Skip to content

Commit e2b18e7

Browse files
sean-beathsean-beath
authored
feat(redshift): support enhanced vpc routing when creating redshift cluster (#22499)
Allows users to enable enhanced VPC routing when creating a Redshift cluster. ---- ### All Submissions: * [x] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) ### Adding new Unconventional Dependencies: * [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies) ### New Features * [x] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)? * [x] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)? *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 6f332ef commit e2b18e7

11 files changed

+1860
-0
lines changed

‎packages/@aws-cdk/aws-redshift/README.md

+18
Original file line numberDiff line numberDiff line change
@@ -368,3 +368,21 @@ The elastic IP address is an external IP address for accessing the cluster outsi
368368

369369
In some cases, you might want to associate the cluster with an elastic IP address or change an elastic IP address that is associated with the cluster. To attach an elastic IP address after the cluster is created, first update the cluster so that it is not publicly accessible, then make it both publicly accessible and add an Elastic IP address in the same operation.
370370

371+
## Enhanced VPC Routing
372+
373+
When you use Amazon Redshift enhanced VPC routing, Amazon Redshift forces all COPY and UNLOAD traffic between your cluster and your data repositories through your virtual private cloud (VPC) based on the Amazon VPC service. By using enhanced VPC routing, you can use standard VPC features, such as VPC security groups, network access control lists (ACLs), VPC endpoints, VPC endpoint policies, internet gateways, and Domain Name System (DNS) servers, as described in the Amazon VPC User Guide. You use these features to tightly manage the flow of data between your Amazon Redshift cluster and other resources. When you use enhanced VPC routing to route traffic through your VPC, you can also use VPC flow logs to monitor COPY and UNLOAD traffic.
374+
375+
```ts
376+
declare const vpc: ec2.Vpc;
377+
378+
new Cluster(stack, 'Redshift', {
379+
masterUser: {
380+
masterUsername: 'admin',
381+
masterPassword: cdk.SecretValue.unsafePlainText('tooshort'),
382+
},
383+
vpc,
384+
enhancedVpcRouting: true,
385+
})
386+
```
387+
388+
If enhanced VPC routing is not enabled, Amazon Redshift routes traffic through the internet, including traffic to other services within the AWS network.

‎packages/@aws-cdk/aws-redshift/lib/cluster.ts

+10
Original file line numberDiff line numberDiff line change
@@ -354,6 +354,15 @@ export interface ClusterProps {
354354
* @default - No Elastic IP
355355
*/
356356
readonly elasticIp?: string
357+
358+
/**
359+
* If this flag is set, Amazon Redshift forces all COPY and UNLOAD traffic between your cluster and your data repositories through your virtual private cloud (VPC).
360+
*
361+
* @see https://docs.aws.amazon.com/redshift/latest/mgmt/enhanced-vpc-routing.html
362+
*
363+
* @default - false
364+
*/
365+
readonly enhancedVpcRouting?: boolean
357366
}
358367

359368
/**
@@ -547,6 +556,7 @@ export class Cluster extends ClusterBase {
547556
encrypted: props.encrypted ?? true,
548557
classic: props.classicResizing,
549558
elasticIp: props.elasticIp,
559+
enhancedVpcRouting: props.enhancedVpcRouting,
550560
});
551561

552562
this.cluster.applyRemovalPolicy(removalPolicy, {

‎packages/@aws-cdk/aws-redshift/test/cluster-enhancedvpcrouting.integ.snapshot/EnhancedVpcRoutingDefaultTestDeployAssert10B513A1.assets.json

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "21.0.0",
3+
"files": {
4+
"21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": {
5+
"source": {
6+
"path": "EnhancedVpcRoutingDefaultTestDeployAssert10B513A1.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk/aws-redshift/test/cluster-enhancedvpcrouting.integ.snapshot/EnhancedVpcRoutingDefaultTestDeployAssert10B513A1.template.json

