RedshiftClusterStack.yaml

Parameters:
  ClusterVPC:
    Description: Select a VPC for the cluster
    Type: AWS::EC2::VPC::Id
  ClusterSubnet:
    Description: Enter a subnet for the cluster (make sure to select public subnet)
    Type: AWS::EC2::Subnet::Id
  ClusterIdentifier:
    Description: Enter cluster identifier
    Type: String
  NodeType:
    Description: Select the type of node to be provisioned
    Type: String
    Default: ds2.xlarge
    AllowedValues:
      - ds2.xlarge
      - ds2.8xlarge
      - dc2.large
      - dc2.8xlarge
  DatabaseName:
    Description: The name of the database to be created
    Type: String
    Default: dw_dev
  MasterUsername:
    Description: The cluster master user name
    Type: String
    AllowedPattern: "([a-z])([a-z]|[0-9])*"
  MasterUserPassword:
    Description:  The cluster master user name password
    Type: String
    NoEcho: true
  InboundTraffic:
    Description: Allow inbound traffic to the cluster from this CIDR range
    Type: String
    MinLength: '9'
    MaxLength: '18'
    AllowedPattern: "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
    ConstraintDescription: Must be a valid CIDR range of the form x.x.x.x/x.
  KinesisFirehoseIPAddress:
    Description: "Allow access to the Redshift cluster by unblocking the Kinesis Data Firehose IP address (see this link for more info - https://docs.aws.amazon.com/firehose/latest/dev/controlling-access.html#using-iam-rs-vpc)"
    Type: String
    MinLength: '9'
    MaxLength: '18'
    AllowedPattern: "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
    ConstraintDescription: Must be a valid CIDR range of the form x.x.x.x/x.
Resources:
  RedshiftCluster:
    Type: AWS::Redshift::Cluster
    Properties:
      ClusterIdentifier: !Ref ClusterIdentifier
      ClusterType: single-node
      NodeType: !Ref NodeType
      DBName: !Ref DatabaseName
      MasterUsername: !Ref MasterUsername
      MasterUserPassword: !Ref MasterUserPassword
      VpcSecurityGroupIds: 
        - Ref: ClusterSecurityGroup
      ClusterSubnetGroupName: !Ref RedshiftClusterSubnetGroup
      PubliclyAccessible: true
      IamRoles:
       - !GetAtt RedshiftS3DataDeliveryRole.Arn
  ClusterSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for xConnect Redshift cluster
      VpcId: !Ref ClusterVPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 5439
          ToPort: 5439
          CidrIp: !Ref InboundTraffic
          Description: CIDR block to allow access SQL tools access to Redshift cluster 
        - IpProtocol: tcp
          FromPort: 5439
          ToPort: 5439
          CidrIp: !Ref KinesisFirehoseIPAddress
          Description: Kinesis Firehose specific region CIDR block
  RedshiftClusterSubnetGroup:
    Type: AWS::Redshift::ClusterSubnetGroup
    Properties:
      Description: xConnect Redshift cluster subnet group
      SubnetIds:
        - Ref: ClusterSubnet
  RedshiftS3DataDeliveryRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: ''
            Effect: Allow
            Principal:
              Service: redshift.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
Outputs:
  ClusterEndpoint:
    Description: Cluster endpoint
    Value: !Sub "${RedshiftCluster.Endpoint.Address}:${RedshiftCluster.Endpoint.Port}"