feat(redshift): IAM roles can be attached to a cluster, post creation

packages/@aws-cdk/aws-redshift/README.md

@@ -386,3 +386,39 @@ new Cluster(stack, 'Redshift', {
 ```
 
 If enhanced VPC routing is not enabled, Amazon Redshift routes traffic through the internet, including traffic to other services within the AWS network.
+
+## IAM roles
+
+Attaching IAM roles to a Redshift Cluster grants permissions to the Redshift service to perform actions on your behalf.
+
+```ts
+declare const vpc: ec2.Vpc
+
+const role = new iam.Role(this, 'Role', {
+  assumedBy: new iam.ServicePrincipal('redshift.amazonaws.com'),
+});
+const cluster = new Cluster(this, 'Redshift', {
+  masterUser: {
+    masterUsername: 'admin',
+  },
+  vpc,
+  roles: [role],
+});
+```
+
+Additional IAM roles can be attached to a cluster using the `addIamRole` method.
+
+```ts
+declare const vpc: ec2.Vpc
+
+const role = new iam.Role(this, 'Role', {
+  assumedBy: new iam.ServicePrincipal('redshift.amazonaws.com'),
+});
+const cluster = new Cluster(this, 'Redshift', {
+  masterUser: {
+    masterUsername: 'admin',
+  },
+  vpc,
+});
+cluster.addIamRole(role);
+```

packages/@aws-cdk/aws-redshift/lib/cluster.ts

@@ -4,6 +4,7 @@ import * as kms from '@aws-cdk/aws-kms';
 import * as s3 from '@aws-cdk/aws-s3';
 import * as secretsmanager from '@aws-cdk/aws-secretsmanager';
 import { Duration, IResource, RemovalPolicy, Resource, SecretValue, Token } from '@aws-cdk/core';
+import { AwsCustomResource, AwsCustomResourcePolicy, PhysicalResourceId } from '@aws-cdk/custom-resources';
 import { Construct } from 'constructs';
 import { DatabaseSecret } from './database-secret';
 import { Endpoint } from './endpoint';
@@ -662,4 +663,52 @@ export class Cluster extends ClusterBase {
       throw new Error('Cannot add a parameter to an imported parameter group.');
     }
   }
+
+  /**
+   * Adds a role to the cluster
+   *
+   * @param role the role to add
+   */
+  public addIamRole(role: iam.IRole): void {
+    const clusterRoleList = this.cluster.iamRoles ?? [];
+
+    if (clusterRoleList.includes(role.roleArn)) {
+      throw new Error('Role is already attached to the cluster');
+    }
+    if (clusterRoleList.length >= 10) {
+      throw new Error('Maximum number of IAM roles for a cluster is 10');
+    }
+
+    // On UPDATE or CREATE define the new list of roles. On DELETE, detech the role from the cluster
+    const roleCustomResource = new AwsCustomResource(this, `add-role-${role.node.id}`, {
+      onUpdate: {
+        service: 'Redshift',
+        action: 'modifyClusterIamRoles',
+        parameters: {
+          ClusterIdentifier: this.cluster.ref,
+          AddIamRoles: [role.roleArn],
+        },
+        physicalResourceId: PhysicalResourceId.of(
+          `${role.roleArn}-${this.cluster.ref}`,
+        ),
+      },
+      onDelete: {
+        service: 'Redshift',
+        action: 'modifyClusterIamRoles',
+        parameters: {
+          ClusterIdentifier: this.cluster.ref,
+          RemoveIamRoles: [role.roleArn],
+        },
+        physicalResourceId: PhysicalResourceId.of(
+          `${role.roleArn}-${this.cluster.ref}`,
+        ),
+      },
+      policy: AwsCustomResourcePolicy.fromSdkCalls({
+        resources: AwsCustomResourcePolicy.ANY_RESOURCE,
+      }),
+      resourceType: 'Custom::ModifyClusterIamRoles',
+    });
+
+    role.grantPassRole(roleCustomResource.grantPrincipal);
+  }
 }

packages/@aws-cdk/aws-redshift/test/cluster.test.ts

@@ -1,5 +1,6 @@
 import { Match, Template } from '@aws-cdk/assertions';
 import * as ec2 from '@aws-cdk/aws-ec2';
+import * as iam from '@aws-cdk/aws-iam';
