Skip to content

Commit a23a3f5

Browse files
mergify[bot]mergify[bot]
authored
Merge branch 'main' into revert-21305-hotswap-configurations
2 parents 14545a8 + 220177f commit a23a3f5

13 files changed

Lines changed: 2482 additions & 16 deletions

‎packages/@aws-cdk/aws-redshift/README.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,29 @@ A default database named `default_db` will be created in the cluster. To change
4545
By default, the cluster will not be publicly accessible.
4646
Depending on your use case, you can make the cluster publicly accessible with the `publiclyAccessible` property.
4747

48+
## Adding a logging bucket for database audit logging to S3
49+
50+
Amazon Redshift logs information about connections and user activities in your database. These logs help you to monitor the database for security and troubleshooting purposes, a process called database auditing. To send these logs to an S3 bucket, specify the `loggingProperties` when creating a new cluster.
51+
52+
```ts
53+
import * as ec2 from '@aws-cdk/aws-ec2';
54+
import * as s3 from '@aws-cdk/aws-s3';
55+
56+
const vpc = new ec2.Vpc(this, 'Vpc');
57+
const bucket = s3.Bucket.fromBucketName(stack, 'bucket', 'logging-bucket');
58+
59+
const cluster = new Cluster(this, 'Redshift', {
60+
masterUser: {
61+
masterUsername: 'admin',
62+
},
63+
vpc,
64+
loggingProperties: {
65+
loggingBucket = bucket,
66+
loggingKeyPrefix: 'prefix',
67+
}
68+
});
69+
```
70+
4871
## Connecting
4972

5073
To control who can access the cluster, use the `.connections` attribute. Redshift Clusters have

‎packages/@aws-cdk/aws-redshift/lib/cluster.ts‎

Lines changed: 41 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,24 @@ export interface Login {
9595
readonly encryptionKey?: kms.IKey;
9696
}
9797

98+
/**
99+
* Logging bucket and S3 prefix combination
100+
*/
101+
export interface LoggingProperties {
102+
/**
103+
* Bucket to send logs to.
104+
* Logging information includes queries and connection attempts, for the specified Amazon Redshift cluster.
105+
*
106+
*/
107+
readonly loggingBucket: s3.IBucket
108+
109+
/**
110+
* Prefix used for logging.
111+
*
112+
*/
113+
readonly loggingKeyPrefix: string
114+
}
115+
98116
/**
99117
* Options to add the multi user rotation
100118
*/
@@ -294,19 +312,11 @@ export interface ClusterProps {
294312
readonly defaultDatabaseName?: string;
295313

296314
/**
297-
* Bucket to send logs to.
298-
* Logging information includes queries and connection attempts, for the specified Amazon Redshift cluster.
299-
*
300-
* @default - No Logs
301-
*/
302-
readonly loggingBucket?: s3.IBucket
303-
304-
/**
305-
* Prefix used for logging
315+
* Bucket details for log files to be sent to, including prefix.
306316
*
307-
* @default - no prefix
317+
* @default - No logging bucket is used
308318
*/
309-
readonly loggingKeyPrefix?: string
319+
readonly loggingProperties?: LoggingProperties;
310320

311321
/**
312322
* The removal policy to apply when the cluster and its instances are removed
@@ -475,11 +485,28 @@ export class Cluster extends ClusterBase {
475485
this.multiUserRotationApplication = secretsmanager.SecretRotationApplication.REDSHIFT_ROTATION_MULTI_USER;
476486

477487
let loggingProperties;
478-
if (props.loggingBucket) {
488+
if (props.loggingProperties) {
479489
loggingProperties = {
480-
bucketName: props.loggingBucket.bucketName,
481-
s3KeyPrefix: props.loggingKeyPrefix,
490+
bucketName: props.loggingProperties.loggingBucket.bucketName,
491+
s3KeyPrefix: props.loggingProperties.loggingKeyPrefix,
482492
};
493+
props.loggingProperties.loggingBucket.addToResourcePolicy(
494+
new iam.PolicyStatement(
495+
{
496+
actions: [
497+
's3:GetBucketAcl',
498+
's3:PutObject',
499+
],
500+
resources: [
501+
props.loggingProperties.loggingBucket.arnForObjects('*'),
502+
props.loggingProperties.loggingBucket.bucketArn,
503+
],
504+
principals: [
505+
new iam.ServicePrincipal('redshift.amazonaws.com'),
506+
],
507+
},
508+
),
509+
);
483510
}
484511

485512
const cluster = new CfnCluster(this, 'Resource', {

‎packages/@aws-cdk/aws-redshift/package.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,7 @@
8585
"@aws-cdk/integ-runner": "0.0.0",
8686
"@aws-cdk/cfn2ts": "0.0.0",
8787
"@aws-cdk/pkglint": "0.0.0",
88+
"@aws-cdk/integ-tests": "0.0.0",
8889
"@types/jest": "^27.5.2",
8990
"aws-sdk": "^2.848.0",
9091
"jest": "^27.5.1"

‎packages/@aws-cdk/aws-redshift/test/cluster-loggingbucket.integ.snapshot/LoggingBucketIntegDefaultTestDeployAssert2827ECC1.template.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{}

‎packages/@aws-cdk/aws-redshift/test/cluster-loggingbucket.integ.snapshot/aws-cdk-redshift-cluster-loggingbucket.assets.json‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "20.0.0",
3+
"files": {
4+
"941d95acb9a710e3df3e05301e7debabdecabed59c6b395b0265d4d3be632c5f": {
5+
"source": {
6+
"path": "aws-cdk-redshift-cluster-loggingbucket.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "941d95acb9a710e3df3e05301e7debabdecabed59c6b395b0265d4d3be632c5f.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

0 commit comments

Comments
 (0)