(aws_redshiftserverless): CfnNamespace missing adminPasswordSecretArn property

[dossy]

Describe the feature

CfnNamespace is missing attrNamespaceAdminPasswordSecretArn which is listed in NamespaceProperty.

Use Case

I need the Secret ARN that Redshift Serverless has created when manageAdminPassword = true, so that I can use the ARN in subsequent code.

Proposed Solution

No response

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.138.0

Environment details (OS name and version, etc.)

macOS 13.6.4

[pahud]

Looking at the return values of that resource in the CFN document, it does not have that attribute returned so I believe it's a limit of CFN.

Please cut a ticket to cloudformation-coverage-roadmap to help the cfn team prioritize. Meanwhile, I'll cut an internal ticket for that as well.

[pahud]

internal tracking: V1360162562

[pahud]

Confirmed it's a limit of CFN. At this moment CDK would need custom resource for that.

[Rizxcviii]

You can use this for now if needed

// Custom resource role, for least privilege
const getNamespaceCRRole = new iam.Role(this, 'GetNamespaceRole', {
  assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
  inlinePolicies: {
    NamespaceCRPolicy: new iam.PolicyDocument({
      statements: [
        new iam.PolicyStatement({
          actions: ['redshift-serverless:GetNamespace'],
          resources: ['exmpleNamespaceArn'],
        }),
        new iam.PolicyStatement({
          actions: ['logs:CreateLogStream', 'logs:PutLogEvents'],
          resources: ['logGroupArn'],
        }),
      ],
    }),
  },
});

// custom resource def
const getNamespaceCR = new cr.AwsCustomResource(this, 'GetNamespaceCR', {
  onUpdate: {
    service: 'RedshiftServerless',
    action: 'GetNamespace',
    parameters: {
      namespaceName: props.namespaceName,
    },
    physicalResourceId: cr.PhysicalResourceId.of('exampleNamespaceName'),
  },
  role: getNamespaceCRRole.withoutPolicyUpdates(),
  functionName: props.getNamespaceFunctionName,
  logGroup: logGroupConstruct,
});

// importing the secret into the CDK, using the full secret ARN
this.redshiftAdminSecret = secretsmanager.Secret.fromSecretCompleteArn(
  this,
  'RedshiftAdminSecret',
  getNamespaceCR.getResponseField('namespace.adminPasswordSecretArn')
);