{
  "tagging" : {
    "taggable" : true
  },
  "typeName" : "AWS::Redshift::Cluster",
  "readOnlyProperties" : [ "/properties/DeferMaintenanceIdentifier", "/properties/Endpoint/Port", "/properties/Endpoint/Address", "/properties/ClusterNamespaceArn", "/properties/MasterPasswordSecretArn" ],
  "description" : "An example resource schema demonstrating some basic constructs and validation rules.",
  "createOnlyProperties" : [ "/properties/ClusterIdentifier", "/properties/OwnerAccount", "/properties/SnapshotIdentifier", "/properties/DBName", "/properties/SnapshotClusterIdentifier", "/properties/ClusterSubnetGroupName", "/properties/MasterUsername" ],
  "primaryIdentifier" : [ "/properties/ClusterIdentifier" ],
  "required" : [ "NodeType", "MasterUsername", "DBName", "ClusterType" ],
  "sourceUrl" : "https://github.com/aws-cloudformation/aws-cloudformation-rpdk.git",
  "handlers" : {
    "read" : {
      "permissions" : [ "redshift:DescribeClusters", "redshift:DescribeLoggingStatus", "redshift:DescribeSnapshotCopyGrant", "redshift:DescribeClusterDbRevisions", "redshift:DescribeTags", "redshift:GetResourcePolicy" ]
    },
    "create" : {
      "permissions" : [ "iam:PassRole", "iam:CreateServiceLinkedRole", "redshift:DescribeClusters", "redshift:CreateCluster", "redshift:RestoreFromClusterSnapshot", "redshift:EnableLogging", "redshift:DescribeLoggingStatus", "redshift:CreateTags", "redshift:DescribeTags", "redshift:GetResourcePolicy", "redshift:PutResourcePolicy", "redshift:ModifyClusterMaintenance", "ec2:Describe*", "ec2:AssociateAddress", "ec2:CreateNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:CreateVpcEndpoint", "ec2:ModifyVpcEndpoint", "ec2:AllocateAddress", "ec2:CreateSecurityGroup", "cloudwatch:PutMetricData", "kms:GenerateDataKey", "kms:CreateGrant", "kms:DescribeKey", "kms:Encrypt", "kms:Decrypt", "secretsmanager:CreateSecret", "secretsmanager:TagResource" ],
      "timeoutInMinutes" : 2160
    },
    "update" : {
      "permissions" : [ "iam:PassRole", "redshift:DescribeClusters", "redshift:ModifyCluster", "redshift:ModifyClusterIamRoles", "redshift:EnableLogging", "redshift:CreateTags", "redshift:DeleteTags", "redshift:DescribeTags", "redshift:DisableLogging", "redshift:DescribeLoggingStatus", "redshift:RebootCluster", "redshift:EnableSnapshotCopy", "redshift:DisableSnapshotCopy", "redshift:ModifySnapshotCopyRetentionPeriod", "redshift:ModifyAquaConfiguration", "redshift:ResizeCluster", "redshift:ModifyClusterMaintenance", "redshift:DescribeClusterDbRevisions", "redshift:ModifyClusterDbRevisions", "redshift:PauseCluster", "redshift:ResumeCluster", "redshift:RotateEncryptionKey", "redshift:FailoverPrimaryCompute", "redshift:PutResourcePolicy", "redshift:GetResourcePolicy", "redshift:DeleteResourcePolicy", "cloudwatch:PutMetricData", "kms:GenerateDataKey", "kms:CreateGrant", "kms:DescribeKey", "kms:Encrypt", "kms:Decrypt", "secretsmanager:CreateSecret", "secretsmanager:TagResource" ],
      "timeoutInMinutes" : 2160
    },
    "list" : {
      "permissions" : [ "redshift:DescribeTags", "redshift:DescribeClusters" ]
    },
    "delete" : {
      "permissions" : [ "redshift:DescribeTags", "redshift:DescribeClusters", "redshift:DeleteCluster" ],
      "timeoutInMinutes" : 2160
    }
  },
  "writeOnlyProperties" : [ "/properties/MasterUserPassword", "/properties/Classic", "/properties/SnapshotIdentifier", "/properties/DeferMaintenance", "/properties/DeferMaintenanceDuration", "/properties/ManageMasterPassword" ],
  "additionalProperties" : false,
  "definitions" : {
    "Endpoint" : {
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "Address" : {
          "type" : "string"
        },
        "Port" : {
          "type" : "string"
        }
      }
    },
    "LoggingProperties" : {
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "BucketName" : {
          "type" : "string"
        },
        "S3KeyPrefix" : {
          "type" : "string"
        },
        "LogDestinationType" : {
          "type" : "string"
        },
        "LogExports" : {
          "maxItems" : 3,
          "insertionOrder" : false,
          "type" : "array",
          "items" : {
            "type" : "string"
          }
        }
      }
    },
    "Tag" : {
      "description" : "A key-value pair to associate with a resource.",
      "additionalProperties" : false,
      "type" : "object",
      "properties" : {
        "Value" : {
          "minLength" : 1,
          "description" : "The value for the tag. You can specify a value that is 1 to 255 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -.",
          "type" : "string",
          "maxLength" : 255
        },
        "Key" : {
          "minLength" : 1,
          "description" : "The key name of the tag. You can specify a value that is 1 to 127 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -.",
