add read policies for departments to access redshift (#1556)

* add read policies for departments to access redshift * allow departments with notebook access to see redshift resources
LBHackney-IT · Jan 17, 2024 · 8fb7961 · 8fb7961
1 parent e37bfd0
commit 8fb7961
Show file tree

Hide file tree

Showing 2 changed files with 27 additions and 1 deletion.
diff --git a/terraform/modules/department/50-aws-iam-policies.tf b/terraform/modules/department/50-aws-iam-policies.tf
@@ -720,3 +720,27 @@ data "aws_iam_policy_document" "glue_access_to_watermarks_table" {
   }
 
 }
+
+//Redshfift
+
+data "aws_iam_policy_document" "redshift_department_read_access" {
+
+  statement {
+    effect = "Allow"
+    actions = [
+      "redshift:DescribeClusters",
+      "redshift:DescribeClusterSnapshots",
+      "redshift:DescribeEvents",
+    ]
+    resources = ["*"]
+  }
+
+  statement {
+    effect = "Allow"
+    actions = [
+      "sqlworkbench:GetUserInfo",
+      "sqlworkbench:GetAccountInfo"
+    ]
+    resources = ["*"]
+  }
+}
diff --git a/terraform/modules/department/50-aws-iam-roles.tf b/terraform/modules/department/50-aws-iam-roles.tf
@@ -4,11 +4,13 @@ data "aws_iam_policy_document" "sso_staging_user_policy" {
     data.aws_iam_policy_document.s3_department_access.json,
     data.aws_iam_policy_document.glue_access.json,
     data.aws_iam_policy_document.secrets_manager_read_only.json,
+    data.aws_iam_policy_document.redshift_department_read_access.json,
     data.aws_iam_policy_document.notebook_access[0].json
     ] : [
     data.aws_iam_policy_document.s3_department_access.json,
     data.aws_iam_policy_document.glue_access.json,
-    data.aws_iam_policy_document.secrets_manager_read_only.json
+    data.aws_iam_policy_document.secrets_manager_read_only.json,
+    data.aws_iam_policy_document.redshift_department_read_access.json
   ]
 }