Redshift Serverless workgroup arn error

Question

from aws_cdk import (
aws_redshiftserverless as redshiftserverless,
aws_iam as iam,
Stack
)
from constructs import Construct

class MyStack(Stack):
def __init__(self, scope: Construct, id: str, **kwargs):
super().__init__(scope, id, **kwargs)

# Create a Redshift Serverless workgroup
workgroup = redshiftserverless.CfnWorkgroup(
self, "MyWorkgroup",
workgroup_name="my-workgroup",
namespace_name="my-namespace"
# Add other required properties
)

# Create an IAM role with a policy that references the workgroup ARN
role = iam.Role(
self, "MyRole",
assumed_by=iam.ServicePrincipal("lambda.amazonaws.com")
)

# Add a policy that references the workgroup ARN
role.add_to_policy(
iam.PolicyStatement(
actions=["redshift-serverless:GetWorkgroup"],
resources=[workgroup.get_att("workgroupArn").to_string()]
)
)
The key here is using workgroup.get_att("workgroupArn").to_string() to correctly reference the workgroup ARN. This approach uses CloudFormation's GetAtt function to retrieve the ARN attribute of the workgroup resource.

If you're using TypeScript, the equivalent would be:

workgroup.getAtt('workgroupArn').toString()

on using above got
Requested attribute workgroupArn does not exist in schema for AWS::RedshiftServerless::Workgroup
also tried

Using workgroup.attr_workgroup or workgroup.attr_workgroup_arn resources=[workgroup.attr_workgroup] Error: TypeError: type of argument resources must be one of (Sequence[str], NoneType); got aws_cdk.Reference instead

Trying to use workgroup.ref to construct ARN manually workgroup_arn = f"arn:aws:redshift-serverless:{self.region}:{self.account}:workgroup/{workgroup.ref}" resources=[workgroup_arn] Problem: workgroup.ref returns the workgroup name, not the UUID.

Using a Python list directly resources=[workgroup.attr_workgroup] Error: TypeError: type of argument resources must be one of (Sequence[str], NoneType); got list in

Using attr_workgroup_arn resources=[workgroup.attr_workgroup_arn] Error: AttributeError: 'CfnWorkgroup' object has no attribute 'attr_workgroup_arn'. Did you mean: 'attr_workgroup'?

When using AWS CDK to create a Redshift Serverless Workgroup (CfnWorkgroup), there is no property to retrieve the workgroup’s ARN or UUID.

This causes issues when creating IAM policies that require the workgroup ARN (UUID-based). Attempts to use workgroup.ref, attr_workgroup, or attr_workgroup_arn either produce the name instead of UUID or result in type errors:

AttributeError: 'CfnWorkgroup' object has no attribute 'attr_workgroup_arn'

TypeError: type of argument resources must be one of (Sequence[str], NoneType); got aws_cdk.Reference instead

When working with Amazon Redshift Serverless workgroups in AWS CDK, the ARN format is important to get right. The correct format for a Redshift Serverless workgroup ARN follows this pattern:

arn:aws(-[a-z]+)*:redshift-serverless:[a-z]{2}(-gov|(-iso[a-z]?))?-[a-z]+-\d{1}:\d{12}:workgroup/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}

You're seeing workgroup/workgroup name instead of workgroup/uuid because you might be using a reference to the workgroup name rather than the actual ARN that gets generated when the resource is created.

The workgroup ARN should include a UUID after the "workgroup/" part, which is automatically generated when the workgroup is created. This UUID is part of the workgroup's unique identifier.

When using the AWS CDK, you should reference the workgroup's ARN using attr_workgroup_arn property, which will give you the complete ARN including the UUID. This property links to the actual ARN that gets created in AWS, matching what you would see in the AWS console.

Make sure you're using the workgroupArn property from the WorkgroupProperty interface or the attr_workgroup_arn attribute from a CfnWorkgroup instance to get the correct ARN format with the UUID.

when used this got above multiple error

please help with cdk code

re:Post Agent · Answer

To correctly reference a Redshift Serverless workgroup ARN in your AWS CDK code, you need to use the proper attribute and format. The issue you're encountering is that the CfnWorkgroup class doesn't directly expose an attribute for the workgroup ARN.

Here's how you can correctly reference the workgroup ARN in your IAM policy:

```python
from aws_cdk import (
aws_redshiftserverless as redshiftserverless,
aws_iam as iam,
Stack,
Fn
)
from constructs import Construct

class MyStack(Stack):
def __init__(self, scope: Construct, id: str, **kwargs):
super().__init__(scope, id, **kwargs)

# Create a Redshift Serverless workgroup
workgroup = redshiftserverless.CfnWorkgroup(
self, "MyWorkgroup",
workgroup_name="my-workgroup",
namespace_name="my-namespace"
# Add other required properties
)

# Construct the ARN manually using the correct format
workgroup_arn = Fn.join("", [
f"arn:aws:redshift-serverless:{self.region}:{self.account}:workgroup/",
workgroup.ref
])

# Create an IAM role with a policy that references the workgroup ARN
role = iam.Role(
self, "MyRole",
assumed_by=iam.ServicePrincipal("lambda.amazonaws.com")
)

# Add a policy that references the workgroup ARN
role.add_to_policy(
iam.PolicyStatement(
actions=["redshift-serverless:GetWorkgroup"],
resources=[workgroup_arn]
)
)
```

The key issue is that for Redshift Serverless workgroups, the `ref` attribute returns the workgroup ID (which includes the UUID), not just the name. This is different from what you expected. By constructing the ARN manually with `Fn.join()`, you can create the proper ARN format that includes the workgroup ID.

If you need to reference the workgroup ARN in other parts of your CDK code or in cross-account scenarios, you'll need to follow the same pattern of constructing the ARN manually using the workgroup's `ref` attribute.

For cross-account scenarios, you would need to specify the account ID explicitly rather than using `self.account` if the workgroup is in a different account.  
**Sources**  
[AWS::Bedrock::KnowledgeBase RedshiftServerlessConfiguration - AWS CloudFormation](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-bedrock-knowledgebase-redshiftserverlessconfiguration.html)  
[How to Set Up Cross-Account Amazon MSK to Redshift Streaming Over Private Network | AWS re:Post](https://repost.aws/articles/ARlntclZHYRpCk5dMVB1_A7Q/how-to-set-up-cross-account-amazon-msk-to-redshift-streaming-over-private-network)

Redshift Serverless workgroup arn error

Create a Redshift Serverless workgroup

Add other required properties

Create an IAM role with a policy that references the workgroup ARN

Add a policy that references the workgroup ARN

Add your answer

Relevant content