(redshift): How to enable audit logging from redshift module
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
Hi there,
We are creating a redshift cluster from `aws-cdk/aws-redshift-alpha` module and can't see a way to enable audit logging. Even though we set `enable_user_activity_logging` to true aws console displays audit logging disabled. We want to forward logs to CloudWatch not S3 so `loggingProperties` doesn't solve this case as well. I also couldn't find the related property from CloudFormation [reference](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-redshift-cluster.html)
Here is the cdk code for creating a cluster and configuring the parameter group for it.
```
// redshift single node "cluster"
const redshiftCluster = new redshift.Cluster(this, 'Cluster', {
masterUser: {
masterUsername: 'foobar',
encryptionKey: key,
},
vpc: props.vpc,
vpcSubnets: {
subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
},
publiclyAccessible: false,
clusterType: redshift.ClusterType.SINGLE_NODE,
nodeType: redshift.NodeType.DC2_LARGE,
encrypted: true,
enhancedVpcRouting: true,
preferredMaintenanceWindow: 'Sat:23:45-Sun:00:45',
// permissions
defaultRole: role,
roles: [role],
// don't delete on accident when stack is deleted
removalPolicy: cdk.RemovalPolicy.RETAIN,
});
// database parameters
redshiftCluster.addToParameterGroup('enable_user_activity_logging', 'true');
redshiftCluster.addToParameterGroup('require_ssl', 'true');
```
I am not sure if this is considered as a bug so please guide me.
Thanks!
### Expected Behavior
There should be a proper way for enabling audit logs into CloudWatch from aws cdk
### Current Behavior
There is no way of enabling audit logs into CloudWatch
### Reproduction Steps
I shared the simple cdk code
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### CDK CLI Version
2.81.0
### Framework Version
_No response_
### Node.js Version
18.0.0
### OS
macos
### Language
Typescript
### Language Version
_No response_
### Other information
_No response_
Contributor guide
Research direction
Inspect the aws-redshift-alpha Cluster API and the CloudFormation Redshift cluster resource documentation first, then compare the available logging properties with the requested CloudWatch audit logging. Done means establishing whether the underlying service supports this configuration and identifying the CDK-facing change or limitation; validate against the provided cluster setup.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, databases
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100