@aws-cdk/aws-redshift-alpha 2.36.0-alpha.0 → 2.38.0-alpha.0

package/.jsii

@@ -8,7 +8,7 @@
     "url": "https://aws.amazon.com"
   },
   "dependencies": {
-    "aws-cdk-lib": "^2.36.0",
+    "aws-cdk-lib": "^2.38.0",
     "constructs": "^10.0.0"
   },
   "dependencyClosure": {
@@ -3045,7 +3045,7 @@
   },
   "name": "@aws-cdk/aws-redshift-alpha",
   "readme": {
-    "markdown": "# Amazon Redshift Construct Library\n<!--BEGIN STABILITY BANNER-->\n\n---\n\n![cdk-constructs: Experimental](https://img.shields.io/badge/cdk--constructs-experimental-important.svg?style=for-the-badge)\n\n> The APIs of higher level constructs in this module are experimental and under active development.\n> They are subject to non-backward compatible changes or removal in any future version. These are\n> not subject to the [Semantic Versioning](https://semver.org/) model and breaking changes will be\n> announced in the release notes. This means that while you may use them, you may need to update\n> your source code when upgrading to a newer version of this package.\n\n---\n\n<!--END STABILITY BANNER-->\n\n## Starting a Redshift Cluster Database\n\nTo set up a Redshift cluster, define a `Cluster`. It will be launched in a VPC.\nYou can specify a VPC, otherwise one will be created. The nodes are always launched in private subnets and are encrypted by default.\n\n```ts\nimport * as ec2 from 'aws-cdk-lib/aws-ec2';\n\nconst vpc = new ec2.Vpc(this, 'Vpc');\nconst cluster = new Cluster(this, 'Redshift', {\n  masterUser: {\n    masterUsername: 'admin',\n  },\n  vpc\n});\n```\n\nBy default, the master password will be generated and stored in AWS Secrets Manager.\n\nA default database named `default_db` will be created in the cluster. To change the name of this database set the `defaultDatabaseName` attribute in the constructor properties.\n\nBy default, the cluster will not be publicly accessible.\nDepending on your use case, you can make the cluster publicly accessible with the `publiclyAccessible` property.\n\n## Connecting\n\nTo control who can access the cluster, use the `.connections` attribute. Redshift Clusters have\na default port, so you don't need to specify the port:\n\n```ts fixture=cluster\ncluster.connections.allowDefaultPortFromAnyIpv4('Open to the world');\n```\n\nThe endpoint to access your database cluster will be available as the `.clusterEndpoint` attribute:\n\n```ts fixture=cluster\ncluster.clusterEndpoint.socketAddress;   // \"HOSTNAME:PORT\"\n```\n\n## Database Resources\n\nThis module allows for the creation of non-CloudFormation database resources such as users\nand tables. This allows you to manage identities, permissions, and stateful resources\nwithin your Redshift cluster from your CDK application.\n\nBecause these resources are not available in CloudFormation, this library leverages\n[custom\nresources](https://docs.aws.amazon.com/cdk/api/latest/docs/custom-resources-readme.html)\nto manage them. In addition to the IAM permissions required to make Redshift service\ncalls, the execution role for the custom resource handler requires database credentials to\ncreate resources within the cluster.\n\nThese database credentials can be supplied explicitly through the `adminUser` properties\nof the various database resource constructs. Alternatively, the credentials can be\nautomatically pulled from the Redshift cluster's default administrator\ncredentials. However, this option is only available if the password for the credentials\nwas generated by the CDK application (ie., no value vas provided for [the `masterPassword`\nproperty](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-redshift.Login.html#masterpasswordspan-classapi-icon-api-icon-experimental-titlethis-api-element-is-experimental-it-may-change-without-noticespan)\nof\n[`Cluster.masterUser`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-redshift.Cluster.html#masteruserspan-classapi-icon-api-icon-experimental-titlethis-api-element-is-experimental-it-may-change-without-noticespan)).\n\n### Creating Users\n\nCreate a user within a Redshift cluster database by instantiating a `User` construct. This\nwill generate a username and password, store the credentials in a [AWS Secrets Manager\n`Secret`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-secretsmanager.Secret.html),\nand make a query to the Redshift cluster to create a new database user with the\ncredentials.\n\n```ts fixture=cluster\nnew User(this, 'User', {\n  cluster: cluster,\n  databaseName: 'databaseName',\n});\n```\n\nBy default, the user credentials are encrypted with your AWS account's default Secrets\nManager encryption key. You can specify the encryption key used for this purpose by\nsupplying a key in the `encryptionKey` property.