          "type" : "string",
          "maxLength" : 127
        }
      },
      "required" : [ "Value", "Key" ]
    }
  },
  "properties" : {
    "RevisionTarget" : {
      "description" : "The identifier of the database revision. You can retrieve this value from the response to the DescribeClusterDbRevisions request.",
      "type" : "string"
    },
    "AutomatedSnapshotRetentionPeriod" : {
      "description" : "The number of days that automated snapshots are retained. If the value is 0, automated snapshots are disabled. Default value is 1",
      "type" : "integer"
    },
    "Encrypted" : {
      "description" : "If true, the data in the cluster is encrypted at rest.",
      "type" : "boolean"
    },
    "Port" : {
      "description" : "The port number on which the cluster accepts incoming connections. The cluster is accessible only via the JDBC and ODBC connection strings",
      "type" : "integer"
    },
    "NumberOfNodes" : {
      "description" : "The number of compute nodes in the cluster. This parameter is required when the ClusterType parameter is specified as multi-node.",
      "type" : "integer"
    },
    "DestinationRegion" : {
      "description" : "The destination AWS Region that you want to copy snapshots to. Constraints: Must be the name of a valid AWS Region. For more information, see Regions and Endpoints in the Amazon Web Services [https://docs.aws.amazon.com/general/latest/gr/rande.html#redshift_region] General Reference",
      "type" : "string"
    },
    "AllowVersionUpgrade" : {
      "description" : "Major version upgrades can be applied during the maintenance window to the Amazon Redshift engine that is running on the cluster. Default value is True",
      "type" : "boolean"
    },
    "Endpoint" : {
      "$ref" : "#/definitions/Endpoint"
    },
    "NamespaceResourcePolicy" : {
      "description" : "The namespace resource policy document that will be attached to a Redshift cluster.",
      "type" : "object"
    },
    "MaintenanceTrackName" : {
      "description" : "The name for the maintenance track that you want to assign for the cluster. This name change is asynchronous. The new track name stays in the PendingModifiedValues for the cluster until the next maintenance window. When the maintenance track changes, the cluster is switched to the latest cluster release available for the maintenance track. At this point, the maintenance track name is applied.",
      "type" : "string"
    },
    "OwnerAccount" : {
      "type" : "string"
    },
    "MultiAZ" : {
      "description" : "A boolean indicating if the redshift cluster is multi-az or not. If you don't provide this parameter or set the value to false, the redshift cluster will be single-az.",
      "type" : "boolean"
    },
    "Tags" : {
      "maxItems" : 50,
      "uniqueItems" : false,
      "description" : "The list of tags for the cluster parameter group.",
      "insertionOrder" : false,
      "type" : "array",
      "items" : {
        "$ref" : "#/definitions/Tag"
      }
    },
    "SnapshotClusterIdentifier" : {
      "description" : "The name of the cluster the source snapshot was created from. This parameter is required if your IAM user has a policy containing a snapshot resource element that specifies anything other than * for the cluster name.",
      "type" : "string"
    },
    "IamRoles" : {
      "maxItems" : 50,
      "description" : "A list of AWS Identity and Access Management (IAM) roles that can be used by the cluster to access other AWS services. You must supply the IAM roles in their Amazon Resource Name (ARN) format. You can supply up to 50 IAM roles in a single request",
      "insertionOrder" : false,
      "type" : "array",
      "items" : {
        "relationshipRef" : {
          "typeName" : "AWS::IAM::Role",
          "propertyPath" : "/properties/Arn"
        },
        "type" : "string"
      }
    },
    "KmsKeyId" : {
      "description" : "The AWS Key Management Service (KMS) key ID of the encryption key that you want to use to encrypt data in the cluster.",
      "anyOf" : [ {
        "relationshipRef" : {
          "typeName" : "AWS::KMS::Key",
          "propertyPath" : "/properties/Arn"
        }
      }, {
        "relationshipRef" : {
          "typeName" : "AWS::KMS::Key",
          "propertyPath" : "/properties/KeyId"
        }
      } ],
      "type" : "string"
    },
    "SnapshotCopyManual" : {
      "description" : "Indicates whether to apply the snapshot retention period to newly copied manual snapshots instead of automated snapshots.",
      "type" : "boolean"
    },
    "ManageMasterPassword" : {
      "description" : "A boolean indicating if the redshift cluster's admin user credentials is managed by Redshift or not. You can't use MasterUserPassword if ManageMasterPassword is true. If ManageMasterPassword is false or not set, Amazon Redshift uses MasterUserPassword for the admin user account's password.",