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"Parameters": {
3+
"BootstrapVersion": {
4+
"Type": "AWS::SSM::Parameter::Value<String>",
5+
"Default": "/cdk-bootstrap/hnb659fds/version",
6+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
7+
}
8+
},
9+
"Rules": {
10+
"CheckBootstrapVersion": {
11+
"Assertions": [
12+
{
13+
"Assert": {
14+
"Fn::Not": [
15+
{
16+
"Fn::Contains": [
17+
[
18+
"1",
19+
"2",
20+
"3",
21+
"4",
22+
"5"
23+
],
24+
{
25+
"Ref": "BootstrapVersion"
26+
}
27+
]
28+
}
29+
]
30+
},
31+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
32+
}
33+
]
34+
}
35+
}
36+
}

‎packages/@aws-cdk/aws-redshift/test/cluster-enhancedvpcrouting.integ.snapshot/cdk.out

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"version":"21.0.0"}

‎packages/@aws-cdk/aws-redshift/test/cluster-enhancedvpcrouting.integ.snapshot/integ.json

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"version": "21.0.0",
3+
"testCases": {
4+
"EnhancedVpcRouting/DefaultTest": {
5+
"stacks": [
6+
"redshift-enhancedvpcrouting-integ"
7+
],
8+
"assertionStack": "EnhancedVpcRouting/DefaultTest/DeployAssert",
9+
"assertionStackName": "EnhancedVpcRoutingDefaultTestDeployAssert10B513A1"
10+
}
11+
}
12+
}

‎packages/@aws-cdk/aws-redshift/test/cluster-enhancedvpcrouting.integ.snapshot/manifest.json