\n\n```ts fixture=cluster\nimport * as kms from 'aws-cdk-lib/aws-kms';\n\nconst encryptionKey = new kms.Key(this, 'Key');\nnew User(this, 'User', {\n  encryptionKey: encryptionKey,\n  cluster: cluster,\n  databaseName: 'databaseName',\n});\n```\n\nBy default, a username is automatically generated from the user construct ID and its path\nin the construct tree. You can specify a particular username by providing a value for the\n`username` property. Usernames must be valid identifiers; see: [Names and\nidentifiers](https://docs.aws.amazon.com/redshift/latest/dg/r_names.html) in the *Amazon\nRedshift Database Developer Guide*.\n\n```ts fixture=cluster\nnew User(this, 'User', {\n  username: 'myuser',\n  cluster: cluster,\n  databaseName: 'databaseName',\n});\n```\n\nThe user password is generated by AWS Secrets Manager using the default configuration\nfound in\n[`secretsmanager.SecretStringGenerator`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-secretsmanager.SecretStringGenerator.html),\nexcept with password length `30` and some SQL-incompliant characters excluded. The\nplaintext for the password will never be present in the CDK application; instead, a\n[CloudFormation Dynamic\nReference](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/dynamic-references.html)\nwill be used wherever the password value is required.\n\n### Creating Tables\n\nCreate a table within a Redshift cluster database by instantiating a `Table`\nconstruct. This will make a query to the Redshift cluster to create a new database table\nwith the supplied schema.\n\n```ts fixture=cluster\nnew Table(this, 'Table', {\n  tableColumns: [{ name: 'col1', dataType: 'varchar(4)' }, { name: 'col2', dataType: 'float' }],\n  cluster: cluster,\n  databaseName: 'databaseName',\n});\n```\n\nThe table can be configured to have distStyle attribute and a distKey column:\n\n```ts fixture=cluster\nnew Table(this, 'Table', {\n  tableColumns: [\n    { name: 'col1', dataType: 'varchar(4)', distKey: true },\n    { name: 'col2', dataType: 'float' },\n  ],\n  cluster: cluster,\n  databaseName: 'databaseName',\n  distStyle: TableDistStyle.KEY,\n});\n```\n\nThe table can also be configured to have sortStyle attribute and sortKey columns:\n\n```ts fixture=cluster\nnew Table(this, 'Table', {\n  tableColumns: [\n    { name: 'col1', dataType: 'varchar(4)', sortKey: true },\n    { name: 'col2', dataType: 'float', sortKey: true },\n  ],\n  cluster: cluster,\n  databaseName: 'databaseName',\n  sortStyle: TableSortStyle.COMPOUND,\n});\n```\n\n### Granting Privileges\n\nYou can give a user privileges to perform certain actions on a table by using the\n`Table.grant()` method.\n\n```ts fixture=cluster\nconst user = new User(this, 'User', {\n  cluster: cluster,\n  databaseName: 'databaseName',\n});\nconst table = new Table(this, 'Table', {\n  tableColumns: [{ name: 'col1', dataType: 'varchar(4)' }, { name: 'col2', dataType: 'float' }],\n  cluster: cluster,\n  databaseName: 'databaseName',\n});\n\ntable.grant(user, TableAction.DROP, TableAction.SELECT);\n```\n\nTake care when managing privileges via the CDK, as attempting to manage a user's\nprivileges on the same table in multiple CDK applications could lead to accidentally\noverriding these permissions. Consider the following two CDK applications which both refer\nto the same user and table. In application 1, the resources are created and the user is\ngiven `INSERT` permissions on the table:\n\n```ts fixture=cluster\nconst databaseName = 'databaseName';\nconst username = 'myuser'\nconst tableName = 'mytable'\n\nconst user = new User(this, 'User', {\n  username: username,\n  cluster: cluster,\n  databaseName: databaseName,\n});\nconst table = new Table(this, 'Table', {\n  tableColumns: [{ name: 'col1', dataType: 'varchar(4)' }, { name: 'col2', dataType: 'float' }],\n  cluster: cluster,\n  databaseName: databaseName,\n});\ntable.grant(user, TableAction.INSERT);\n```\n\nIn application 2, the resources are imported and the user is given `INSERT` permissions on\nthe table:\n\n```ts fixture=cluster\nconst databaseName = 'databaseName';\nconst username = 'myuser'\nconst tableName = 'mytable'\n\nconst user = User.fromUserAttributes(this, 'User', {\n  username: username,\n  password: SecretValue.unsafePlainText('NOT_FOR_PRODUCTION'),\n  cluster: cluster,\n  databaseName: databaseName,\n});\nconst table = Table.fromTableAttributes(this, 'Table', {\n  tableName: tableName,\n  tableColumns: [{ name: 'col1', dataType: 'varchar(4)' }, { name: 'col2', dataType: 'float' }],\n  cluster: cluster,\n  databaseName: 'databaseName',\n});\ntable.grant(user, TableAction.INSERT);\n```\n\nBoth applications attempt to grant the user the appropriate privilege on the table by\nsubmitting a `GRANT USER` SQL query to the Redshift cluster. Note that the latter of these\ntwo calls will have no effect since the user has already been granted the privilege.