      "type" : "boolean"
    },
    "AvailabilityZone" : {
      "description" : "The EC2 Availability Zone (AZ) in which you want Amazon Redshift to provision the cluster. Default: A random, system-chosen Availability Zone in the region that is specified by the endpoint",
      "type" : "string"
    },
    "ClusterSecurityGroups" : {
      "uniqueItems" : false,
      "description" : "A list of security groups to be associated with this cluster.",
      "insertionOrder" : false,
      "type" : "array",
      "items" : {
        "anyOf" : [ {
          "relationshipRef" : {
            "typeName" : "AWS::EC2::SecurityGroup",
            "propertyPath" : "/properties/Id"
          }
        }, {
          "relationshipRef" : {
            "typeName" : "AWS::Redshift::ClusterSecurityGroup",
            "propertyPath" : "/properties/Id"
          }
        } ],
        "type" : "string"
      }
    },
    "ClusterIdentifier" : {
      "description" : "A unique identifier for the cluster. You use this identifier to refer to the cluster for any subsequent cluster operations such as deleting or modifying. All alphabetical characters must be lower case, no hypens at the end, no two consecutive hyphens. Cluster name should be unique for all clusters within an AWS account",
      "type" : "string",
      "maxLength" : 63
    },
    "MasterUserPassword" : {
      "description" : "The password associated with the master user account for the cluster that is being created. You can't use MasterUserPassword if ManageMasterPassword is true. Password must be between 8 and 64 characters in length, should have at least one uppercase letter.Must contain at least one lowercase letter.Must contain one number.Can be any printable ASCII character.",
      "type" : "string",
      "maxLength" : 64
    },
    "ClusterSubnetGroupName" : {
      "description" : "The name of a cluster subnet group to be associated with this cluster.",
      "type" : "string"
    },
    "LoggingProperties" : {
      "$ref" : "#/definitions/LoggingProperties"
    },
    "DeferMaintenance" : {
      "description" : "A boolean indicating whether to enable the deferred maintenance window.",
      "type" : "boolean"
    },
    "NodeType" : {
      "description" : "The node type to be provisioned for the cluster.Valid Values: ds2.xlarge | ds2.8xlarge | dc1.large | dc1.8xlarge | dc2.large | dc2.8xlarge | ra3.large | ra3.4xlarge | ra3.16xlarge",
      "type" : "string"
    },
    "MasterUsername" : {
      "description" : "The user name associated with the master user account for the cluster that is being created. The user name can't be PUBLIC and first character must be a letter.",
      "type" : "string",
      "maxLength" : 128
    },
    "PubliclyAccessible" : {
      "description" : "If true, the cluster can be accessed from a public network.",
      "type" : "boolean"
    },
    "DeferMaintenanceIdentifier" : {
      "description" : "A unique identifier for the deferred maintenance window.",
      "type" : "string"
    },
    "ManualSnapshotRetentionPeriod" : {
      "description" : "The number of days to retain newly copied snapshots in the destination AWS Region after they are copied from the source AWS Region. If the value is -1, the manual snapshot is retained indefinitely.\n\nThe value must be either -1 or an integer between 1 and 3,653.",
      "type" : "integer"
    },
    "ResourceAction" : {
      "description" : "The Redshift operation to be performed. Resource Action supports pause-cluster, resume-cluster, failover-primary-compute APIs",
      "type" : "string"
    },
    "HsmClientCertificateIdentifier" : {
      "description" : "Specifies the name of the HSM client certificate the Amazon Redshift cluster uses to retrieve the data encryption keys stored in an HSM",
      "type" : "string"
    },
    "ElasticIp" : {
      "description" : "The Elastic IP (EIP) address for the cluster.",
      "type" : "string"
    },
    "AvailabilityZoneRelocationStatus" : {
      "description" : "The availability zone relocation status of the cluster",
      "type" : "string"
    },
    "AquaConfigurationStatus" : {
      "description" : "The value represents how the cluster is configured to use AQUA (Advanced Query Accelerator) after the cluster is restored. Possible values include the following.\n\nenabled - Use AQUA if it is available for the current Region and Amazon Redshift node type.\ndisabled - Don't use AQUA.\nauto - Amazon Redshift determines whether to use AQUA.\n",
      "type" : "string"
    },
    "SnapshotIdentifier" : {
      "description" : "The name of the snapshot from which to create the new cluster. This parameter isn't case sensitive.",
      "type" : "string"
    },
