Documentation +

Static IP guide

Connecting to Amazon Redshift with a static IP from a Ruby app on Heroku

Ruby ETL and reporting jobs on Heroku can query Amazon Redshift through the pg gem — the protocol is Postgres-compatible — but the cluster's security group will not admit ephemeral dyno IPs. Forward port 5439 with Fixie-Wrench and your Sequel or ActiveRecord code connects to localhost while Redshift sees a fixed address.

RuntimeRuby
PlatformHeroku
DestinationAmazon Redshift
Fixie productFixie Socks Heroku add-on

Recommended setup

Use Fixie Socks Heroku add-on for Amazon Redshift connections that require a stable source IP. Store the proxy value in FIXIE_SOCKS_HOST, then configure Ruby to route outbound traffic through Fixie before connecting to Amazon Redshift.

Set up Fixie on Heroku

Heroku is a native Fixie marketplace flow. Install the Fixie Socks Heroku add-on or attach it from the Heroku CLI. Heroku will create FIXIE_SOCKS_HOST as a config var for the app.

Attach fixie-socks to your Heroku app

heroku addons:create fixie-socks
heroku config:get FIXIE_SOCKS_HOST

Implementation

The example below shows the core application-side change. Keep credentials in environment variables and avoid committing proxy, database, or API secrets.

Forward a local port to Amazon Redshift through Fixie Socks

# Install Fixie-Wrench in your app build or deploy process.
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/usefixie/fixie-wrench/HEAD/install.sh)"

# Start a tunnel from localhost:5439 to redshift-cluster.example.com:5439.
# Your Ruby app connects to localhost:5439; Fixie handles the outbound static IP.
./bin/fixie-wrench 5439:redshift-cluster.example.com:5439

Good to know

  • Add both Fixie IPs to the cluster security group on port 5439 and confirm the cluster is publicly accessible; a private-subnet-only cluster is unreachable from outside its VPC no matter what IP you present.
  • Heroku Scheduler tasks receive the same config vars as web dynos, so the tunnel command works unchanged inside a scheduled rake task.

Allowlist and test the static IPs

  1. Open the Fixie dashboard and copy the outbound IP addresses for this proxy.
  2. Add both IPs to the Redshift security group.
  3. Deploy the updated Ruby app on Heroku.
  4. Run a small connection test before sending production traffic.

Related guides

Related docs

Is this guide useful?