\n\nNow, if application 1 were to remove the call to `grant`, a `REVOKE USER` SQL query is\nsubmitted to the Redshift cluster. In general, application 1 does not know that\napplication 2 has also granted this permission and thus cannot decide not to issue the\nrevocation. This leads to the undesirable state where application 2 still contains the\ncall to `grant` but the user does not have the specified permission.\n\nNote that this does not occur when duplicate privileges are granted within the same\napplication, as such privileges are de-duplicated before any SQL query is submitted.\n\n## Rotating credentials\n\nWhen the master password is generated and stored in AWS Secrets Manager, it can be rotated automatically:\n\n```ts fixture=cluster\ncluster.addRotationSingleUser(); // Will rotate automatically after 30 days\n```\n\nThe multi user rotation scheme is also available:\n\n```ts fixture=cluster\n\nconst user = new User(this, 'User', {\n  cluster: cluster,\n  databaseName: 'databaseName',\n});\ncluster.addRotationMultiUser('MultiUserRotation', {\n  secret: user.secret,\n});\n```\n\n## Elastic IP\n\nIf you configure your cluster to be publicly accessible, you can optionally select an *elastic IP address* to use for the external IP address. An elastic IP address is a static IP address that is associated with your AWS account. You can use an elastic IP address to connect to your cluster from outside the VPC. An elastic IP address gives you the ability to change your underlying configuration without affecting the IP address that clients use to connect to your cluster. This approach can be helpful for situations such as recovery after a failure.\n\n```ts\ndeclare const vpc: ec2.Vpc;\n\nnew Cluster(stack, 'Redshift', {\n    masterUser: {\n      masterUsername: 'admin',\n      masterPassword: cdk.SecretValue.unsafePlainText('tooshort'),\n    },\n    vpc,\n    publiclyAccessible: true,\n    elasticIp: '10.123.123.255', // A elastic ip you own\n})\n```\n\nIf the Cluster is in a VPC and you want to connect to it using the private IP address from within the cluster, it is important to enable *DNS resolution* and *DNS hostnames* in the VPC config. If these parameters would not be set, connections from within the VPC would connect to the elastic IP address and not the private IP address.\n\n```ts\nconst vpc = new ec2.Vpc(this, 'VPC', {\n  enableDnsSupport: true,\n  enableDnsHostnames: true,\n});\n```\n\nNote that if there is already an existing, public accessible Cluster, which VPC configuration is changed to use *DNS hostnames* and *DNS resolution*, connections still use the elastic IP address until the cluster is resized.\n\n### Elastic IP vs. Cluster node public IP\n\nThe elastic IP address is an external IP address for accessing the cluster outside of a VPC. It's not related to the cluster node public IP addresses and private IP addresses that are accessible via the `clusterEndpoint` property. The public and private cluster node IP addresses appear regardless of whether the cluster is publicly accessible or not. They are used only in certain circumstances to configure ingress rules on the remote host. These circumstances occur when you load data from an Amazon EC2 instance or other remote host using a Secure Shell (SSH) connection.\n\n### Attach Elastic IP after Cluster creation\n\nIn some cases, you might want to associate the cluster with an elastic IP address or change an elastic IP address that is associated with the cluster. To attach an elastic IP address after the cluster is created, first update the cluster so that it is not publicly accessible, then make it both publicly accessible and add an Elastic IP address in the same operation.\n\n"
+    "markdown": "# Amazon Redshift Construct Library\n<!--BEGIN STABILITY BANNER-->\n\n---\n\n![cdk-constructs: Experimental](https://img.shields.io/badge/cdk--constructs-experimental-important.svg?style=for-the-badge)\n\n> The APIs of higher level constructs in this module are experimental and under active development.\n> They are subject to non-backward compatible changes or removal in any future version. These are\n> not subject to the [Semantic Versioning](https://semver.org/) model and breaking changes will be\n> announced in the release notes. This means that while you may use them, you may need to update\n> your source code when upgrading to a newer version of this package.\n\n---\n\n<!