aws / aws/aws-cdk

(redshift): How to enable audit logging from redshift module

Open
#25,755 1 comment 1 reaction 0 assignees View on GitHub
@aws-cdk/aws-redshift bug effort/medium needs-cfn p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

Hi there,

We are creating a redshift cluster from `aws-cdk/aws-redshift-alpha` module and can't see a way to enable audit logging. Even though we set `enable_user_activity_logging` to true aws console displays audit logging disabled. We want to forward logs to CloudWatch not S3 so `loggingProperties` doesn't solve this case as well. I also couldn't find the related property from CloudFormation [reference](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-redshift-cluster.html)

Here is the cdk code for creating a cluster and configuring the parameter group for it.
```
// redshift single node "cluster"
const redshiftCluster = new redshift.Cluster(this, 'Cluster', {
masterUser: {
masterUsername: 'foobar',
encryptionKey: key,
},
vpc: props.vpc,
vpcSubnets: {
subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
},
publiclyAccessible: false,
clusterType: redshift.ClusterType.SINGLE_NODE,
nodeType: redshift.NodeType.DC2_LARGE,
encrypted: true,
enhancedVpcRouting: true,
preferredMaintenanceWindow: 'Sat:23:45-Sun:00:45',
// permissions
defaultRole: role,
roles: [role],
// don't delete on accident when stack is deleted
removalPolicy: cdk.RemovalPolicy.RETAIN,
});

// database parameters
redshiftCluster.addToParameterGroup('enable_user_activity_logging', 'true');
redshiftCluster.addToParameterGroup('require_ssl', 'true');
```

I am not sure if this is considered as a bug so please guide me.

Thanks!

### Expected Behavior

There should be a proper way for enabling audit logs into CloudWatch from aws cdk

### Current Behavior

There is no way of enabling audit logs into CloudWatch

### Reproduction Steps

I shared the simple cdk code

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.81.0

### Framework Version

_No response_

### Node.js Version

18.0.0

### OS

macos

### Language

Typescript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Inspect the aws-redshift-alpha Cluster API and the CloudFormation Redshift cluster resource documentation first, then compare the available logging properties with the requested CloudWatch audit logging. Done means establishing whether the underlying service supports this configuration and identifying the CDK-facing change or limitation; validate against the provided cluster setup.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, databases
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.