Terraform module which creates Redshift resources on AWS.
module "redshift" {
source = "terraform-aws-modules/redshift/aws"
cluster_identifier = "example"
allow_version_upgrade = true
node_type = "ra3.xlplus"
number_of_nodes = 3
database_name = "mydb"
master_username = "mydbuser"
create_random_password = false
master_password = "MySecretPassw0rd1!" # Do better!
encrypted = true
kms_key_arn = "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
enhanced_vpc_routing = true
vpc_security_group_ids = ["sg-12345678"]
subnet_ids = ["subnet-123456", "subnet-654321"]
availability_zone_relocation_enabled = true
snapshot_copy = {
useast1 = {
destination_region = "us-east-1"
grant_name = "example-grant"
}
}
logging = {
enable = true
bucket_name = "my-s3-log-bucket"
s3_key_prefix = "example/"
}
# Parameter group
parameter_group_name = "example-custom"
parameter_group_description = "Custom parameter group for example cluster"
parameter_group_parameters = {
wlm_json_configuration = {
name = "wlm_json_configuration"
value = jsonencode([
{
query_concurrency = 15
}
])
}
require_ssl = {
name = "require_ssl"
value = true
}
use_fips_ssl = {
name = "use_fips_ssl"
value = false
}
enable_user_activity_logging = {
name = "enable_user_activity_logging"
value = true
}
max_concurrency_scaling_clusters = {
name = "max_concurrency_scaling_clusters"
value = 3
}
enable_case_sensitive_identifier = {
name = "enable_case_sensitive_identifier"
value = true
}
}
parameter_group_tags = {
Additional = "CustomParameterGroup"
}
# Subnet group
subnet_group_name = "example-custom"
subnet_group_description = "Custom subnet group for example cluster"
subnet_group_tags = {
Additional = "CustomSubnetGroup"
}
# Snapshot schedule
create_snapshot_schedule = true
snapshot_schedule_identifier = local.name
use_snapshot_identifier_prefix = true
snapshot_schedule_description = "Example snapshot schedule"
snapshot_schedule_definitions = ["rate(12 hours)"]
snapshot_schedule_force_destroy = true
# Scheduled actions
create_scheduled_action_iam_role = true
scheduled_actions = {
pause = {
name = "example-pause"
description = "Pause cluster every night"
schedule = "cron(0 22 * * ? *)"
pause_cluster = true
}
resize = {
name = "example-resize"
description = "Resize cluster (demo only)"
schedule = "cron(00 13 * * ? *)"
resize_cluster = {
node_type = "ds2.xlarge"
number_of_nodes = 5
}
}
resume = {
name = "example-resume"
description = "Resume cluster every morning"
schedule = "cron(0 12 * * ? *)"
resume_cluster = true
}
}
# Endpoint access
create_endpoint_access = true
endpoint_name = "example-example"
endpoint_subnet_group_name = "example-subnet-group"
endpoint_vpc_security_group_ids = ["sg-12345678"]
# Usage limits
usage_limits = {
currency_scaling = {
feature_type = "concurrency-scaling"
limit_type = "time"
amount = 60
breach_action = "emit-metric"
}
spectrum = {
feature_type = "spectrum"
limit_type = "data-scanned"
amount = 2
breach_action = "disable"
tags = {
Additional = "CustomUsageLimits"
}
}
}
# Authentication profile
authentication_profiles = {
example = {
name = "example"
content = {
AllowDBUserOverride = "1"
Client_ID = "ExampleClientID"
App_ID = "example"
}
}
bar = {
content = {
AllowDBUserOverride = "1"
Client_ID = "ExampleClientID"
App_ID = "bar"
}
}
}
tags = {
Environment = "dev"
Terraform = "true"
}
}- Complete Redshift example creates VPC with Redshift subnet, VPC security group and Redshift cluster itself.
| Name | Version |
|---|---|
| terraform | >= 1.0 |
| aws | >= 4.17 |
| random | >= 3.0 |
| Name | Version |
|---|---|
| aws | >= 4.17 |
| random | >= 3.0 |
No modules.
