endpoint_authorizations

Creates, updates, deletes or gets an endpoint_authorization resource or lists endpoint_authorizations in a region

Overview

Name	endpoint_authorizations
Type	Resource
Description	Describes an endpoint authorization for authorizing Redshift-managed VPC endpoint access to a cluster across AWS accounts.
Id	awscc.redshift.endpoint_authorizations

Fields

Name	Datatype	Description
status	string	The status of the authorization action.
grantee	string	The AWS account ID of the grantee of the cluster.
endpoint_count	integer	The number of Redshift-managed VPC endpoints created for the authorization.
authorize_time	string	The time (UTC) when the authorization was created.
allowed_vpcs	array	The VPCs allowed access to the cluster.
force	boolean	Indicates whether to force the revoke action. If true, the Redshift-managed VPC endpoints associated with the endpoint authorization are also deleted.
allowed_all_vpcs	boolean	Indicates whether all VPCs in the grantee account are allowed access to the cluster.
vpc_ids	array	The virtual private cloud (VPC) identifiers to grant or revoke access to.
cluster_identifier	string	The cluster identifier.
cluster_status	string	The status of the cluster.
region	string	AWS region.

For more information, see AWS::Redshift::EndpointAuthorization.

Methods

Name	Accessible by	Required Params
create_resource	INSERT	ClusterIdentifier, Account, region
delete_resource	DELETE	data__Identifier, region
update_resource	UPDATE	data__Identifier, data__PatchDocument, region
list_resources	SELECT	region
get_resource	SELECT	data__Identifier, region

SELECT examples

Gets all properties from an individual endpoint_authorization.

SELECT
region,
status,
grantee,
account,
grantor,
endpoint_count,
authorize_time,
allowed_vpcs,
force,
allowed_all_vpcs,
vpc_ids,
cluster_identifier,
cluster_status
FROM awscc.redshift.endpoint_authorizations
WHERE region = 'us-east-1' AND data__Identifier = '<ClusterIdentifier>|<Account>';

INSERT example

Use the following StackQL query and manifest file to create a new endpoint_authorization resource, using stack-deploy.

Required Properties

/*+ create */
INSERT INTO awscc.redshift.endpoint_authorizations (
 Account,
 ClusterIdentifier,
 region
)
SELECT 
'{{ Account }}',
 '{{ ClusterIdentifier }}',
'{{ region }}';

All Properties

/*+ create */
INSERT INTO awscc.redshift.endpoint_authorizations (
 Account,
 Force,
 VpcIds,
 ClusterIdentifier,
 region
)
SELECT 
 '{{ Account }}',
 '{{ Force }}',
 '{{ VpcIds }}',
 '{{ ClusterIdentifier }}',
 '{{ region }}';

Manifest

version: 1
name: stack name
description: stack description
providers:
  - aws
globals:
  - name: region
    value: '{{ vars.AWS_REGION }}'
resources:
  - name: endpoint_authorization
    props:
      - name: Account
        value: '{{ Account }}'
      - name: Force
        value: '{{ Force }}'
      - name: VpcIds
        value:
          - '{{ VpcIds[0] }}'
      - name: ClusterIdentifier
        value: '{{ ClusterIdentifier }}'

DELETE example

/*+ delete */
DELETE FROM awscc.redshift.endpoint_authorizations
WHERE data__Identifier = '<ClusterIdentifier|Account>'
AND region = 'us-east-1';

Permissions

To operate on the endpoint_authorizations resource, the following permissions are required:

Read

redshift:DescribeEndpointAuthorization

Create

redshift:AuthorizeEndpointAccess,
redshift:DescribeEndpointAuthorization

Update

redshift:AuthorizeEndpointAccess,
redshift:DescribeEndpointAuthorization,
redshift:RevokeEndpointAccess

List

redshift:DescribeEndpointAuthorization

Delete

redshift:RevokeEndpointAccess,
redshift:DeleteEndpointAccess,
redshift:DescribeEndpointAuthorization,
ec2:DeleteClientVpnEndpoint,
ec2:DescribeVpcAttribute,
ec2:DescribeSecurityGroups,
ec2:DescribeAddresses,
ec2:DescribeInternetGateways,
ec2:DescribeSubnets