feat(redshift): optionally reboot Clusters to apply parameter changes

packages/@aws-cdk/aws-redshift/README.md

@@ -349,6 +349,25 @@ const cluster = new Cluster(this, 'Cluster', {
 cluster.addToParameterGroup('enable_user_activity_logging', 'true');
 ```
 
+## Rebooting for Parameter Updates
+
+In most cases, existing clusters [must be manually rebooted](https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-parameter-groups.html) to apply parameter changes. You can automate parameter related reboots by setting the cluster's `rebootForParameterChanges` property to `true` , or by using `Cluster.enableRebootForParameterChanges()`.
+
+```ts
+declare const vpc: ec2.Vpc;
+
+const cluster = new Cluster(this, 'Cluster', {
+  masterUser: {
+    masterUsername: 'admin',
+    masterPassword: cdk.SecretValue.unsafePlainText('tooshort'),
+  },
+  vpc,
+});
+
+cluster.addToParameterGroup('enable_user_activity_logging', 'true');
+cluster.enableRebootForParameterChanges()
+```
+
 ## Elastic IP
 
 If you configure your cluster to be publicly accessible, you can optionally select an *elastic IP address* to use for the external IP address. An elastic IP address is a static IP address that is associated with your AWS account. You can use an elastic IP address to connect to your cluster from outside the VPC. An elastic IP address gives you the ability to change your underlying configuration without affecting the IP address that clients use to connect to your cluster. This approach can be helpful for situations such as recovery after a failure.

packages/@aws-cdk/aws-redshift/lib/cluster-parameter-change-reboot-handler/index.ts

@@ -0,0 +1,53 @@
+// eslint-disable-next-line import/no-extraneous-dependencies
+import { Redshift } from 'aws-sdk';
+
+const redshift = new Redshift();
+
+export async function handler(event: AWSLambda.CloudFormationCustomResourceEvent): Promise<void> {
+  if (event.RequestType !== 'Delete') {
+    return rebootClusterIfRequired(event.ResourceProperties?.ClusterId, event.ResourceProperties?.ParameterGroupName);
+  } else {
+    return;
+  }
+}
+
+async function rebootClusterIfRequired(clusterId: string, parameterGroupName: string): Promise<void> {
+  return executeActionForStatus(await getApplyStatus());
+
+  // https://docs.aws.amazon.com/redshift/latest/APIReference/API_ClusterParameterStatus.html
+  async function executeActionForStatus(status: string, retryDurationMs?: number): Promise<void> {
+    await sleep(retryDurationMs ?? 0);
+    if (['pending-reboot', 'apply-deferred', 'apply-error'].includes(status)) {
+      try {
+        await redshift.rebootCluster({ ClusterIdentifier: clusterId }).promise();
+      } catch (err) {
+        if ((err as any).code === 'InvalidClusterState') {
+          return await executeActionForStatus(status, 30000);
+        } else {
+          throw err;
+        }
+      }
+      return;
+    } else if (['applying', 'retry'].includes(status)) {
+      return executeActionForStatus(await getApplyStatus(), 30000);
+    }
+    return;
+  }
+
+  async function getApplyStatus(): Promise<string> {
+    const clusterDetails = await redshift.describeClusters({ ClusterIdentifier: clusterId }).promise();
+    if (clusterDetails.Clusters?.[0].ClusterParameterGroups === undefined) {
+      throw new Error(`Unable to find any Parameter Groups associated with ClusterId "${clusterId}".`);
+    }
+    for (const group of clusterDetails.Clusters?.[0].ClusterParameterGroups) {
+      if (group.ParameterGroupName === parameterGroupName) {
+        return group.ParameterApplyStatus ?? 'retry';
+      }
+    }
+    throw new Error(`Unable to find Parameter Group named "${parameterGroupName}" associated with ClusterId "${clusterId}".`);
+  }
+}
+
+function sleep(ms: number) {
+  return new Promise(resolve => setTimeout(resolve, ms));
+}

packages/@aws-cdk/aws-redshift/lib/cluster.ts

@@ -1,17 +1,18 @@
+import * as path from 'path';
 import * as ec2 from '@aws-cdk/aws-ec2';
 import * as iam from '@aws-cdk/aws-iam';
 import * as kms from '@aws-cdk/aws-kms';
+import * as lambda from '@aws-cdk/aws-lambda';
 import * as s3 from '@aws-cdk/aws-s3';
 import * as secretsmanager from '@aws-cdk/aws-secretsmanager';
-import { Duration, IResource, Lazy, RemovalPolicy, Resource, SecretValue, Token } from '@aws-cdk/core';
-import { AwsCustomResource, AwsCustomResourcePolicy, PhysicalResourceId } from '@aws-cdk/custom-resources';
+import { ArnFormat, CustomResource, Duration, IResource, Lazy, RemovalPolicy, Resource, SecretValue, Stack, Token } from '@aws-cdk/core';
+import { AwsCustomResource, AwsCustomResourcePolicy, PhysicalResourceId, Provider } from '@aws-cdk/custom-resources';
 import { Construct } from 'constructs';
 import { DatabaseSecret } from './database-secret';
 import { Endpoint } from './endpoint';
 import { ClusterParameterGroup, IClusterParameterGroup } from './parameter-group';
 import { CfnCluster } from './redshift.generated';
 import { ClusterSubnetGroup, IClusterSubnetGroup } from './subnet-group';
-
 /**
  * Possible Node Types to use in the cluster
  * used for defining `ClusterProps.nodeType`.