| Name | Type |
|---|---|
| aws_iam_role.scheduled_action | resource |
| aws_iam_role_policy.scheduled_action | resource |
| aws_redshift_authentication_profile.this | resource |
| aws_redshift_cluster.this | resource |
| aws_redshift_cluster_iam_roles.this | resource |
| aws_redshift_endpoint_access.this | resource |
| aws_redshift_parameter_group.this | resource |
| aws_redshift_scheduled_action.this | resource |
| aws_redshift_snapshot_schedule.this | resource |
| aws_redshift_snapshot_schedule_association.this | resource |
| aws_redshift_subnet_group.this | resource |
| aws_redshift_usage_limit.this | resource |
| random_password.master_password | resource |
| aws_iam_policy_document.scheduled_action | data source |
| aws_iam_policy_document.scheduled_action_assume | data source |
| aws_partition.current | data source |
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| allow_version_upgrade | If true, major version upgrades can be applied during the maintenance window to the Amazon Redshift engine that is running on the cluster. Default is true |
bool |
null |
no |
| apply_immediately | Specifies whether any cluster modifications are applied immediately, or during the next maintenance window. Default is false |
bool |
null |
no |
| aqua_configuration_status | The value represents how the cluster is configured to use AQUA (Advanced Query Accelerator) after the cluster is restored. Possible values are enabled, disabled, and auto. Requires Cluster reboot |
string |
null |
no |
| authentication_profiles | Map of authentication profiles to create | any |
{} |
no |
| automated_snapshot_retention_period | The number of days that automated snapshots are retained. If the value is 0, automated snapshots are disabled. Even if automated snapshots are disabled, you can still create manual snapshots when you want with create-cluster-snapshot. Default is 1 | number |
null |
no |
| availability_zone | The EC2 Availability Zone (AZ) in which you want Amazon Redshift to provision the cluster. Can only be changed if availability_zone_relocation_enabled is true |
string |
null |
no |
| availability_zone_relocation_enabled | If true, the cluster can be relocated to another availabity zone, either automatically by AWS or when requested. Default is false. Available for use on clusters from the RA3 instance family |
bool |
null |
no |
| cluster_identifier | The Cluster Identifier. Must be a lower case string | string |
"" |
no |
| cluster_timeouts | Create, update, and delete timeout configurations for the cluster | map(string) |
{} |
no |
| cluster_version | The version of the Amazon Redshift engine software that you want to deploy on the cluster. The version selected runs on all the nodes in the cluster | string |
null |
no |
| create | Determines whether to create Redshift cluster and resources (affects all resources) | bool |
true |
no |
| create_endpoint_access | Determines whether to create an endpoint access (managed VPC endpoint) | bool |
false |
no |
| create_parameter_group | Determines whether to create a parameter group or use existing | bool |
true |
no |
| create_random_password | Determines whether to create random password for cluster master_password |
bool |
true |
no |
| create_scheduled_action_iam_role | Determines whether a scheduled action IAM role is created | bool |
false |
no |
| create_snapshot_schedule | Determines whether to create a snapshot schedule | bool |
false |
no |
| create_subnet_group | Determines whether to create a subnet group or use existing | bool |
true |
no |
| database_name | The name of the first database to be created when the cluster is created. If you do not provide a name, Amazon Redshift will create a default database called dev |
string |
null |
no |
| default_iam_role_arn | The Amazon Resource Name (ARN) for the IAM role that was set as default for the cluster when the cluster was created | string |
null |
no |
| elastic_ip | The Elastic IP (EIP) address for the cluster | string |
null |
no |
| encrypted | If true, the data in the cluster is encrypted at rest |
bool |
true |
no |
| endpoint_name | The Redshift-managed VPC endpoint name | string |
"" |
no |
| endpoint_resource_owner | The Amazon Web Services account ID of the owner of the cluster. This is only required if the cluster is in another Amazon Web Services account | string |
null |
no |
| endpoint_subnet_group_name | The subnet group from which Amazon Redshift chooses the subnet to deploy the endpoint | string |
"" |
no |
