# redshift

Creates Redshift clusters with managed master passwords, subnet groups, parameter groups, enhanced VPC routing, and optional scheduled pause/resume/resize actions.

All clusters use `manage_master_password = true` to store credentials in Secrets Manager. Encryption is enabled by default with optional CMK. Enhanced VPC routing is enabled by default to ensure all traffic is routed through the VPC.

## Usage

```hcl
module "redshift" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/database/redshift/aws"
  version = "0.1.0"

  subnet_groups = {
    main = {
      name       = "prod-redshift"
      subnet_ids = module.vpc.isolated_subnet_id_list
    }
  }

  parameter_groups = {
    main = {
      name   = "prod-redshift-params"
      family = "redshift-1.0"
      parameters = {
        "enable_user_activity_logging"    = "true"
        "require_ssl"                     = "true"
        "auto_analyze"                    = "true"
        "search_path"                     = "$user, public"
      }
    }
  }

  clusters = {
    main = {
      cluster_identifier = "prod-analytics"
      database_name      = "analytics"
      master_username    = "admin"
      node_type          = "ra3.xlplus"
      cluster_type       = "multi-node"
      number_of_nodes    = 3
      kms_key_id         = module.kms.key_arn
      vpc_security_group_ids = [module.security_groups.ids["redshift"]]

      logging = {
        enable        = true
        bucket_name   = module.s3.bucket_ids["redshift-logs"]
        s3_key_prefix = "redshift/prod/"
      }
    }
  }

  scheduled_actions = {
    pause_nights = {
      name         = "prod-analytics-pause"
      cluster_key  = "main"
      schedule     = "cron(0 22 * * ? *)"
      action_type  = "pause"
      iam_role_arn = aws_iam_role.redshift_scheduler.arn
    }
    resume_mornings = {
      name         = "prod-analytics-resume"
      cluster_key  = "main"
      schedule     = "cron(0 7 * * ? *)"
      action_type  = "resume"
      iam_role_arn = aws_iam_role.redshift_scheduler.arn
    }
  }

  tags = {
    Environment = "prod"
    Team        = "data"
  }
}
```

<!-- BEGIN_TF_DOCS — DO NOT EDIT BELOW THIS LINE -->
## Requirements

| Name | Version |
| ---- | ------- |
| <a name="requirement_terraform"></a> [terraform](#requirement_terraform) | ~> 1.5 |
| <a name="requirement_aws"></a> [aws](#requirement_aws) | ~> 6.50 |

## Providers

| Name | Version |
| ---- | ------- |
| <a name="provider_aws"></a> [aws](#provider_aws) | 6.50.0 |

## Resources

| Name | Type |
| ---- | ---- |
| [aws_redshift_cluster.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/redshift_cluster) | resource |
| [aws_redshift_logging.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/redshift_logging) | resource |
| [aws_redshift_parameter_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/redshift_parameter_group) | resource |
| [aws_redshift_scheduled_action.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/redshift_scheduled_action) | resource |
| [aws_redshift_subnet_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/redshift_subnet_group) | resource |

## Inputs

| Name | Description | Type | Default | Required |
| ---- | ----------- | ---- | ------- | :------: |
| <a name="input_clusters"></a> [clusters](#input_clusters) | Map of Redshift cluster definitions | <pre>map(object({<br/>    cluster_identifier                   = string<br/>    database_name                        = string<br/>    master_username                      = string<br/>    node_type                            = optional(string, "ra3.xlplus")<br/>    cluster_type                         = optional(string, "multi-node")<br/>    number_of_nodes                      = optional(number, 2)<br/>    port                                 = optional(number, 5439)<br/>    allow_version_upgrade                = optional(bool, true)<br/>    publicly_accessible                  = optional(bool, false)<br/>    encrypted                            = optional(bool, true)<br/>    kms_key_id                           = optional(string, null)<br/>    enhanced_vpc_routing                 = optional(bool, true)<br/>    automated_snapshot_retention_period  = optional(number, 7)<br/>    preferred_maintenance_window         = optional(string, "sun:05:00-sun:05:30")<br/>    skip_final_snapshot                  = optional(bool, false)<br/>    final_snapshot_identifier            = optional(string, null)<br/>    snapshot_cluster_identifier          = optional(string, null)<br/>    snapshot_identifier                  = optional(string, null)<br/>    availability_zone                    = optional(string, null)<br/>    availability_zone_relocation_enabled = optional(bool, false)<br/>    iam_roles                            = optional(list(string), [])<br/>    logging = optional(object({<br/>      enable        = optional(bool, true)<br/>      bucket_name   = optional(string, null)<br/>      s3_key_prefix = optional(string, "redshift/")<br/>    }), null)<br/>    subnet_group_name      = optional(string, null)<br/>    parameter_group_name   = optional(string, null)<br/>    vpc_security_group_ids = optional(list(string), [])<br/>  }))</pre> | `{}` | no |
| <a name="input_parameter_groups"></a> [parameter_groups](#input_parameter_groups) | Map of Redshift parameter group definitions | <pre>map(object({<br/>    name        = string<br/>    family      = optional(string, "redshift-1.0")<br/>    description = optional(string, "")<br/>    parameters  = optional(map(string), {})<br/>  }))</pre> | `{}` | no |
| <a name="input_scheduled_actions"></a> [scheduled_actions](#input_scheduled_actions) | Map of Redshift scheduled action definitions (pause/resume) | <pre>map(object({<br/>    name         = string<br/>    cluster_key  = string<br/>    schedule     = string<br/>    action_type  = string<br/>    iam_role_arn = string<br/>    pause        = optional(bool, null)<br/>    resize = optional(object({<br/>      node_type       = string<br/>      number_of_nodes = number<br/>      cluster_type    = string<br/>    }), null)<br/>  }))</pre> | `{}` | no |
| <a name="input_subnet_groups"></a> [subnet_groups](#input_subnet_groups) | Map of Redshift subnet group definitions | <pre>map(object({<br/>    name        = string<br/>    description = optional(string, "")<br/>    subnet_ids  = list(string)<br/>  }))</pre> | `{}` | no |
| <a name="input_tags"></a> [tags](#input_tags) | Resource tags to apply to all resources | `map(string)` | `{}` | no |

## Outputs

| Name | Description |
| ---- | ----------- |
| <a name="output_cluster_arns"></a> [cluster_arns](#output_cluster_arns) | Map of cluster keys to Redshift cluster ARNs |
| <a name="output_cluster_dns_names"></a> [cluster_dns_names](#output_cluster_dns_names) | Map of cluster keys to Redshift cluster DNS names |
| <a name="output_cluster_endpoints"></a> [cluster_endpoints](#output_cluster_endpoints) | Map of cluster keys to Redshift cluster endpoints |
| <a name="output_cluster_ids"></a> [cluster_ids](#output_cluster_ids) | Map of cluster keys to Redshift cluster identifiers |
| <a name="output_cluster_ports"></a> [cluster_ports](#output_cluster_ports) | Map of cluster keys to Redshift cluster ports |
| <a name="output_master_password_secret_arns"></a> [master_password_secret_arns](#output_master_password_secret_arns) | Map of cluster keys to ARNs of the managed master password Secrets Manager secrets |
| <a name="output_parameter_group_ids"></a> [parameter_group_ids](#output_parameter_group_ids) | Map of parameter group keys to Redshift parameter group IDs |
| <a name="output_subnet_group_ids"></a> [subnet_group_ids](#output_subnet_group_ids) | Map of subnet group keys to Redshift subnet group IDs |
<!-- END_TF_DOCS — DO NOT EDIT ABOVE THIS LINE -->