AWS Redshift Terraform module

Terraform module which creates Redshift resources on AWS.

Usage

module "redshift" {
  source  = "terraform-aws-modules/redshift/aws"

  cluster_identifier    = "example"
  allow_version_upgrade = true
  node_type             = "ra3.xlplus"
  number_of_nodes       = 3

  database_name   = "mydb"
  master_username = "mydbuser"

  manage_master_password                       = true
  manage_master_password_rotation              = true
  master_password_rotation_schedule_expression = "rate(90 days)"

  encrypted   = true
  kms_key_arn = "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"

  vpc_id                               = "vpc-1234556abcdef"
  enhanced_vpc_routing                 = true
  availability_zone_relocation_enabled = true

  snapshot_copy = {
    destination_region = "us-east-1"
    grant_name         = "example-grant"
  }

  logging = {
    bucket_name   = "my-s3-log-bucket"
    s3_key_prefix = "example/"
  }

  # Parameter group
  parameter_group_name        = "example-custom"
  parameter_group_description = "Custom parameter group for example cluster"
  parameter_group_parameters = {
    wlm_json_configuration = {
      name = "wlm_json_configuration"
      value = jsonencode([
        {
          query_concurrency = 15
        }
      ])
    }
    require_ssl = {
      name  = "require_ssl"
      value = true
    }
    use_fips_ssl = {
      name  = "use_fips_ssl"
      value = false
    }
    enable_user_activity_logging = {
      name  = "enable_user_activity_logging"
      value = true
    }
    max_concurrency_scaling_clusters = {
      name  = "max_concurrency_scaling_clusters"
      value = 3
    }
    enable_case_sensitive_identifier = {
      name  = "enable_case_sensitive_identifier"
      value = true
    }
  }
  parameter_group_tags = {
    Additional = "CustomParameterGroup"
  }

  # Subnet group
  subnet_group_name        = "example-custom"
  subnet_group_description = "Custom subnet group for example cluster"
  subnet_ids               = ["subnet-123456", "subnet-654321"]
  subnet_group_tags = {
    Additional = "CustomSubnetGroup"
  }

  # Snapshot schedule
  snapshot_schedule = {
    identifier    = "example"
    use_prefix    = true
    description   = "Example snapshot schedule"
    definitions   = ["rate(12 hours)"]
    force_destroy = true
  }

  # Scheduled actions
  create_scheduled_action_iam_role = true
  scheduled_actions = {
    pause = {
      name          = "example-pause"
      description   = "Pause cluster every night"
      schedule      = "cron(0 22 * * ? *)"
      target_action = {
        pause_cluster = true
      }
    }
    resize = {
      name        = "example-resize"
      description = "Resize cluster (demo only)"
      schedule    = "cron(00 13 * * ? *)"
      target_action = {
        resize_cluster = {
          node_type       = "ds2.xlarge"
          number_of_nodes = 5
        }
      }
    }
    resume = {
      name           = "example-resume"
      description    = "Resume cluster every morning"
      schedule       = "cron(0 12 * * ? *)"
      target_action = {
        resume_cluster = true
      }
    }
  }

  # Endpoint access
  endpoint_access = {
    example = {
      name                   = "example-example"
      subnet_group_name      = "example-subnet-group"
      vpc_security_group_ids = ["sg-12345678"]
    }
  }

  # Usage limits
  usage_limits = {
    currency_scaling = {
      feature_type  = "concurrency-scaling"
      limit_type    = "time"
      amount        = 60
      breach_action = "emit-metric"
    }
    spectrum = {
      feature_type  = "spectrum"
      limit_type    = "data-scanned"
      amount        = 2
      breach_action = "disable"
      tags = {
        Additional = "CustomUsageLimits"
      }
    }
  }

  # Authentication profile
  authentication_profiles = {
    example = {
      name = "example"
      content = {
        AllowDBUserOverride = "1"
        Client_ID           = "ExampleClientID"
        App_ID              = "example"
      }
    }
    bar = {
      content = {
        AllowDBUserOverride = "1"
        Client_ID           = "ExampleClientID"
        App_ID              = "bar"
      }
    }
  }

  tags = {
    Environment = "dev"
    Terraform   = "true"
  }
}

Examples

• Complete Redshift example creates VPC with Redshift subnet, VPC security group and Redshift cluster itself.

Requirements

Providers

Modules

No modules.

Resources

Inputs

map(object({
    name    = optional(string) # Will fall back to key if not set
    content = any
  }))

object({
    create = optional(string)
    update = optional(string)
    delete = optional(string)
  })

map(object({
    name                   = optional(string) # Will fall back to key if not set
    resource_owner         = optional(string)
    subnet_group_name      = string
    vpc_security_group_ids = optional(list(string))
  }))

object({
    bucket_name          = optional(string)
    log_destination_type = optional(string)
    log_exports          = optional(list(string))
    s3_key_prefix        = optional(string)
  })

list(object({
    name  = string
    value = string
  }))

map(object({
    name        = optional(string) # Will fall back to key if not set
    description = optional(string)
    enable      = optional(bool)
    start_time  = optional(string)
    end_time    = optional(string)
    schedule    = string
    iam_role    = optional(string)
    target_action = object({
      pause_cluster = optional(bool, false)
      resize_cluster = optional(object({
        classic         = optional(bool)
        cluster_type    = optional(string)
        node_type       = optional(string)
        number_of_nodes = optional(number)
      }))
      resume_cluster = optional(bool, false)
    })
  }))

map(object({
    name = optional(string)

    cidr_ipv4                    = optional(string)
    cidr_ipv6                    = optional(string)
    description                  = optional(string)
    from_port                    = optional(number)
    ip_protocol                  = optional(string, "tcp")
    prefix_list_id               = optional(string)
    referenced_security_group_id = optional(string)
    region                       = optional(string)
    tags                         = optional(map(string), {})
    to_port                      = optional(number)
  }))

map(object({
    name = optional(string)

    cidr_ipv4                    = optional(string)
    cidr_ipv6                    = optional(string)
    description                  = optional(string)
    from_port                    = optional(number)
    ip_protocol                  = optional(string, "tcp")
    prefix_list_id               = optional(string)
    referenced_security_group_id = optional(string)
    region                       = optional(string)
    tags                         = optional(map(string), {})
    to_port                      = optional(number)
  }))

object({
    destination_region               = string
    manual_snapshot_retention_period = optional(number)
    retention_period                 = optional(number)
    grant_name                       = optional(string)
  })

object({
    definitions   = list(string)
    description   = optional(string)
    force_destroy = optional(bool)
    use_prefix    = optional(bool, false)
    identifier    = optional(string)
    tags          = optional(map(string), {})
  })

map(object({
    amount        = number
    breach_action = optional(string)
    feature_type  = string
    limit_type    = optional(string) # Will fall back to key if not set
    period        = optional(string)
    tags          = optional(map(string), {})
  }))

Outputs

Authors

Module is maintained by Anton Babenko with help from these awesome contributors.

License

Apache 2 Licensed. See LICENSE for full details.