redshiftserverless workgroup error

When working with Amazon Redshift Serverless workgroups in AWS CDK, you're encountering an error because you're trying to access the ARN attribute incorrectly.

For a Redshift Serverless workgroup created using CDK, the correct way to reference the workgroup ARN is through the workgroupArn property of the workgroup object. Based on the AWS CDK API for Redshift Serverless, the CfnWorkgroup class doesn't have an attr_arn property, which explains your first error.

To correctly reference the workgroup ARN in your IAM role policy, you should use:

workgroup_arn = workgroup.get_att("WorkgroupArn")

Or if you're using TypeScript:

const workgroupArn = workgroup.getAtt("WorkgroupArn");

This retrieves the ARN from the CloudFormation resource attribute. The ARN follows the format: arn:aws:redshift-serverless:region:account-id:workgroup/workgroup-id

When adding this ARN to an IAM role policy, ensure you're using it in a properly formatted policy document. For example:

role = iam.Role(self, "RedshiftRole",
assumed_by=iam.ServicePrincipal("redshift.amazonaws.com")
)

role.add_to_policy(iam.PolicyStatement(
actions=["redshift-serverless:GetCredentials"],
resources=[workgroup.get_att("WorkgroupArn")]
))

This approach will correctly reference the Redshift Serverless workgroup ARN in your IAM role policy.
Sources
CfnWorkgroupPropsMixin.WorkgroupProperty (AWS CDK 2.230.0 API)
CreateWorkgroup - Amazon Redshift Serverless
CfnWorkgroup.WorkgroupProperty (AWS CDK 2.221.0 API)
Authenticating a scheduled query - Amazon Redshift