Redshift Serverless workgroup arn error

Question

Using workgroup.attr_workgroup or workgroup.attr_workgroup_arn resources=[workgroup.attr_workgroup] Error: TypeError: type of argument resources must be one of (Sequence[str], NoneType); got aws_cdk.Reference instead

Trying to use workgroup.ref to construct ARN manually workgroup_arn = f"arn:aws:redshift-serverless:{self.region}:{self.account}:workgroup/{workgroup.ref}" resources=[workgroup_arn] Problem: workgroup.ref returns the workgroup name, not the UUID.

Using a Python list directly resources=[workgroup.attr_workgroup] Error: TypeError: type of argument resources must be one of (Sequence[str], NoneType); got list in

Using attr_workgroup_arn resources=[workgroup.attr_workgroup_arn] Error: AttributeError: 'CfnWorkgroup' object has no attribute 'attr_workgroup_arn'. Did you mean: 'attr_workgroup'?

When using AWS CDK to create a Redshift Serverless Workgroup (CfnWorkgroup), there is no property to retrieve the workgroup’s ARN or UUID.

This causes issues when creating IAM policies that require the workgroup ARN (UUID-based). Attempts to use workgroup.ref, attr_workgroup, or attr_workgroup_arn either produce the name instead of UUID or result in type errors:

AttributeError: 'CfnWorkgroup' object has no attribute 'attr_workgroup_arn'

TypeError: type of argument resources must be one of (Sequence[str], NoneType); got aws_cdk.Reference instead

When working with Amazon Redshift Serverless workgroups in AWS CDK, the ARN format is important to get right. The correct format for a Redshift Serverless workgroup ARN follows this pattern:

arn:aws(-[a-z]+)*:redshift-serverless:[a-z]{2}(-gov|(-iso[a-z]?))?-[a-z]+-\d{1}:\d{12}:workgroup/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}

You're seeing workgroup/workgroup name instead of workgroup/uuid because you might be using a reference to the workgroup name rather than the actual ARN that gets generated when the resource is created.

The workgroup ARN should include a UUID after the "workgroup/" part, which is automatically generated when the workgroup is created. This UUID is part of the workgroup's unique identifier.

When using the AWS CDK, you should reference the workgroup's ARN using attr_workgroup_arn property, which will give you the complete ARN including the UUID. This property links to the actual ARN that gets created in AWS, matching what you would see in the AWS console.

Make sure you're using the workgroupArn property from the WorkgroupProperty interface or the attr_workgroup_arn attribute from a CfnWorkgroup instance to get the correct ARN format with the UUID.

when used this got above multiple error

please provide cdk code to refer workgroup arn in role in same stack

re:Post Agent · Answer

Based on your description of the errors, it seems you're having trouble accessing the ARN of a Redshift Serverless workgroup in AWS CDK to use it in IAM policies.

When working with a CfnWorkgroup in AWS CDK, the correct attribute to access the workgroup ARN is `attr_workgroup_arn`, not `attr_workgroup`. However, there appears to be some confusion in the error messages you're seeing.

Here's the correct way to reference a Redshift Serverless workgroup ARN in an IAM policy within the same stack:

```python
from aws_cdk import (
aws_redshiftserverless as redshiftserverless,
aws_iam as iam,
Stack
)
from constructs import Construct

class MyStack(Stack):
def __init__(self, scope: Construct, id: str, **kwargs):
super().__init__(scope, id, **kwargs)

# Create a Redshift Serverless workgroup
workgroup = redshiftserverless.CfnWorkgroup(
self, "MyWorkgroup",
workgroup_name="my-workgroup",
namespace_name="my-namespace"
# Add other required properties
)

# Create an IAM role with a policy that references the workgroup ARN
role = iam.Role(
self, "MyRole",
assumed_by=iam.ServicePrincipal("lambda.amazonaws.com")
)

# Add a policy that references the workgroup ARN
role.add_to_policy(
iam.PolicyStatement(
actions=["redshift-serverless:GetWorkgroup"],
resources=[workgroup.get_att("workgroupArn").to_string()]
)
)
```

The key here is using `workgroup.get_att("workgroupArn").to_string()` to correctly reference the workgroup ARN. This approach uses CloudFormation's GetAtt function to retrieve the ARN attribute of the workgroup resource.

If you're using TypeScript, the equivalent would be:
```typescript
workgroup.getAtt('workgroupArn').toString()
```

This will correctly reference the full ARN including the UUID that gets generated when the workgroup is created.  
**Sources**  
[Workgroup - Amazon Redshift Serverless](https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_Workgroup.html)  
[CfnWorkgroup — AWS Cloud Development Kit 2.232.0 documentation](https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_redshiftserverless/CfnWorkgroup.html)  
[CfnWorkgroupPropsMixin — AWS Cloud Development Kit 2.232.0 documentation](https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.mixins_preview.aws_redshiftserverless.mixins/CfnWorkgroupPropsMixin.html)

Redshift Serverless workgroup arn error

Add your answer

Relevant content