Add support for managing Redshift Roles

[dimitris4000]

Add support for managing Redshift Roles.

More specifically we should be able to use the provider to:

1. Create new role
2. Alter/Rename an existing role
3. Granting/Revoking permissions from an existing role
4. Drop a role
5. (optional) Besides managing roles, this provider should be able to "detect" role usages by other TF managed (this provider only) resources - like users, groups, etc. -.
6. (optional) total control of roles creation in the system (i.e. when a role is created outside Redshift, terraform plan should show diffs. (the end user should be able to enable/disable this feature)

[dimitris4000]

Not sure if new feature requests are acceptable here, but if they are I could also possible help with the implementation of this one.

[StevenKGER]

@dimitris4000 Thank you for this feature request! Feel free to help with the implementation and create a PR. :)
If you need any support/review, assign the PR to @mmichaelb or me

Regarding point 6 I'd personally prefer not to have this kind of "total control of roles" since every roll will probably be an independent resource and therefore should be actively imported by the user (like the AWS provider doesn't automatically every DB instance of a RDS DB cluster afaik) - what do you think @mmichaelb?

[mmichaelb]

@dimitris4000 Thanks again for opening this issue! I'll try to address the aspects of this feature request separately and give my opinion on them.

1. Create new role

Could be covered by implementing a redshift_role-resource

2. Alter/Rename an existing role

Covered by implementing a redshift_role-resource (import existing role, update name)

3. Granting/Revoking permissions from an existing role

I guess this could be achieved by extending the existing redshift_grant-resource

4. Drop a role

Covered by implementing a redshift_role-resource

5. (optional) Besides managing roles, this provider should be able to "detect" role usages by other TF managed (this provider only) resources - like users, groups, etc. -.

I do not really get this aspect. At the present stage, this provider should not directly interfere with other resources deployed on the redshift. How do you imagine "detecting" the role usage?

6. (optional) total control of roles creation in the system (i.e. when a role is created outside Redshift, terraform plan should show diffs. (the end user should be able to enable/disable this feature)

Personally, I do like this idea because it enables the user to follow an "Database Structure as Code"-approach. Manually deployed resources would therefore also be deleted. But I'm afraid that this feature would be tricky to implement. AFAIK There are several AWS-owned users/groups/roles which should be excluded when enabling "total control roles". Moreover, we somehow always have to gather all other resources and create a diff between the declared terraform resources and the resources provisioned on the Redshift.

---

TLDR: I do welcome this feature request as role-based access control is a broadly used feature for fine-grained access control. Following your proposal, I would also recommend implementing the Role-Resource and Grants first and leaving aspects 5 and 6 aside for the time being.

[dimitris4000]

@mmichaelb Thanks for the quick responses. That's great news! I'll start working on implementing the PR for 1-4.

For the sake of completeness, regarding point 5:

I do not really get this aspect. At the present stage, this provider should not directly interfere with other resources deployed on the redshift. How do you imagine "detecting" the role usage?

I do not have a "complete" design in my mind yet, but the overarching idea is that the provider currently defines resources that correlate with roles (i.e.redshift_grant which is also the SQL command used to configure role permissions, redshift_user and redshift_group which are "granted" specific roles). So,
a) if an existing (in terraform code/state) user/group is granted a specific role (also in TF code/sate), this correlation should somehow be reflected in TF plans and b) the redshift_grant resource should/could somehow be refactored to be also usable with roles.