如何通过Terraform批量创建Redshift集群并添加额外用户？

1. 调整集群配置结构，添加额外用户字段 #

先在你的local.env集群配置中，为每个集群新增extra_users数组，定义需要创建的非管理员用户信息：

locals {
  env = {
    ${var.tier} = {
      ${var.region} = {
        clusters = [
          {
            name          = "cluster-prod-1"
            database      = "prod_db_1"
            admin_user    = "prod_admin"
            admin_password = "your_admin_pass" # 建议用AWS Secrets Manager存储，避免明文
            extra_users = [
              { username = "app_user_1", password = "app_pass_1" },
              { username = "report_user_1", password = "report_pass_1" }
            ]
          },
          # 更多集群配置...
        ]
      }
    }
  }
}

2. 优化Redshift模块的for_each配置 #

将集群列表转为以集群名称为键的映射，方便后续关联用户资源：

module "redshift_clusters" {
  for_each = { for cluster in local.env[var.tier][var.region].clusters : cluster.name => cluster }
  source  = "terraform-aws-modules/redshift/aws"

  cluster_identifier    = each.value.name
  allow_version_upgrade = true
  node_type             = "dc2.large"
  number_of_nodes       = 2

  database_name          = each.value.database
  master_username        = each.value.admin_user
  create_random_password = false
  master_password        = each.value.admin_password

  encrypted   = true
  kms_key_arn = "your_kms_key_arn"

  enhanced_vpc_routing   = false
  vpc_security_group_ids = ["your_sg_ids"]
  subnet_ids             = ["your_subnet_ids"]

  publicly_accessible = true

  iam_role_arns = ["your_iam_role_arns"]

  parameter_group_name = "your_parameter_group"

  create_subnet_group = false
  subnet_group_name   = "your_subnet_group"

  preferred_maintenance_window = "sat:01:00-sat:01:30"

  automated_snapshot_retention_period = 30
  manual_snapshot_retention_period = -1
}

3. 扁平化用户配置，批量创建额外用户 #

先通过局部变量将所有集群的额外用户转为带唯一键的映射，再使用AWS原生aws_redshift_user资源批量创建用户：

# 扁平化所有集群的额外用户，生成唯一键（集群名-用户名）
locals {
  redshift_extra_users = merge(
    flatten([
      for cluster_name, cluster in local.env[var.tier][var.region].clusters : [
        for user in cluster.extra_users : {
          "${cluster_name}-${user.username}" = {
            cluster_identifier = cluster_name
            username           = user.username
            password           = user.password
          }
        }
      ]
    ])...
  )
}

# 批量创建额外Redshift用户
resource "aws_redshift_user" "extra_users" {
  for_each = local.redshift_extra_users

  cluster_identifier = each.value.cluster_identifier
  username           = each.value.username
  password           = each.value.password

  # 可选：为用户配置默认IAM角色（用于IAM认证场景）
  # default_iam_role_arn = "your_iam_user_role_arn"

  # 可选：直接分配数据库权限
  # permissions = ["SELECT ON ALL TABLES IN SCHEMA public"]
}

4. 安全优化：自动生成用户密码（可选） #

若不想明文存储用户密码，可使用random_password资源自动生成符合要求的密码：

# 为每个额外用户生成随机密码
resource "random_password" "user_passwords" {
  for_each = local.redshift_extra_users
  length   = 16
  special  = true
  override_special = "!@#$%" # 自定义允许的特殊字符
}

# 使用生成的随机密码创建用户
resource "aws_redshift_user" "extra_users" {
  for_each = local.redshift_extra_users

  cluster_identifier = each.value.cluster_identifier
  username           = each.value.username
  password           = random_password.user_passwords[each.key].result
}

关键说明 #

• aws_redshift_user是AWS Provider原生资源，不受Terraform Redshift模块限制，可直接关联已创建的集群
• Terraform会自动处理依赖关系：因cluster_identifier引用了模块输出的集群标识符，用户资源会在集群创建完成后再执行创建
• 如需更精细的权限控制，可配合aws_redshift_user_policy或aws_redshift_group资源管理用户权限组

内容的提问来源于stack exchange，提问作者thebaconator