 import * as kms from '@aws-cdk/aws-kms';
 import * as s3 from '@aws-cdk/aws-s3';
 import * as cdk from '@aws-cdk/core';
@@ -613,6 +614,67 @@ test('elastic ip address', () => {
   });
 });
 
+describe('IAM role', () => {
+  test('adding a role after cluster declaration creates a custom resource', () => {
+    // GIVEN
+    const cluster = new Cluster(stack, 'Redshift', {
+      masterUser: {
+        masterUsername: 'admin',
+      },
+      vpc,
+    });
+
+    // WHEN
+    cluster.addIamRole(new iam.Role(stack, 'Role', {
+      assumedBy: new iam.ServicePrincipal('redshift.amazonaws.com'),
+    }));
+
+    // THEN
+    Template.fromStack(stack).hasResource('Custom::ModifyClusterIamRoles', {});
+  });
+
+  test('throws when adding more than 10 roles to cluster', () => {
+    // GIVEN
+    const cluster = new Cluster(stack, 'Redshift', {
+      masterUser: {
+        masterUsername: 'admin',
+      },
+      vpc,
+      roles: new Array(10).fill(0).map((_, i) => new iam.Role(stack, `Role${i+1}`, {
+        assumedBy: new iam.ServicePrincipal('redshift.amazonaws.com'),
+      })),
+    });
+
+    expect(() =>
+      // WHEN
+      cluster.addIamRole(new iam.Role(stack, 'Role11', {
+        assumedBy: new iam.ServicePrincipal('redshift.amazonaws.com'),
+      })),
+    // THEN
+    ).toThrow(/Maximum number of IAM roles for a cluster is 10/);
+  });
+
+  test('throws when adding role that is already in cluster', () => {
+    // GIVEN
+    const role = new iam.Role(stack, 'Role', {
+      assumedBy: new iam.ServicePrincipal('redshift.amazonaws.com'),
+    });
+    const cluster = new Cluster(stack, 'Redshift', {
+      masterUser: {
+        masterUsername: 'admin',
+      },
+      vpc,
+      roles: [role],
+    });
+
+    expect(() =>
+      // WHEN
+      cluster.addIamRole(role),
+    // THEN
+    ).toThrow(/Role is already attached to the cluster/);
+  });
+});
+
 function testStack() {
   const newTestStack = new cdk.Stack(undefined, undefined, { env: { account: '12345', region: 'us-test-1' } });
   newTestStack.node.setContext('availability-zones:12345:us-test-1', ['us-test-1a', 'us-test-1b']);

packages/@aws-cdk/aws-redshift/test/integ.cluster-iamrole.js.snapshot/IamRoleIntegDefaultTestDeployAssertBEF20992.assets.json

@@ -0,0 +1,19 @@
+{
+  "version": "29.0.0",
+  "files": {
+    "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": {
+      "source": {
+        "path": "IamRoleIntegDefaultTestDeployAssertBEF20992.template.json",
+        "packaging": "file"
+      },
+      "destinations": {
+        "current_account-current_region": {
+          "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
+          "objectKey": "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
+          "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
+        }
+      }
+    }
+  },
+  "dockerImages": {}
+}

packages/@aws-cdk/aws-redshift/test/integ.cluster-iamrole.js.snapshot/IamRoleIntegDefaultTestDeployAssertBEF20992.template.json

@@ -0,0 +1,36 @@
+{
+ "Parameters": {
+  "BootstrapVersion": {
+   "Type": "AWS::SSM::Parameter::Value<String>",
+   "Default": "/cdk-bootstrap/hnb659fds/version",
+   "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
+  }
+ },
+ "Rules": {
+  "CheckBootstrapVersion": {
+   "Assertions": [
+    {
+     "Assert": {
+      "Fn::Not": [
+       {
+        "Fn::Contains": [
+         [
+          "1",
+          "2",
+          "3",
+          "4",
+          "5"
+         ],
+         {
+          "Ref": "BootstrapVersion"
+         }
+        ]
+       }
+      ]
+     },
+     "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
+    }
+   ]
+  }
+ }
+}