--END STABILITY BANNER-->\n\n## Starting a Redshift Cluster Database\n\nTo set up a Redshift cluster, define a `Cluster`. It will be launched in a VPC.\nYou can specify a VPC, otherwise one will be created. The nodes are always launched in private subnets and are encrypted by default.\n\n```ts\nimport * as ec2 from 'aws-cdk-lib/aws-ec2';\n\nconst vpc = new ec2.Vpc(this, 'Vpc');\nconst cluster = new Cluster(this, 'Redshift', {\n  masterUser: {\n    masterUsername: 'admin',\n  },\n  vpc\n});\n```\n\nBy default, the master password will be generated and stored in AWS Secrets Manager.\n\nA default database named `default_db` will be created in the cluster. To change the name of this database set the `defaultDatabaseName` attribute in the constructor properties.\n\nBy default, the cluster will not be publicly accessible.\nDepending on your use case, you can make the cluster publicly accessible with the `publiclyAccessible` property.\n\n## Adding a logging bucket for database audit logging to S3\n\nAmazon Redshift logs information about connections and user activities in your database. These logs help you to monitor the database for security and troubleshooting purposes, a process called database auditing. To send these logs to an S3 bucket, specify the `loggingProperties` when creating a new cluster.\n\n```ts\nimport * as ec2 from 'aws-cdk-lib/aws-ec2';\nimport * as s3 from 'aws-cdk-lib/aws-s3';\n\nconst vpc = new ec2.Vpc(this, 'Vpc');\nconst bucket = s3.Bucket.fromBucketName(stack, 'bucket', 'logging-bucket');\n\nconst cluster = new Cluster(this, 'Redshift', {\n  masterUser: {\n    masterUsername: 'admin',\n  },\n  vpc,\n  loggingProperties: {\n    loggingBucket = bucket,\n    loggingKeyPrefix: 'prefix',\n  }\n});\n```\n\n## Connecting\n\nTo control who can access the cluster, use the `.connections` attribute. Redshift Clusters have\na default port, so you don't need to specify the port:\n\n```ts fixture=cluster\ncluster.connections.allowDefaultPortFromAnyIpv4('Open to the world');\n```\n\nThe endpoint to access your database cluster will be available as the `.clusterEndpoint` attribute:\n\n```ts fixture=cluster\ncluster.clusterEndpoint.socketAddress;   // \"HOSTNAME:PORT\"\n```\n\n## Database Resources\n\nThis module allows for the creation of non-CloudFormation database resources such as users\nand tables. This allows you to manage identities, permissions, and stateful resources\nwithin your Redshift cluster from your CDK application.\n\nBecause these resources are not available in CloudFormation, this library leverages\n[custom\nresources](https://docs.aws.amazon.com/cdk/api/latest/docs/custom-resources-readme.html)\nto manage them. In addition to the IAM permissions required to make Redshift service\ncalls, the execution role for the custom resource handler requires database credentials to\ncreate resources within the cluster.\n\nThese database credentials can be supplied explicitly through the `adminUser` properties\nof the various database resource constructs. Alternatively, the credentials can be\nautomatically pulled from the Redshift cluster's default administrator\ncredentials. However, this option is only available if the password for the credentials\nwas generated by the CDK application (ie., no value vas provided for [the `masterPassword`\nproperty](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-redshift.Login.html#masterpasswordspan-classapi-icon-api-icon-experimental-titlethis-api-element-is-experimental-it-may-change-without-noticespan)\nof\n[`Cluster.masterUser`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-redshift.Cluster.html#masteruserspan-classapi-icon-api-icon-experimental-titlethis-api-element-is-experimental-it-may-change-without-noticespan)).\n\n### Creating Users\n\nCreate a user within a Redshift cluster database by instantiating a `User` construct. This\nwill generate a username and password, store the credentials in a [AWS Secrets Manager\n`Secret`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-secretsmanager.Secret.html),\nand make a query to the Redshift cluster to create a new database user with the\ncredentials.\n\n```ts fixture=cluster\nnew User(this, 'User', {\n  cluster: cluster,\n  databaseName: 'databaseName',\n});\n```\n\nBy default, the user credentials are encrypted with your AWS account's default Secrets\nManager encryption key. You can specify the encryption key used for this purpose by\nsupplying a key in the `encryptionKey` property.