+273
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,273 @@
1+
{
2+
"version": "21.0.0",
3+
"artifacts": {
4+
"Tree": {
5+
"type": "cdk:tree",
6+
"properties": {
7+
"file": "tree.json"
8+
}
9+
},
10+
"redshift-enhancedvpcrouting-integ.assets": {
11+
"type": "cdk:asset-manifest",
12+
"properties": {
13+
"file": "redshift-enhancedvpcrouting-integ.assets.json",
14+
"requiresBootstrapStackVersion": 6,
15+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
16+
}
17+
},
18+
"redshift-enhancedvpcrouting-integ": {
19+
"type": "aws:cloudformation:stack",
20+
"environment": "aws://unknown-account/unknown-region",
21+
"properties": {
22+
"templateFile": "redshift-enhancedvpcrouting-integ.template.json",
23+
"validateOnSynth": false,
24+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
25+
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
26+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/88e2010a08d484eca3203f7e1bcffce43eaa10faedbd092b56c3d70967765b7a.json",
27+
"requiresBootstrapStackVersion": 6,
28+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
29+
"additionalDependencies": [
30+
"redshift-enhancedvpcrouting-integ.assets"
31+
],
32+
"lookupRole": {
33+
"arn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}",
34+
"requiresBootstrapStackVersion": 8,
35+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
36+
}
37+
},
38+
"dependencies": [
39+
"redshift-enhancedvpcrouting-integ.assets"
40+
],
41+
"metadata": {
42+
"/redshift-enhancedvpcrouting-integ/VPC/Resource": [
43+
{
44+
"type": "aws:cdk:logicalId",
45+
"data": "VPCB9E5F0B4"
46+
}
47+
],
48+
"/redshift-enhancedvpcrouting-integ/VPC/PublicSubnet1/Subnet": [
49+
{
50+
"type": "aws:cdk:logicalId",
51+
"data": "VPCPublicSubnet1SubnetB4246D30"
52+
}
53+
],
54+
"/redshift-enhancedvpcrouting-integ/VPC/PublicSubnet1/RouteTable": [
55+
{
56+
"type": "aws:cdk:logicalId",
57+
"data": "VPCPublicSubnet1RouteTableFEE4B781"
58+
}
59+
],
60+
"/redshift-enhancedvpcrouting-integ/VPC/PublicSubnet1/RouteTableAssociation": [
61+
{
62+
"type": "aws:cdk:logicalId",
63+
"data": "VPCPublicSubnet1RouteTableAssociation0B0896DC"
64+
}
65+
],
66+
"/redshift-enhancedvpcrouting-integ/VPC/PublicSubnet1/DefaultRoute": [
67+
{
68+
"type": "aws:cdk:logicalId",
69+
"data": "VPCPublicSubnet1DefaultRoute91CEF279"
70+
}
71+
],
72+
"/redshift-enhancedvpcrouting-integ/VPC/PublicSubnet1/EIP": [
73+
{
74+
"type": "aws:cdk:logicalId",
75+
"data": "VPCPublicSubnet1EIP6AD938E8"
76+
}
77+
],
78+
"/redshift-enhancedvpcrouting-integ/VPC/PublicSubnet1/NATGateway": [
79+
{
80+
"type": "aws:cdk:logicalId",
81+
"data": "VPCPublicSubnet1NATGatewayE0556630"
82+
}
83+
],
84+
"/redshift-enhancedvpcrouting-integ/VPC/PublicSubnet2/Subnet": [
85+
{
86+
"type": "aws:cdk:logicalId",
87+
"data": "VPCPublicSubnet2Subnet74179F39"
88+
}
89+
],
90+
"/redshift-enhancedvpcrouting-integ/VPC/PublicSubnet2/RouteTable": [
91+
{
92+
"type": "aws:cdk:logicalId",
93+
"data": "VPCPublicSubnet2RouteTable6F1A15F1"
94+
}
95+
],
96+
"/redshift-enhancedvpcrouting-integ/VPC/PublicSubnet2/RouteTableAssociation": [
97+
{
98+
"type": "aws:cdk:logicalId",
99+
"data": "VPCPublicSubnet2RouteTableAssociation5A808732"
100+
}
101+
],
102+
"/redshift-enhancedvpcrouting-integ/VPC/PublicSubnet2/DefaultRoute": [
103+
{
104+
"type": "aws:cdk:logicalId",
105+
"data": "VPCPublicSubnet2DefaultRouteB7481BBA"
106+
}
107+
],
108+
"/redshift-enhancedvpcrouting-integ/VPC/PublicSubnet2/EIP": [
109+
{
110+
"type": "aws:cdk:logicalId",
111+
"data": "VPCPublicSubnet2EIP4947BC00"
112+
}
113+
],
114+
"/redshift-enhancedvpcrouting-integ/VPC/PublicSubnet2/NATGateway": [
115+
{
116+
"type": "aws:cdk:logicalId",
117+
"data": "VPCPublicSubnet2NATGateway3C070193"
118+
}
119+
],
120+
"/redshift-enhancedvpcrouting-integ/VPC/PrivateSubnet1/Subnet": [
121+
{
122+
"type": "aws:cdk:logicalId",
123+
"data": "VPCPrivateSubnet1Subnet8BCA10E0"
124+
}
125+
],
126+
"/redshift-enhancedvpcrouting-integ/VPC/PrivateSubnet1/RouteTable": [
127+
{
128+
"type": "aws:cdk:logicalId",
129+
"data": "VPCPrivateSubnet1RouteTableBE8A6027"
130+
}
131+
],
132+
"/redshift-enhancedvpcrouting-integ/VPC/PrivateSubnet1/RouteTableAssociation": [
133+
{
134+
"type": "aws:cdk:logicalId",
135+
"data": "VPCPrivateSubnet1RouteTableAssociation347902D1"
