fixie Socks Heroku add-on for Amazon Redshift connections that require a stable source IP. Store the proxy value in FIXIE_SOCKS_HOST, then configure Python to route outbound traffic through Fixie before connecting to Amazon Redshift.

Set up Fixie on Heroku

Heroku is a native Fixie marketplace flow. Install the Fixie Socks Heroku add-on or attach it from the Heroku CLI. Heroku will create FIXIE_SOCKS_HOST as a config var for the app.

Attach fixie-socks to your Heroku app

heroku addons:create fixie-socks
heroku config:get FIXIE_SOCKS_HOST

Implementation

The example below shows the core application-side change. Keep credentials in environment variables and avoid committing proxy, database, or API secrets.

Forward a local port to Amazon Redshift through Fixie Socks

# Install Fixie-Wrench in your app build or deploy process.
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/usefixie/fixie-wrench/HEAD/install.sh)"

# Start a tunnel from localhost:5439 to redshift-cluster.example.com:5439.
# Your Python app connects to localhost:5439; Fixie handles the outbound static IP.
./bin/fixie-wrench 5439:redshift-cluster.example.com:5439

Good to know

  • Point the driver at host 127.0.0.1, port 5439; database name, user, and password are unchanged.
  • COPY and UNLOAD statements move data between the cluster and S3 directly — only the SQL control connection flows through the tunnel, so large loads are not bottlenecked by the proxy.

Allowlist and test the static IPs

  1. Open the Fixie dashboard and copy the outbound IP addresses for this proxy.
  2. Add both IPs to the Redshift security group.
  3. Deploy the updated Python app on Heroku.
  4. Run a small connection test before sending production traffic.

Related guides

Related docs