\n\n```ts fixture=cluster\nimport * as kms from 'aws-cdk-lib/aws-kms';\n\nconst encryptionKey = new kms.Key(this, 'Key');\nnew User(this, 'User', {\n  encryptionKey: encryptionKey,\n  cluster: cluster,\n  databaseName: 'databaseName',\n});\n```\n\nBy default, a username is automatically generated from the user construct ID and its path\nin the construct tree. You can specify a particular username by providing a value for the\n`username` property. Usernames must be valid identifiers; see: [Names and\nidentifiers](https://docs.aws.amazon.com/redshift/latest/dg/r_names.html) in the *Amazon\nRedshift Database Developer Guide*.\n\n```ts fixture=cluster\nnew User(this, 'User', {\n  username: 'myuser',\n  cluster: cluster,\n  databaseName: 'databaseName',\n});\n```\n\nThe user password is generated by AWS Secrets Manager using the default configuration\nfound in\n[`secretsmanager.SecretStringGenerator`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-secretsmanager.SecretStringGenerator.html),\nexcept with password length `30` and some SQL-incompliant characters excluded. The\nplaintext for the password will never be present in the CDK application; instead, a\n[CloudFormation Dynamic\nReference](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/dynamic-references.html)\nwill be used wherever the password value is required.\n\n### Creating Tables\n\nCreate a table within a Redshift cluster database by instantiating a `Table`\nconstruct. This will make a query to the Redshift cluster to create a new database table\nwith the supplied schema.\n\n```ts fixture=cluster\nnew Table(this, 'Table', {\n  tableColumns: [{ name: 'col1', dataType: 'varchar(4)' }, { name: 'col2', dataType: 'float' }],\n  cluster: cluster,\n  databaseName: 'databaseName',\n});\n```\n\nThe table can be configured to have distStyle attribute and a distKey column:\n\n```ts fixture=cluster\nnew Table(this, 'Table', {\n  tableColumns: [\n    { name: 'col1', dataType: 'varchar(4)', distKey: true },\n    { name: 'col2', dataType: 'float' },\n  ],\n  cluster: cluster,\n  databaseName: 'databaseName',\n  distStyle: TableDistStyle.KEY,\n});\n```\n\nThe table can also be configured to have sortStyle attribute and sortKey columns:\n\n```ts fixture=cluster\nnew Table(this, 'Table', {\n  tableColumns: [\n    { name: 'col1', dataType: 'varchar(4)', sortKey: true },\n    { name: 'col2', dataType: 'float', sortKey: true },\n  ],\n  cluster: cluster,\n  databaseName: 'databaseName',\n  sortStyle: TableSortStyle.COMPOUND,\n});\n```\n\n### Granting Privileges\n\nYou can give a user privileges to perform certain actions on a table by using the\n`Table.grant()` method.\n\n```ts fixture=cluster\nconst user = new User(this, 'User', {\n  cluster: cluster,\n  databaseName: 'databaseName',\n});\nconst table = new Table(this, 'Table', {\n  tableColumns: [{ name: 'col1', dataType: 'varchar(4)' }, { name: 'col2', dataType: 'float' }],\n  cluster: cluster,\n  databaseName: 'databaseName',\n});\n\ntable.grant(user, TableAction.DROP, TableAction.SELECT);\n```\n\nTake care when managing privileges via the CDK, as attempting to manage a user's\nprivileges on the same table in multiple CDK applications could lead to accidentally\noverriding these permissions. Consider the following two CDK applications which both refer\nto the same user and table. In application 1, the resources are created and the user is\ngiven `INSERT` permissions on the table:\n\n```ts fixture=cluster\nconst databaseName = 'databaseName';\nconst username = 'myuser'\nconst tableName = 'mytable'\n\nconst user = new User(this, 'User', {\n  username: username,\n  cluster: cluster,\n  databaseName: databaseName,\n});\nconst table = new Table(this, 'Table', {\n  tableColumns: [{ name: 'col1', dataType: 'varchar(4)' }, { name: 'col2', dataType: 'float' }],\n  cluster: cluster,\n  databaseName: databaseName,\n});\ntable.grant(user, TableAction.INSERT);\n```\n\nIn application 2, the resources are imported and the user is given `INSERT` permissions on\nthe table:\n\n```ts fixture=cluster\nconst databaseName = 'databaseName';\nconst username = 'myuser'\nconst tableName = 'mytable'\n\nconst user = User.fromUserAttributes(this, 'User', {\n  username: username,\n  password: SecretValue.unsafePlainText('NOT_FOR_PRODUCTION'),\n  cluster: cluster,\n  databaseName: databaseName,\n});\nconst table = Table.fromTableAttributes(this, 'Table', {\n  tableName: tableName,\n  tableColumns: [{ name: 'col1', dataType: 'varchar(4)' }, { name: 'col2', dataType: 'float' }],\n  cluster: cluster,\n  databaseName: 'databaseName',\n});\ntable.grant(user, TableAction.INSERT);\n```\n\nBoth applications attempt to grant the user the appropriate privilege on the table by\nsubmitting a `GRANT USER` SQL query to the Redshift cluster. Note that the latter of these\ntwo calls will have no effect since the user has already been granted the privilege.