Skip to content

SCOPE.md

Latest commit

 

History

History
123 lines (98 loc) · 7.46 KB

SCOPE.md

File metadata and controls

123 lines (98 loc) · 7.46 KB
Raw

terraform-aws-redshift — SCOPE

Composite module for a secure-by-default Amazon Redshift data warehouse, in one of two selectable deployment shapes: a provisioned cluster (with subnet group and parameter group) or a Redshift Serverless namespace + workgroup. A single module call produces an encrypted, private, logging-enabled warehouse aligned with the Casey's (NPI / GLBA / FCA) baseline.

  • Module type: Composite
  • Primary resource (keystone): aws_redshift_cluster.this (provisioned) — or aws_redshiftserverless_namespace.this + aws_redshiftserverless_workgroup.this (Serverless mode)

In-scope resources

The module manages all of the following (allow-list), gated by deployment_mode:

  • aws_redshift_cluster — keystone (provisioned mode)
  • aws_redshift_subnet_group — placement across caller-supplied subnets (provisioned)
  • aws_redshift_parameter_group — cluster parameters (provisioned; only when parameter_group is set)
  • aws_redshift_logging — standalone audit-logging resource (provisioned; only when logging is set)
  • aws_redshiftserverless_namespace — Serverless namespace (database + admin + encryption)
  • aws_redshiftserverless_workgroup — Serverless workgroup (compute + networking)

Out-of-scope resources (consumed by reference)

Referenced by arn/id, never created here:

  • VPC subnets — subnet_ids (from terraform-aws-vpc)
  • Security groups — vpc_security_group_ids (from terraform-aws-security-group)
  • KMS CMK for at-rest encryption — kms_key_arn (from terraform-aws-kms)
  • IAM roles attached to the cluster/namespace (e.g. for COPY/UNLOAD to S3) — iam_roles (from terraform-aws-iam-role)
  • Admin password secret — Secrets Manager (from terraform-aws-secrets-manager)
  • S3 bucket for audit logging — logging.bucket_name (from terraform-aws-s3-bucket)

Consumes

Input Type Source module
subnet_ids list(string) terraform-aws-vpc
vpc_security_group_ids list(string) terraform-aws-security-group
kms_key_arn string (KMS key ARN, optional) terraform-aws-kms
iam_roles list(string) (IAM role ARNs) terraform-aws-iam-role
logging.bucket_name string (S3 bucket id) terraform-aws-s3-bucket
admin password string (sensitive) terraform-aws-secrets-manager

Required IAM permissions

Least-privilege actions the Terraform identity needs:

Action Required for
redshift:CreateCluster, redshift:DeleteCluster, redshift:ModifyCluster, redshift:DescribeClusters Provisioned cluster lifecycle
redshift:CreateClusterSubnetGroup, redshift:DeleteClusterSubnetGroup, redshift:ModifyClusterSubnetGroup Subnet group
redshift:CreateClusterParameterGroup, redshift:DeleteClusterParameterGroup, redshift:ModifyClusterParameterGroup Parameter group
redshift:EnableLogging, redshift:DisableLogging, redshift:DescribeLoggingStatus Audit logging
redshift-serverless:CreateNamespace, redshift-serverless:DeleteNamespace, redshift-serverless:UpdateNamespace, redshift-serverless:GetNamespace Serverless namespace
redshift-serverless:CreateWorkgroup, redshift-serverless:DeleteWorkgroup, redshift-serverless:UpdateWorkgroup, redshift-serverless:GetWorkgroup Serverless workgroup
redshift:CreateTags, redshift:DeleteTags, redshift:DescribeTags Tagging
iam:PassRole Attach cluster/namespace IAM roles (COPY/UNLOAD)
iam:CreateServiceLinkedRole AWSServiceRoleForRedshift
kms:DescribeKey, kms:CreateGrant When kms_key_arn (CMK) supplied for encryption
s3:PutObject, s3:GetBucketAcl Audit-log delivery (granted on the log bucket)

iam:PassRole is required to attach the COPY/UNLOAD roles to the cluster or namespace.

AWS Prerequisites

  • Service-linked role: AWSServiceRoleForRedshift is used by the service in your VPC.
  • Subnet group: provisioned clusters require a cluster subnet group spanning the target AZs.
  • CMK (optional): at-rest encryption supports a customer-managed key; its key policy must allow Redshift.
  • Audit logging bucket: the S3 bucket must grant the Redshift log-delivery service s3:PutObject and s3:GetBucketAcl via bucket policy.
  • IAM roles: roles attached for COPY/UNLOAD must trust redshift.amazonaws.com.
  • Node type / capacity: the provisioned node_type or Serverless base RPU must be offered in the Region.
  • Quotas: default soft limits on clusters and nodes per Region (raisable).

Emits

Output Description Consumed by
id Cluster identifier or namespace id references
arn Cluster / namespace ARN — cross-resource reference type IAM policies, monitoring
endpoint Cluster / workgroup endpoint address BI tools, application config
port Warehouse port (default 5439) application config
database_name Initial database name client connections
namespace_arn Serverless namespace ARN (Serverless mode) references
workgroup_id Serverless workgroup id (Serverless mode) references
cluster_identifier Provisioned cluster identifier CLI / console
tags_all All tags incl. provider default_tags governance/audit

Any emitted admin password is marked sensitive = true; prefer manage_admin_password = true (Secrets Manager) so it is never an output.

Provider gotchas

  • Mode is mutually exclusive: deployment_mode = "provisioned" vs "serverless" selects entirely different resource sets; switching modes is a destroy/recreate, not an in-place edit.
  • FORCE-NEW fields: cluster_identifier, node_type (resize is a different operation), cluster_subnet_group_name, database_name, master_username, and enabling encrypted/changing kms_key_id may recreate or require resize.
  • tags vs tags_all. Resource tags win over provider default_tags; default_tags is the caller's concern.
  • skip_final_snapshot / final_snapshot_identifier govern provisioned-cluster destroy; default to retaining a final snapshot.
  • publicly_accessible must stay false for private warehouses; an Elastic IP is involved when public.
  • arn is the cross-resource reference type.

Secure-by-default decisions

Posture Default Opt-out
Encryption at rest encrypted = true (AWS-managed KMS; CMK via kms_key_arn) encrypted = false (discouraged)
Public accessibility publicly_accessible = false true (documented exception)
Audit logging enabled to an S3 bucket disable via logging variable
Enhanced VPC routing enhanced_vpc_routing = true false
Admin password manage_admin_password = true (Secrets Manager) caller master_password (sensitive)
Final snapshot skip_final_snapshot = false true (discouraged)
Deletion protection (Serverless) enabled where supported disable via variable

Design decisions

  • One composite covers both Redshift deployment shapes behind a single deployment_mode selector, so callers pick provisioned or Serverless without switching modules.
  • Provisioned resources (subnet group, parameter group) render only in provisioned mode; namespace + workgroup render only in Serverless mode.
  • IAM roles for COPY/UNLOAD and the audit-log bucket are referenced by ARN / name, keeping the module's blast radius to warehouse resources.
  • Admin credentials are managed via Secrets Manager by default and never required as a plaintext variable.