@@ -364,6 +365,12 @@ export interface ClusterProps {
    */
   readonly elasticIp?: string
 
+  /**
+   * If this flag is set, the cluster will be rebooted when changes to the cluster's parameter group that require a restart to apply.
+   * @default false
+   */
+  readonly rebootForParameterChanges?: boolean
+
   /**
    * If this flag is set, Amazon Redshift forces all COPY and UNLOAD traffic between your cluster and your data repositories through your virtual private cloud (VPC).
    *
@@ -470,6 +477,11 @@ export class Cluster extends ClusterBase {
    */
   protected parameterGroup?: IClusterParameterGroup;
 
+  /**
+   * Whether the cluster will be rebooted when changes to the cluster's parameter group that require a restart to apply.
+   */
+  protected rebootForParameterChangesEnabled?: boolean;
+
   /**
    * The ARNs of the roles that will be attached to the cluster.
    *
@@ -592,7 +604,9 @@ export class Cluster extends ClusterBase {
 
     const defaultPort = ec2.Port.tcp(this.clusterEndpoint.port);
     this.connections = new ec2.Connections({ securityGroups, defaultPort });
-
+    if (props.rebootForParameterChanges) {
+      this.enableRebootForParameterChanges();
+    }
     // Add default role if specified and also available in the roles list
     if (props.defaultRole) {
       if (props.roles?.some(x => x === props.defaultRole)) {
@@ -689,6 +703,71 @@ export class Cluster extends ClusterBase {
     }
   }
 
+  /**
+   * Enables automatic cluster rebooting when changes to the cluster's parameter group require a restart to apply.
+   */
+  public enableRebootForParameterChanges(): void {
+    if (!this.rebootForParameterChangesEnabled) {
+      this.rebootForParameterChangesEnabled = true;
+      const rebootFunction = new lambda.SingletonFunction(this, 'RedshiftClusterRebooterFunction', {
+        uuid: '511e207f-13df-4b8b-b632-c32b30b65ac2',
+        runtime: lambda.Runtime.NODEJS_16_X,
+        code: lambda.Code.fromAsset(path.join(__dirname, 'cluster-parameter-change-reboot-handler')),
+        handler: 'index.handler',
+        timeout: Duration.seconds(900),
+      });
+      rebootFunction.addToRolePolicy(new iam.PolicyStatement({
+        actions: ['redshift:DescribeClusters'],
+        resources: ['*'],
+      }));
+      rebootFunction.addToRolePolicy(new iam.PolicyStatement({
+        actions: ['redshift:RebootCluster'],
+        resources: [
+          Stack.of(this).formatArn({
+            service: 'redshift',
+            resource: 'cluster',
+            resourceName: this.clusterName,
+            arnFormat: ArnFormat.COLON_RESOURCE_NAME,
+          }),
+        ],
+      }));
+      const provider = new Provider(this, 'ResourceProvider', {
+        onEventHandler: rebootFunction,
+      });
+      const customResource = new CustomResource(this, 'RedshiftClusterRebooterCustomResource', {
+        resourceType: 'Custom::RedshiftClusterRebooter',
+        serviceToken: provider.serviceToken,
+        properties: {
+          ClusterId: this.clusterName,
+          ParameterGroupName: Lazy.string({
+            produce: () => {
+              if (!this.parameterGroup) {
+                throw new Error('Cannot enable reboot for parameter changes when there is no associated ClusterParameterGroup.');
+              }
+              return this.parameterGroup.clusterParameterGroupName;
+            },
+          }),
+          ParametersString: Lazy.string({
+            produce: () => {
+              if (!(this.parameterGroup instanceof ClusterParameterGroup)) {
+                throw new Error('Cannot enable reboot for parameter changes when using an imported parameter group.');
+              }
+              return JSON.stringify(this.parameterGroup.parameters);
+            },
+          }),
+        },
+      });
+      Lazy.any({
+        produce: () => {
+          if (!this.parameterGroup) {
+            throw new Error('Cannot enable reboot for parameter changes when there is no associated ClusterParameterGroup.');
+          }
+          customResource.node.addDependency(this, this.parameterGroup);
+        },
+      });
+    }
+  }
+
   /**
    * Adds default IAM role to cluster. The default IAM role must be already associated to the cluster to be added as the default role.
