CODEWITHSUNDEEP
terraformamazon-redshiftterraform-provider-awsamazon-redshift-serverless
nickklon
nickklon

Reputation: 121

How to add "Granted accounts" for Redshift Serverless Workgroup with Terraform?

I want to grant access to my Redshift Serverless workgroup so other specified accounts to create Redshift-managed VPC endpoints.

In the workgroup view in the console, it looks like it is an attribute on the workgroup. However, it is not a member of that Terraform resource.

Upvotes: 0

Views: 162

Answers (2)

Nevermore
Nevermore

Reputation: 7409

Your answer helped me, here was my complete working example

resource "aws_redshiftserverless_resource_policy" "this" {
  resource_arn = aws_redshiftserverless_workgroup.this.arn

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          AWS = "arn:aws:iam::EXTERNAL_ACCOUNT_ID:root"
        }
        Condition = {
          "ArnLike": {
            "redshift-serverless:AuthorizedVpc": [ "arn:aws:ec2:eu-west-1:EXTERNAL_ACCOUNT_ID:vpc/VPC_ID" ]

          }
        }
        Action = [
          "redshift-serverless:CreateEndpointAccess",
          "redshift-serverless:UpdateEndpointAccess",
          "redshift-serverless:DeleteEndpointAccess",
          "redshift-serverless:GetEndpointAccess"
        ]
      }
    ]
  })
}

This allowed me to grant external accounts access to my private Redshift serverless instance

Upvotes: 1

nickklon
nickklon

Reputation: 121

Though it looks like a workgroup setting in the console, inspecting the network request while updating “Granted accounts” shows that like most access in AWS, it's controlled with an IAM policy.

What you need to set this via Terraform is an aws_redshiftserverless_resource_policy with the resource_arn set to your workgroup arn, and the policy statement should look like:

{
  "Principal": {
    "AWS": ["123456789012", "987654321098"]
  },
  "Action" [
   "redshift-serverless:CreateEndpointAccess",
   "redshift-serverless:UpdateEndpointAccess",
   "redshift-serverless:DeleteEndpointAccess",
   "redshift-serverless:GetEndpointAccess"
  ],
  "Condition": {
    "ArnLike": {
      "redshift-serverless:AuthorizedVpc": [ "arn:aws:ec2:<REGION>:<ACCOUNT_ID>:vpc/<VPC_ID_OR_*>" ]
    }
  }
}

*** Disclaimer: this is how I observed the policy being set via the console. Like everything on SO, you should vet this before using it yourself :)

Upvotes: 1

Related Questions