\n\nNow, if application 1 were to remove the call to `grant`, a `REVOKE USER` SQL query is\nsubmitted to the Redshift cluster. In general, application 1 does not know that\napplication 2 has also granted this permission and thus cannot decide not to issue the\nrevocation. This leads to the undesirable state where application 2 still contains the\ncall to `grant` but the user does not have the specified permission.\n\nNote that this does not occur when duplicate privileges are granted within the same\napplication, as such privileges are de-duplicated before any SQL query is submitted.\n\n## Rotating credentials\n\nWhen the master password is generated and stored in AWS Secrets Manager, it can be rotated automatically:\n\n```ts fixture=cluster\ncluster.addRotationSingleUser(); // Will rotate automatically after 30 days\n```\n\nThe multi user rotation scheme is also available:\n\n```ts fixture=cluster\n\nconst user = new User(this, 'User', {\n  cluster: cluster,\n  databaseName: 'databaseName',\n});\ncluster.addRotationMultiUser('MultiUserRotation', {\n  secret: user.secret,\n});\n```\n\n## Elastic IP\n\nIf you configure your cluster to be publicly accessible, you can optionally select an *elastic IP address* to use for the external IP address. An elastic IP address is a static IP address that is associated with your AWS account. You can use an elastic IP address to connect to your cluster from outside the VPC. An elastic IP address gives you the ability to change your underlying configuration without affecting the IP address that clients use to connect to your cluster. This approach can be helpful for situations such as recovery after a failure.\n\n```ts\ndeclare const vpc: ec2.Vpc;\n\nnew Cluster(stack, 'Redshift', {\n    masterUser: {\n      masterUsername: 'admin',\n      masterPassword: cdk.SecretValue.unsafePlainText('tooshort'),\n    },\n    vpc,\n    publiclyAccessible: true,\n    elasticIp: '10.123.123.255', // A elastic ip you own\n})\n```\n\nIf the Cluster is in a VPC and you want to connect to it using the private IP address from within the cluster, it is important to enable *DNS resolution* and *DNS hostnames* in the VPC config. If these parameters would not be set, connections from within the VPC would connect to the elastic IP address and not the private IP address.\n\n```ts\nconst vpc = new ec2.Vpc(this, 'VPC', {\n  enableDnsSupport: true,\n  enableDnsHostnames: true,\n});\n```\n\nNote that if there is already an existing, public accessible Cluster, which VPC configuration is changed to use *DNS hostnames* and *DNS resolution*, connections still use the elastic IP address until the cluster is resized.\n\n### Elastic IP vs. Cluster node public IP\n\nThe elastic IP address is an external IP address for accessing the cluster outside of a VPC. It's not related to the cluster node public IP addresses and private IP addresses that are accessible via the `clusterEndpoint` property. The public and private cluster node IP addresses appear regardless of whether the cluster is publicly accessible or not. They are used only in certain circumstances to configure ingress rules on the remote host. These circumstances occur when you load data from an Amazon EC2 instance or other remote host using a Secure Shell (SSH) connection.\n\n### Attach Elastic IP after Cluster creation\n\nIn some cases, you might want to associate the cluster with an elastic IP address or change an elastic IP address that is associated with the cluster. To attach an elastic IP address after the cluster is created, first update the cluster so that it is not publicly accessible, then make it both publicly accessible and add an Elastic IP address in the same operation.\n\n"
   },
   "repository": {
     "directory": "packages/individual-packages/aws-redshift",
@@ -3102,7 +3102,7 @@
         },
         "locationInModule": {
           "filename": "lib/cluster.ts",
-          "line": 435
+          "line": 445
         },
         "parameters": [
           {
@@ -3131,7 +3131,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "lib/cluster.ts",
-        "line": 384
+        "line": 394
       },
       "methods": [
         {
@@ -3141,7 +3141,7 @@
           },
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 388
+            "line": 398
           },
           "name": "fromClusterAttributes",
           "parameters": [
@@ -3178,7 +3178,7 @@
           },
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 562
+            "line": 589
           },
           "name": "addRotationMultiUser",
           "parameters": [
@@ -3208,7 +3208,7 @@
           },
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 538
+            "line": 565
           },
           "name": "addRotationSingleUser",