    *

packages/@aws-cdk/aws-redshift/test/cluster-reboot.integ.snapshot/asset.1b88b7c3e3e0f8d3e27ded1bde51b7a80c75f3d8733872af7952c3a6d902147e/index.d.ts

@@ -0,0 +1 @@
+export declare function handler(event: AWSLambda.CloudFormationCustomResourceEvent): Promise<void>;

packages/@aws-cdk/aws-redshift/test/cluster-reboot.integ.snapshot/asset.1b88b7c3e3e0f8d3e27ded1bde51b7a80c75f3d8733872af7952c3a6d902147e/index.ts

@@ -0,0 +1,53 @@
+// eslint-disable-next-line import/no-extraneous-dependencies
+import { Redshift } from 'aws-sdk';
+
+const redshift = new Redshift();
+
+export async function handler(event: AWSLambda.CloudFormationCustomResourceEvent): Promise<void> {
+  if (event.RequestType !== 'Delete') {
+    return rebootClusterIfRequired(event.ResourceProperties?.ClusterId, event.ResourceProperties?.ParameterGroupName);
+  } else {
+    return;
+  }
+}
+
+async function rebootClusterIfRequired(clusterId: string, parameterGroupName: string): Promise<void> {
+  return executeActionForStatus(await getApplyStatus());
+
+  // https://docs.aws.amazon.com/redshift/latest/APIReference/API_ClusterParameterStatus.html
+  async function executeActionForStatus(status: string, retryDurationMs?: number): Promise<void> {
+    await sleep(retryDurationMs ?? 0);
+    if (['pending-reboot', 'apply-deferred', 'apply-error', 'unknown-error'].includes(status)) {
+      try {
+        await redshift.rebootCluster({ ClusterIdentifier: clusterId }).promise();
+      } catch (err) {
+        if ((<any>err).code === 'InvalidClusterState') {
+          return await executeActionForStatus(status, 30000);
+        } else {
+          throw err;
+        }
+      }
+      return;
+    } else if (['applying', 'retry'].includes(status)) {
+      return executeActionForStatus(await getApplyStatus(), 30000);
+    }
+    return;
+  }
+
+  async function getApplyStatus(): Promise<string> {
+    const clusterDetails = await redshift.describeClusters({ ClusterIdentifier: clusterId }).promise();
+    if (clusterDetails.Clusters?.[0].ClusterParameterGroups === undefined) {
+      throw new Error(`Unable to find any Parameter Groups associated with ClusterId "${clusterId}".`);
+    }
+    for (const group of clusterDetails.Clusters?.[0].ClusterParameterGroups) {
+      if (group.ParameterGroupName === parameterGroupName) {
+        return group.ParameterApplyStatus ?? 'retry';
+      }
+    }
+    throw new Error(`Unable to find Parameter Group named "${parameterGroupName}" associated with ClusterId "${clusterId}".`);
+  }
+}
+
+function sleep(ms: number) {
+  return new Promise(resolve => setTimeout(resolve, ms));
+}