136+
}
137+
],
138+
"/redshift-enhancedvpcrouting-integ/VPC/PrivateSubnet1/DefaultRoute": [
139+
{
140+
"type": "aws:cdk:logicalId",
141+
"data": "VPCPrivateSubnet1DefaultRouteAE1D6490"
142+
}
143+
],
144+
"/redshift-enhancedvpcrouting-integ/VPC/PrivateSubnet2/Subnet": [
145+
{
146+
"type": "aws:cdk:logicalId",
147+
"data": "VPCPrivateSubnet2SubnetCFCDAA7A"
148+
}
149+
],
150+
"/redshift-enhancedvpcrouting-integ/VPC/PrivateSubnet2/RouteTable": [
151+
{
152+
"type": "aws:cdk:logicalId",
153+
"data": "VPCPrivateSubnet2RouteTable0A19E10E"
154+
}
155+
],
156+
"/redshift-enhancedvpcrouting-integ/VPC/PrivateSubnet2/RouteTableAssociation": [
157+
{
158+
"type": "aws:cdk:logicalId",
159+
"data": "VPCPrivateSubnet2RouteTableAssociation0C73D413"
160+
}
161+
],
162+
"/redshift-enhancedvpcrouting-integ/VPC/PrivateSubnet2/DefaultRoute": [
163+
{
164+
"type": "aws:cdk:logicalId",
165+
"data": "VPCPrivateSubnet2DefaultRouteF4F5CFD2"
166+
}
167+
],
168+
"/redshift-enhancedvpcrouting-integ/VPC/IGW": [
169+
{
170+
"type": "aws:cdk:logicalId",
171+
"data": "VPCIGWB7E252D3"
172+
}
173+
],
174+
"/redshift-enhancedvpcrouting-integ/VPC/VPCGW": [
175+
{
176+
"type": "aws:cdk:logicalId",
177+
"data": "VPCVPCGW99B986DC"
178+
}
179+
],
180+
"/redshift-enhancedvpcrouting-integ/Cluster/Subnets/Default": [
181+
{
182+
"type": "aws:cdk:logicalId",
183+
"data": "ClusterSubnetsDCFA5CB7"
184+
}
185+
],
186+
"/redshift-enhancedvpcrouting-integ/Cluster/SecurityGroup/Resource": [
187+
{
188+
"type": "aws:cdk:logicalId",
189+
"data": "ClusterSecurityGroup0921994B"
190+
}
191+
],
192+
"/redshift-enhancedvpcrouting-integ/Cluster/Secret/Resource": [
193+
{
194+
"type": "aws:cdk:logicalId",
195+
"data": "ClusterSecret6368BD0F"
196+
}
197+
],
198+
"/redshift-enhancedvpcrouting-integ/Cluster/Secret/Attachment/Resource": [
199+
{
200+
"type": "aws:cdk:logicalId",
201+
"data": "ClusterSecretAttachment769E6258"
202+
}
203+
],
204+
"/redshift-enhancedvpcrouting-integ/Cluster/Resource": [
205+
{
206+
"type": "aws:cdk:logicalId",
207+
"data": "ClusterEB0386A7"
208+
}
209+
],
210+
"/redshift-enhancedvpcrouting-integ/BootstrapVersion": [
211+
{
212+
"type": "aws:cdk:logicalId",
213+
"data": "BootstrapVersion"
214+
}
215+
],
216+
"/redshift-enhancedvpcrouting-integ/CheckBootstrapVersion": [
217+
{
218+
"type": "aws:cdk:logicalId",
219+
"data": "CheckBootstrapVersion"
220+
}
221+
]
222+
},
223+
"displayName": "redshift-enhancedvpcrouting-integ"
224+
},
225+
"EnhancedVpcRoutingDefaultTestDeployAssert10B513A1.assets": {
226+
"type": "cdk:asset-manifest",
227+
"properties": {
228+
"file": "EnhancedVpcRoutingDefaultTestDeployAssert10B513A1.assets.json",
229+
"requiresBootstrapStackVersion": 6,
230+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
231+
}
232+
},
233+
"EnhancedVpcRoutingDefaultTestDeployAssert10B513A1": {
234+
"type": "aws:cloudformation:stack",
235+
"environment": "aws://unknown-account/unknown-region",
236+
"properties": {
237+
"templateFile": "EnhancedVpcRoutingDefaultTestDeployAssert10B513A1.template.json",
238+
"validateOnSynth": false,
239+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
240+
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
241+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
242+
"requiresBootstrapStackVersion": 6,
243+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
244+
"additionalDependencies": [
245+
"EnhancedVpcRoutingDefaultTestDeployAssert10B513A1.assets"
246+
],
247+
"lookupRole": {
248+
"arn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}",
249+
"requiresBootstrapStackVersion": 8,
250+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
251+
}
252+
},
253+
"dependencies": [
254+
"EnhancedVpcRoutingDefaultTestDeployAssert10B513A1.assets"
255+
],
256+
"metadata": {
257+
"/EnhancedVpcRouting/DefaultTest/DeployAssert/BootstrapVersion": [
258+
{
259+
"type": "aws:cdk:logicalId",
260+
"data": "BootstrapVersion"
261+
}
262+
],
263+
"/EnhancedVpcRouting/DefaultTest/DeployAssert/CheckBootstrapVersion": [
264+
{
265+
"type": "aws:cdk:logicalId",
266+
"data": "CheckBootstrapVersion"
267+
}
268+
]
269+
},
270+
"displayName": "EnhancedVpcRouting/DefaultTest/DeployAssert"
271+
}
272+
}
273+
}

0 commit comments

Comments
 (0)