# yaml-language-server: $schema=../../../schemas/@aws-mdaa/quicksight-project.json
# QuickSight project with Redshift data source.
# Connects QuickSight to the Redshift cluster for BI dashboards.

principals:
  Readers: 'arn:{{partition}}:quicksight:{{context:qs_identity_region}}:{{account}}:group/default/{{context:qs_readers_group}}'
  Authors: 'arn:{{partition}}:quicksight:{{context:qs_identity_region}}:{{account}}:group/default/{{context:qs_authors_group}}'

dataSources:
  REDSHIFT:
    datalake-redshift:
      dataSourceSpecificParameters:
        redshiftParameters:
          database: 'default_db'
          # Actual cluster identifier exported by the redshift module (data domain).
          # Referenced via SSM because MDAA truncates/hashes the cluster name to fit
          # length limits, so it cannot be reliably reconstructed from naming parts.
          clusterId: ssm:/{{org}}/data/redshift/cluster/identifier
          # MDAA datawarehouse app defaults to port 5440
          port: 5440
          # IAM-based authentication: QuickSight calls GetClusterCredentials for temporary
          # DB credentials, avoiding Secrets Manager (and its one-time console enablement),
          # so the data source deploys without a manual step. The quicksight-project module
          # automatically creates the QuickSight-assumable role (scoped to this cluster) and
          # sets its roleArn — no role needs to be supplied here.
          iamParameters:
            autoCreateDatabaseUser: true
            databaseUser: 'quicksight'
      # Alternative to iamParameters: Secrets Manager authentication. To use it:
      #   1. Comment out the iamParameters block above.
      #   2. Uncomment the secretsManager block below.
      #   3. Uncomment the databaseUsers block in redshift.yaml (creates the secret).
      #   4. Enable Secrets Manager in the QuickSight console (one-time; creates the
      #      aws-quicksight-secretsmanager-role-v0 role). See the README
      #      "QuickSight Redshift authentication" section.
      #
      # secretsManager:
      #   arn: ssm:/{{org}}/data/datawarehouse/secretarn/serviceuserquicksight
      #   kmsKeyArns:
      #     - ssm:/{{org}}/data/redshift/kms/data-warehouse/arn
      displayName: 'DataLakeRedshift'
      permissions:
        - actions: 'READER_DATA_SOURCE'
          principal: 'Readers'
        - actions: 'AUTHOR_DATA_SOURCE'
          principal: 'Authors'
      # VPC connection for Redshift data source (created by quicksight-account module)
      vpcConnectionProperties:
        # VPC connection ARN follows MDAA naming: {org}-{env}-{domain}-{module}-vpc-
        # The trailing dash is intentional — it matches the vpcConnectionId generated by the quicksight-account module.
        vpcConnectionArn: 'arn:{{partition}}:quicksight:{{context:qs_identity_region}}:{{account}}:vpcConnection/{{org}}-{{env}}-governance-quicksight-account-vpc-'

sharedFolders:
  redshift-analytics:
    permissions:
      - principal: Readers
        actions: 'READER_FOLDER'
      - principal: Authors
        actions: 'AUTHOR_FOLDER'