           "parameters": [
@@ -3236,7 +3236,7 @@
           },
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 371
+            "line": 381
           },
           "name": "asSecretAttachmentTarget",
           "overrides": "aws-cdk-lib.aws_secretsmanager.ISecretAttachmentTarget",
@@ -3257,7 +3257,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 410
+            "line": 420
           },
           "name": "clusterEndpoint",
           "overrides": "@aws-cdk/aws-redshift-alpha.ICluster",
@@ -3273,7 +3273,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 405
+            "line": 415
           },
           "name": "clusterName",
           "overrides": "@aws-cdk/aws-redshift-alpha.ICluster",
@@ -3289,7 +3289,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 415
+            "line": 425
           },
           "name": "connections",
           "overrides": "aws-cdk-lib.aws_ec2.IConnectable",
@@ -3305,7 +3305,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 420
+            "line": 430
           },
           "name": "secret",
           "optional": true,
@@ -3331,7 +3331,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/cluster.ts",
-        "line": 150
+        "line": 168
       },
       "name": "ClusterAttributes",
       "properties": [
@@ -3344,7 +3344,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 166
+            "line": 184
           },
           "name": "clusterEndpointAddress",
           "type": {
@@ -3360,7 +3360,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 171
+            "line": 189
           },
           "name": "clusterEndpointPort",
           "type": {
@@ -3376,7 +3376,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 161
+            "line": 179
           },
           "name": "clusterName",
           "type": {
@@ -3393,7 +3393,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 156
+            "line": 174
           },
           "name": "securityGroups",
           "optional": true,
@@ -3595,7 +3595,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/cluster.ts",
-        "line": 178
+        "line": 196
       },
       "name": "ClusterProps",
       "properties": [
@@ -3608,7 +3608,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 279
+            "line": 297
           },
           "name": "masterUser",
           "type": {
@@ -3624,7 +3624,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 253
+            "line": 271
           },
           "name": "vpc",
           "type": {
@@ -3643,7 +3643,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 337
+            "line": 347
           },
           "name": "classicResizing",
           "optional": true,
@@ -3661,7 +3661,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 185
+            "line": 203
           },
           "name": "clusterName",
           "optional": true,
@@ -3679,7 +3679,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 216
+            "line": 234
           },
           "name": "clusterType",
           "optional": true,
@@ -3697,7 +3697,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 294
+            "line": 312
           },
           "name": "defaultDatabaseName",
           "optional": true,
@@ -3716,7 +3716,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 346
+            "line": 356
           },
           "name": "elasticIp",
           "optional": true,
@@ -3734,7 +3734,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 230
+            "line": 248
           },
           "name": "encrypted",
           "optional": true,
@@ -3752,7 +3752,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 237
+            "line": 255
           },
           "name": "encryptionKey",
           "optional": true,
@@ -3763,38 +3763,19 @@
         {
           "abstract": true,
           "docs": {
-            "default": "- No Logs",
-            "remarks": "Logging information includes queries and connection attempts, for the specified Amazon Redshift cluster.",
-            "stability": "experimental",
-            "summary": "Bucket to send logs to."
-          },
-          "immutable": true,
-          "locationInModule": {
-            "filename": "lib/cluster.ts",
-            "line": 302
-          },
-          "name": "loggingBucket",
-          "optional": true,
-          "type": {
-            "fqn": "aws-cdk-lib.aws_s3.IBucket"
-          }
-        },
-        {
-          "abstract": true,
-          "docs": {
-            "default": "- no prefix",
+            "default": "- No logging bucket is used",
             "stability": "experimental",
-            "summary": "Prefix used for logging."
