aws / aws/aws-cdk

aws-redshift-alpha: implement the IGrantable interface on Redshift Clusters

Open
#28,013 1 comment 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-redshift effort/small feature-request p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the feature

Have Redshift Clusters implement the [IGrantable](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IGrantable.html) interface.

### Use Case

I use Redshift Clusters with Redshift Spectrum to read Data from S3 Buckets. It would be nice if I could use the the grant method to give my cluster access to S3 Buckets defined in the same applications

```ts

const cluster = new Cluster(this, 'Cluster', {...});
const bucket = new s3.Bucket(stack, 'KmsBucket',{
encryptionKey: new kms.Key(stack,'Key')
})
// Granting permissions to read data from a KMS encrypted Bucket
bucket.grantRead(cluster)
```

### Proposed Solution

1. Add a default IAM role with no permissions to the Cluster to use as the `grantPrincipal`
2. Pass the role into the list of IAM roles that used in the `CfnCluster`

### Other Information

Having a default IAM role also makes it friendlier to add custom permissions to the cluster than creating a role and passing it into the Cluster Props

### Acknowledgements

- [X] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.108.1

### Environment details (OS name and version, etc.)

Not relevant, but macOs 13.4 (Ventura) 😄

Contributor guide

Open the contributing guide

Research direction

Begin with the aws-redshift-alpha Cluster construct and its CfnCluster role wiring. Read the IGrantable and grantPrincipal contract, then check that the proposed default role is included in the cluster's IAM roles and that bucket.grantRead(cluster) can use it. No test file is named, so completion should include coverage for this behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.