    "AvailabilityZoneRelocation" : {
      "description" : "The option to enable relocation for an Amazon Redshift cluster between Availability Zones after the cluster modification is complete.",
      "type" : "boolean"
    },
    "SnapshotCopyGrantName" : {
      "description" : "The name of the snapshot copy grant to use when snapshots of an AWS KMS-encrypted cluster are copied to the destination region.",
      "type" : "string"
    },
    "EnhancedVpcRouting" : {
      "description" : "An option that specifies whether to create the cluster with enhanced VPC routing enabled. To create a cluster that uses enhanced VPC routing, the cluster must be in a VPC. For more information, see Enhanced VPC Routing in the Amazon Redshift Cluster Management Guide.\n\nIf this option is true , enhanced VPC routing is enabled.\n\nDefault: false",
      "type" : "boolean"
    },
    "ClusterParameterGroupName" : {
      "description" : "The name of the parameter group to be associated with this cluster.",
      "type" : "string",
      "maxLength" : 255
    },
    "DeferMaintenanceEndTime" : {
      "description" : "A timestamp indicating end time for the deferred maintenance window. If you specify an end time, you can't specify a duration.",
      "type" : "string"
    },
    "RotateEncryptionKey" : {
      "description" : "A boolean indicating if we want to rotate Encryption Keys.",
      "type" : "boolean"
    },
    "VpcSecurityGroupIds" : {
      "uniqueItems" : false,
      "description" : "A list of Virtual Private Cloud (VPC) security groups to be associated with the cluster.",
      "insertionOrder" : false,
      "type" : "array",
      "items" : {
        "relationshipRef" : {
          "typeName" : "AWS::EC2::VPC",
          "propertyPath" : "/properties/VpcId"
        },
        "type" : "string"
      }
    },
    "ClusterNamespaceArn" : {
      "description" : "The Amazon Resource Name (ARN) of the cluster namespace.",
      "type" : "string"
    },
    "MasterPasswordSecretArn" : {
      "description" : "The Amazon Resource Name (ARN) for the cluster's admin user credentials secret.",
      "type" : "string"
    },
    "ClusterVersion" : {
      "description" : "The version of the Amazon Redshift engine software that you want to deploy on the cluster.The version selected runs on all the nodes in the cluster.",
      "type" : "string"
    },
    "HsmConfigurationIdentifier" : {
      "description" : "Specifies the name of the HSM configuration that contains the information the Amazon Redshift cluster can use to retrieve and store keys in an HSM.",
      "type" : "string"
    },
    "PreferredMaintenanceWindow" : {
      "description" : "The weekly time range (in UTC) during which automated cluster maintenance can occur.",
      "type" : "string"
    },
    "DeferMaintenanceStartTime" : {
      "description" : "A timestamp indicating the start time for the deferred maintenance window.",
      "type" : "string"
    },
    "ClusterType" : {
      "description" : "The type of the cluster. When cluster type is specified as single-node, the NumberOfNodes parameter is not required and if multi-node, the NumberOfNodes parameter is required",
      "type" : "string"
    },
    "Classic" : {
      "description" : "A boolean value indicating whether the resize operation is using the classic resize process. If you don't provide this parameter or set the value to false , the resize type is elastic.",
      "type" : "boolean"
    },
    "MasterPasswordSecretKmsKeyId" : {
      "description" : "The ID of the Key Management Service (KMS) key used to encrypt and store the cluster's admin user credentials secret.",
      "anyOf" : [ {
        "relationshipRef" : {
          "typeName" : "AWS::KMS::Key",
          "propertyPath" : "/properties/Arn"
        }
      }, {
        "relationshipRef" : {
          "typeName" : "AWS::KMS::Key",
          "propertyPath" : "/properties/KeyId"
        }
      } ],
      "type" : "string"
    },
    "DeferMaintenanceDuration" : {
      "description" : "An integer indicating the duration of the maintenance window in days. If you specify a duration, you can't specify an end time. The duration must be 60 days or less.",
      "type" : "integer"
    },
    "DBName" : {
      "description" : "The name of the first database to be created when the cluster is created. To create additional databases after the cluster is created, connect to the cluster with a SQL client and use SQL commands to create a database.",
      "type" : "string"
    },
    "SnapshotCopyRetentionPeriod" : {
      "description" : "The number of days to retain automated snapshots in the destination region after they are copied from the source region. \n\n Default is 7. \n\n Constraints: Must be at least 1 and no more than 35.",
      "type" : "integer"
    }
  }
}