+            "summary": "Bucket details for log files to be sent to, including prefix."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 309
+            "line": 319
           },
-          "name": "loggingKeyPrefix",
+          "name": "loggingProperties",
           "optional": true,
           "type": {
-            "primitive": "string"
+            "fqn": "@aws-cdk/aws-redshift-alpha.LoggingProperties"
           }
         },
         {
@@ -3807,7 +3788,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 209
+            "line": 227
           },
           "name": "nodeType",
           "optional": true,
@@ -3826,7 +3807,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 202
+            "line": 220
           },
           "name": "numberOfNodes",
           "optional": true,
@@ -3844,7 +3825,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 193
+            "line": 211
           },
           "name": "parameterGroup",
           "optional": true,
@@ -3862,7 +3843,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 223
+            "line": 241
           },
           "name": "port",
           "optional": true,
@@ -3882,7 +3863,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 248
+            "line": 266
           },
           "name": "preferredMaintenanceWindow",
           "optional": true,
@@ -3900,7 +3881,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 324
+            "line": 334
           },
           "name": "publiclyAccessible",
           "optional": true,
@@ -3918,7 +3899,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 317
+            "line": 327
           },
           "name": "removalPolicy",
           "optional": true,
@@ -3937,7 +3918,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 287
+            "line": 305
           },
           "name": "roles",
           "optional": true,
@@ -3960,7 +3941,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 267
+            "line": 285
           },
           "name": "securityGroups",
           "optional": true,
@@ -3983,7 +3964,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 274
+            "line": 292
           },
           "name": "subnetGroup",
           "optional": true,
@@ -4001,7 +3982,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 260
+            "line": 278
           },
           "name": "vpcSubnets",
           "optional": true,
@@ -4619,7 +4600,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/cluster.ts",
-        "line": 131
+        "line": 149
       },
       "name": "ICluster",
       "properties": [
@@ -4635,7 +4616,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 144
+            "line": 162
           },
           "name": "clusterEndpoint",
           "type": {
@@ -4654,7 +4635,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 137
+            "line": 155
           },
           "name": "clusterName",
           "type": {
@@ -4975,6 +4956,61 @@
       ],
       "symbolId": "lib/user:IUser"
     },
+    "@aws-cdk/aws-redshift-alpha.LoggingProperties": {
+      "assembly": "@aws-cdk/aws-redshift-alpha",
+      "datatype": true,
+      "docs": {
+        "custom": {
+          "exampleMetadata": "infused"
+        },
+        "example": "import * as ec2 from 'aws-cdk-lib/aws-ec2';\nimport * as s3 from 'aws-cdk-lib/aws-s3';\n\nconst vpc = new ec2.Vpc(this, 'Vpc');\nconst bucket = s3.Bucket.fromBucketName(stack, 'bucket', 'logging-bucket');\n\nconst cluster = new Cluster(this, 'Redshift', {\n  masterUser: {\n    masterUsername: 'admin',\n  },\n  vpc,\n  loggingProperties: {\n    loggingBucket = bucket,\n    loggingKeyPrefix: 'prefix',\n  }\n});",
+        "stability": "experimental",
+        "summary": "Logging bucket and S3 prefix combination."
+      },
+      "fqn": "@aws-cdk/aws-redshift-alpha.LoggingProperties",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "lib/cluster.ts",
+        "line": 101
+      },
+      "name": "LoggingProperties",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "Logging information includes queries and connection attempts, for the specified Amazon Redshift cluster.",
+            "stability": "experimental",
+            "summary": "Bucket to send logs to."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/cluster.ts",
+            "line": 107
+          },
+          "name": "loggingBucket",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_s3.IBucket"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Prefix used for logging."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "lib/cluster.ts",
+            "line": 113
+          },
+          "name": "loggingKeyPrefix",
+          "type": {
+            "primitive": "string"
+          }
+        }
+      ],
+      "symbolId": "lib/cluster:LoggingProperties"
+    },
     "@aws-cdk/aws-redshift-alpha.Login": {
       "assembly": "@aws-cdk/aws-redshift-alpha",
       "datatype": true,
@@ -5145,7 +5181,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "lib/cluster.ts",
-        "line": 101
+        "line": 119
       },
       "name": "RotationMultiUserOptions",
       "properties": [
@@ -5159,7 +5195,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 116
+            "line": 134
           },
           "name": "secret",
           "type": {
@@ -5176,7 +5212,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "lib/cluster.ts",
-            "line": 124
+            "line": 142
           },
           "name": "automaticallyAfter",
           "optional": true,
@@ -6144,6 +6180,6 @@
       "symbolId": "lib/user:UserProps"
     }
   },
-  "version": "2.36.0-alpha.0",
+  "version": "2.38.0-alpha.0",
   "fingerprint": "**********"
 }