| endpoint_vpc_security_group_ids | The security group IDs to use for the endpoint access (managed VPC endpoint) | list(string) |
[] |
no |
| enhanced_vpc_routing | If true, enhanced VPC routing is enabled |
bool |
null |
no |
| final_snapshot_identifier | The identifier of the final snapshot that is to be created immediately before deleting the cluster. If this parameter is provided, skip_final_snapshot must be false |
string |
null |
no |
| iam_role_arns | A list of IAM Role ARNs to associate with the cluster. A Maximum of 10 can be associated to the cluster at any time | list(string) |
[] |
no |
| iam_role_description | Description of the scheduled action IAM role | string |
null |
no |
| iam_role_name | Name to use on scheduled action IAM role created | string |
null |
no |
| iam_role_path | Scheduled action IAM role path | string |
null |
no |
| iam_role_permissions_boundary | ARN of the policy that is used to set the permissions boundary for the scheduled action IAM role | string |
null |
no |
| iam_role_tags | A map of additional tags to add to the scheduled action IAM role created | map(string) |
{} |
no |
| iam_role_use_name_prefix | Determines whether scheduled action the IAM role name (iam_role_name) is used as a prefix |
string |
true |
no |
| kms_key_arn | The ARN for the KMS encryption key. When specifying kms_key_arn, encrypted needs to be set to true |
string |
null |
no |
| logging | Logging configuration for the cluster | any |
{} |
no |
| maintenance_track_name | The name of the maintenance track for the restored cluster. When you take a snapshot, the snapshot inherits the MaintenanceTrack value from the cluster. The snapshot might be on a different track than the cluster that was the source for the snapshot. Default value is current |
string |
null |
no |
| manual_snapshot_retention_period | The default number of days to retain a manual snapshot. If the value is -1, the snapshot is retained indefinitely. This setting doesn't change the retention period of existing snapshots. Valid values are between -1 and 3653. Default value is -1 |
number |
null |
no |
| master_password | Password for the master DB user. (Required unless a snapshot_identifier is provided). Must contain at least 8 chars, one uppercase letter, one lowercase letter, and one number |
string |
null |
no |
| master_username | Username for the master DB user (Required unless a snapshot_identifier is provided). Defaults to awsuser |
string |
"awsuser" |
no |
| node_type | The node type to be provisioned for the cluster | string |
"" |
no |
| number_of_nodes | Number of nodes in the cluster. Defaults to 1. Note: values greater than 1 will trigger cluster_type to switch to multi-node |
number |
1 |
no |
| owner_account | The AWS customer account used to create or copy the snapshot. Required if you are restoring a snapshot you do not own, optional if you own the snapshot | string |
null |
no |
| parameter_group_description | The description of the Redshift parameter group. Defaults to Managed by Terraform |
string |
null |
no |
| parameter_group_family | The family of the Redshift parameter group | string |
"redshift-1.0" |
no |
| parameter_group_name | The name of the Redshift parameter group, existing or to be created | string |
null |
no |
| parameter_group_parameters | value | map(any) |
{} |
no |
| parameter_group_tags | Additional tags to add to the parameter group | map(string) |
{} |
no |
| port | The port number on which the cluster accepts incoming connections. Default port is 5439 | number |
null |
no |
| preferred_maintenance_window | The weekly time range (in UTC) during which automated cluster maintenance can occur. Format: ddd:hh24:mi-ddd:hh24:mi |
string |
"sat:10:00-sat:10:30" |
no |
| publicly_accessible | If true, the cluster can be accessed from a public network | bool |
false |
no |
| random_password_length | Length of random password to create. Defaults to 16 |
number |
16 |
no |
| scheduled_actions | Map of maps containing scheduled action defintions | any |
{} |
no |
| skip_final_snapshot | Determines whether a final snapshot of the cluster is created before Redshift deletes the cluster. If true, a final cluster snapshot is not created. If false , a final cluster snapshot is created before the cluster is deleted | bool |
true |
no |
| snapshot_cluster_identifier | The name of the cluster the source snapshot was created from | string |
null |
no |
| snapshot_copy | Configuration of automatic copy of snapshots from one region to another | any |
