Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(redshift): cluster uses key ARN instead of key ID #17108

Merged
merged 3 commits into from
Oct 25, 2021
Merged

fix(redshift): cluster uses key ARN instead of key ID #17108

merged 3 commits into from
Oct 25, 2021

Conversation

iRoachie
Copy link
Contributor

Field was incorrectly using key arn instead of id.

Fixes #17032


By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

Field was incorrectly using key arn instead of id.

Fixes #17032
@gitpod-io
Copy link

gitpod-io bot commented Oct 22, 2021

@github-actions github-actions bot added the @aws-cdk/aws-redshift Related to Amazon Redshift label Oct 22, 2021
Copy link
Contributor

@njlynch njlynch left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The change itself looks great (one minor nitpick).

I did want to clarify something you said in the linked issue before approving, however.

I wasn't able to confirm if this prevents successful deployment but it can impact the ability to migrate from vanilla CFN to CDK because the change from KeyId to KeyArn triggers an encryption change in the cluster.

The CloudFormation docs for this property states that an update requires no interruption. What exactly do you mean by "encryption change"? Is there downtime associated with this? I ask because by making this change, it's quite possible we are causing the same effect in reverse (moving from ARN to ID) for any existing customers.

packages/@aws-cdk/aws-redshift/lib/cluster.ts Outdated Show resolved Hide resolved
@iRoachie
Copy link
Contributor Author

Oh you're referring to @gkubes. Based on the docs it shouldn't require interruption.

In the event that it does change though, shouldn't this change still be made? We can try a test to see if it fails currently. Right now there's no integ tests that include kms.

@iRoachie
Copy link
Contributor Author

Just confirmed. The stack does deploy with ARN successfully. Do we still make this change?

import * as cdk from "@aws-cdk/core";
import * as redshift from "@aws-cdk/aws-redshift";
import * as ec2 from "@aws-cdk/aws-ec2";
import * as kms from "@aws-cdk/aws-kms";

export class RedshiftStack extends cdk.Stack {
  constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const key = new kms.Key(this, 'id');

    const vpc = new ec2.Vpc(this, "Vpc");
    const databaseName = "my_db";
    const cluster = new redshift.Cluster(this, "Cluster", {
      vpc: vpc,
      vpcSubnets: {
        subnetType: ec2.SubnetType.PUBLIC,
      },
      masterUser: {
        masterUsername: "admin",
      },
      defaultDatabaseName: databaseName,
      publiclyAccessible: true,
      removalPolicy: cdk.RemovalPolicy.DESTROY,
      encryptionKey: key
    });

    const databaseOptions = {
      cluster: cluster,
      databaseName: databaseName,
    };

    const user = new redshift.User(this, "User", databaseOptions);
    const table = new redshift.Table(this, "Table", {
      ...databaseOptions,
      tableColumns: [
        { name: "col1", dataType: "varchar(4)" },
        { name: "col2", dataType: "float" },
      ],
    });
    table.grant(user, redshift.TableAction.INSERT, redshift.TableAction.DELETE);

    // The code that defines your this goes here
  }
}

Screenshot 2021-10-25 at 11 42 43 AM

@njlynch
Copy link
Contributor

njlynch commented Oct 25, 2021

Based on the docs it shouldn't require interruption. In the event that it does change though, shouldn't this change still be made? We can try a test to see if it fails currently. Right now there's no integ tests that include kms.

Yeah, I likewise was able to deploy with the current setup (using the ARN). Given the docs state "no interruption", I'm going to trust the docs and say let's proceed.

@mergify
Copy link
Contributor

mergify bot commented Oct 25, 2021

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@njlynch njlynch changed the title fix(redshift): use keyid for encryption key fix(redshift): cluster uses key ARN instead of keyid Oct 25, 2021
@njlynch njlynch changed the title fix(redshift): cluster uses key ARN instead of keyid fix(redshift): cluster uses key ARN instead of key ID Oct 25, 2021
@mergify
Copy link
Contributor

mergify bot commented Oct 25, 2021

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildProject89A8053A-LhjRyN9kxr8o
  • Commit ID: 6640fa4
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@mergify mergify bot merged commit bdf30c6 into aws:master Oct 25, 2021
@mergify
Copy link
Contributor

mergify bot commented Oct 25, 2021

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@iRoachie iRoachie deleted the fix/redshift-key branch October 25, 2021 21:46
@WhereEam
Copy link

WhereEam commented Dec 10, 2021

@njlynch Hello Nick, we are has been having some troubles with this merge. As you have suspected:

it's quite possible we are causing the same effect in reverse (moving from ARN to ID) for any existing customers.

Our team has seen this issue when updating from monoCDK 1.126.0 to 1.130.0. Receiving the error "This encryption info combination is invalid." A ticket was opened against redshift team but the responses have been slow. Would just like to notify you guys so we start looking at mitigation plans as this is a breaking change. The issue can be mitigated by deleting the entire stack and redeploying but this is not a good solution for productions as accounts can not go through this type of large scale change.

TikiTDO pushed a commit to TikiTDO/aws-cdk that referenced this pull request Feb 21, 2022
Field was incorrectly using key arn instead of id.

Fixes aws#17032


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
@aws-cdk/aws-redshift Related to Amazon Redshift
Projects
None yet
Development

Successfully merging this pull request may close these issues.

(aws-redshift): KmsKeyId uses KeyArn instead of KeyId
4 participants