{} |
no |
| snapshot_identifier | The name of the snapshot from which to create the new cluster | string |
null |
no |
| snapshot_schedule_definitions | The definition of the snapshot schedule. The definition is made up of schedule expressions, for example cron(30 12 *) or rate(12 hours) |
list(string) |
[] |
no |
| snapshot_schedule_description | The description of the snapshot schedule | string |
null |
no |
| snapshot_schedule_force_destroy | Whether to destroy all associated clusters with this snapshot schedule on deletion. Must be enabled and applied before attempting deletion | bool |
null |
no |
| snapshot_schedule_identifier | The snapshot schedule identifier | string |
null |
no |
| subnet_group_description | The description of the Redshift Subnet group. Defaults to Managed by Terraform |
string |
null |
no |
| subnet_group_name | The name of the Redshift subnet group, existing or to be created | string |
null |
no |
| subnet_group_tags | Additional tags to add to the subnet group | map(string) |
{} |
no |
| subnet_ids | An array of VPC subnet IDs to use in the subnet group | list(string) |
[] |
no |
| tags | A map of tags to add to all resources | map(string) |
{} |
no |
| usage_limits | Map of usage limit defintions to create | any |
{} |
no |
| use_snapshot_identifier_prefix | Determines whether the identifier (snapshot_schedule_identifier) is used as a prefix |
bool |
true |
no |
| vpc_security_group_ids | A list of Virtual Private Cloud (VPC) security groups to be associated with the cluster | list(string) |
[] |
no |
| Name | Description |
|---|---|
| authentication_profiles | Map of authentication profiles created and their associated attributes |
| cluster_arn | The Redshift cluster ARN |
| cluster_automated_snapshot_retention_period | The backup retention period |
| cluster_availability_zone | The availability zone of the Cluster |
| cluster_database_name | The name of the default database in the Cluster |
| cluster_dns_name | The DNS name of the cluster |
| cluster_encrypted | Whether the data in the cluster is encrypted |
| cluster_endpoint | The connection endpoint |
| cluster_hostname | The hostname of the Redshift cluster |
| cluster_id | The Redshift cluster ID |
| cluster_identifier | The Redshift cluster identifier |
| cluster_node_type | The type of nodes in the cluster |
| cluster_nodes | The nodes in the cluster. Each node is a map of the following attributes: node_role, private_ip_address, and public_ip_address |
| cluster_parameter_group_name | The name of the parameter group to be associated with this cluster |
| cluster_port | The port the cluster responds on |
| cluster_preferred_maintenance_window | The backup window |
| cluster_public_key | The public key for the cluster |
| cluster_revision_number | The specific revision number of the database in the cluster |
| cluster_security_groups | The security groups associated with the cluster |
| cluster_subnet_group_name | The name of a cluster subnet group to be associated with this cluster |
| cluster_type | The Redshift cluster type |
| cluster_version | The version of Redshift engine software |
| cluster_vpc_security_group_ids | The VPC security group ids associated with the cluster |
| endpoint_access_address | The DNS address of the endpoint |
| endpoint_access_id | The Redshift-managed VPC endpoint name |
| endpoint_access_port | The port number on which the cluster accepts incoming connections |
| endpoint_access_vpc_endpoint | The connection endpoint for connecting to an Amazon Redshift cluster through the proxy. See details below |
| parameter_group_arn | Amazon Resource Name (ARN) of the parameter group created |
| parameter_group_id | The name of the Redshift parameter group created |
| scheduled_action_iam_role_arn | Scheduled actions IAM role ARN |
| scheduled_action_iam_role_name | Scheduled actions IAM role name |
| scheduled_action_iam_role_unique_id | Stable and unique string identifying the scheduled action IAM role |
| scheduled_actions | A map of maps containing scheduled action details |
| snapshot_schedule_arn | Amazon Resource Name (ARN) of the Redshift Snapshot Schedule |
| subnet_group_arn | Amazon Resource Name (ARN) of the Redshift subnet group created |
| subnet_group_id | The ID of Redshift Subnet group created |
| usage_limits | Map of usage limits created and their associated attributes |
Module is maintained by Anton Babenko with help from these awesome contributors.
Apache 2 Licensed. See LICENSE for full details.