Parameters:
  DataZoneDomainName:
    Description: Amazon DataZone domain name
    Type: String
    Default: AWSome-Retail-Company
  DatabaseName:
    Description: The name of the first database in the Amazon Redshift Serverless environment.
    Type: String
    Default: dev
    MaxLength: 127
    AllowedPattern: '[a-zA-Z][a-zA-Z_0-9+.@-]*'
  AdminUsername:
    Description: The administrator's user name for Redshift Serverless Namespace being created.
    Type: String
    Default: admin
    AllowedPattern: '[a-zA-Z][a-zA-Z_0-9+.@-]*'
  AdminUserPassword:
    Description: The password associated with admin user. Take note of what you set here
    Type: String
    NoEcho: 'true'
    MinLength: 8
    MaxLength: 64
    AllowedPattern: '^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[^\x00-\x20\x22\x27\x2f\x40\x5c\x7f-\uffff]+'
  NamespaceName:
    Description: A unique identifier that defines the Namespace.
    Type: String
    MinLength: 3
    MaxLength: 64
    Default: sales-namespace
    AllowedPattern: '^[a-z0-9-]+$'
  WorkgroupName:
    Description: A unique identifier that defines the Workspace.
    Type: String
    MinLength: 3
    MaxLength: 64
    Default: sales-workgroup
    AllowedPattern: '^[a-z0-9-]*$'
  BaseRPU:
    Description: Base RPU for Redshift Serverless Workgroup.
    Type: Number
    MinValue: 32
    MaxValue: 128
    Default: 128
    AllowedValues: [32,40,48,56,64,72,80,88,96,104,112,120,128,136,144,152,160,168,176,184,192,200,208,216,224,232,240,248,256,264,272,280,288,296,304,312,320,328,336,344,352,360,368,376,384,392,400,408,416,424,432,440,448,456,464,472,480,488,496,504,512]
  EnhancedVpcRouting:
    Description: The value that specifies whether to enable enhanced virtual private cloud (VPC) routing, which forces Amazon Redshift Serverless to route traffic through your VPC.
    Type: String
    AllowedValues:
      - true
      - false
    Default: false
  LogExportsList:
    Description: Provide comma seperate values from list "userlog","connectionlog","useractivitylog".  E.g userlog,connectionlog,useractivitylog.  If left blank, LogExport is turned off.
    Type: CommaDelimitedList 
    Default: userlog,connectionlog,useractivitylog
Metadata:
  'AWS::CloudFormation::Interface':
    ParameterGroups:
      - Label:
          default: Amazon DataZone parameters
        Parameters:
          - DataZoneDomainName         
      - Label:
          default: Amazon Redshift Serverless parameters
        Parameters:
            - NamespaceName
            - WorkgroupName
            - DatabaseName
            - AdminUsername
            - AdminUserPassword
            - BaseRPU
            - SubnetId
            - SecurityGroupIds
            - EnhancedVpcRouting
            - LogExportsList
Resources:
  datazoneexecutionroleA8D05138:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
              - sts:TagSession
            Effect: Allow
            Principal:
              Service: datazone.amazonaws.com
        Version: "2012-10-17"
      ManagedPolicyArns:
        - Fn::Join:
            - ""
            - - "arn:"
              - Ref: AWS::Partition
              - :iam::aws:policy/service-role/AmazonDataZoneDomainExecutionRolePolicy
        - Fn::Join:
            - ""
            - - "arn:"
              - Ref: AWS::Partition
              - :iam::aws:policy/IAMReadOnlyAccess
  datazonedomain:
    Type: AWS::DataZone::Domain
    Properties:
      Description: Amazon DataZone domain used for a blog sample use-case for Redshift Enancements
      DomainExecutionRole:
        Fn::GetAtt:
          - datazoneexecutionroleA8D05138
          - Arn
      Name: 
        Ref: DataZoneDomainName
  salesprj:
    Type: AWS::DataZone::Project
    Properties:
      Description: Producer project managed by the Sales team
      DomainIdentifier:
        Ref: datazonedomain
      Name: SalesPRJ
  marketingprj:
    Type: AWS::DataZone::Project
    Properties:
      Description: Consumer project managed by the Marketing team
      DomainIdentifier:
        Ref: datazonedomain
      Name: MarketingPRJ
  adminprj:
    Type: AWS::DataZone::Project
    Properties:
      Description: Admin project
      DomainIdentifier:
        Ref: datazonedomain
      Name: AdminPRJ
  datazoneaccessroleF4506F82:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: datazone.amazonaws.com
        Version: "2012-10-17"
      ManagedPolicyArns:
        - Fn::Join:
            - ""
            - - "arn:"
              - Ref: AWS::Partition
              - :iam::aws:policy/service-role/AmazonDataZoneGlueManageAccessRolePolicy
        - Fn::Join:
            - ""
            - - "arn:"
              - Ref: AWS::Partition
              - :iam::aws:policy/service-role/AmazonDataZoneRedshiftManageAccessRolePolicy
      Policies:
        - PolicyName: MyCustomDataZoneDataPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - 'secretsmanager:GetSecretValue'
                Resource: !Sub 'arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:AmazonDataZone-*'            
  datazoneprovisioningroleE2AAC33A:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: datazone.amazonaws.com
        Version: "2012-10-17"
      ManagedPolicyArns:
        - Fn::Join:
            - ""
            - - "arn:"
              - Ref: AWS::Partition
              - :iam::aws:policy/AmazonDataZoneRedshiftGlueProvisioningPolicy
  datazoneblueprintconfiguration:
    Type: AWS::DataZone::EnvironmentBlueprintConfiguration
    Properties:
      DomainIdentifier:
        Ref: datazonedomain
      EnabledRegions:
        - Ref: AWS::Region
      EnvironmentBlueprintIdentifier: DefaultDataWarehouse
      ManageAccessRoleArn:
        Fn::GetAtt:
          - datazoneaccessroleF4506F82
          - Arn
      ProvisioningRoleArn:
        Fn::GetAtt:
          - datazoneprovisioningroleE2AAC33A
          - Arn
  RedshiftServerlessNamespace:
    Type: 'AWS::RedshiftServerless::Namespace'
    Properties:
      AdminUsername:
        Ref: AdminUsername
      AdminUserPassword:
        Ref: AdminUserPassword
      DbName:
        Ref: DatabaseName
      NamespaceName:
        Ref: NamespaceName   
      LogExports:
        Ref: LogExportsList    
  RedshiftServerlessWorkgroup:
    Type: 'AWS::RedshiftServerless::Workgroup'
    Properties:
      WorkgroupName:
        Ref: WorkgroupName
      NamespaceName:
        Ref: NamespaceName
      BaseCapacity:
        Ref: BaseRPU
      PubliclyAccessible: false
      EnhancedVpcRouting:
        Ref: EnhancedVpcRouting
      ConfigParameters:
        - ParameterKey: enable_user_activity_logging
          ParameterValue: 'true'
        - ParameterKey: require_ssl
          ParameterValue: 'true'        
    DependsOn:
      - RedshiftServerlessNamespace
Outputs:
  datazoneportal:
    Value:
      Fn::GetAtt:
        - datazonedomain
        - PortalUrl
    Description: Amazon DataZone portal URL
    Export:
      Name: datazone-portal-url
  NamespaceName:
    Value: !Ref RedshiftServerlessNamespace
    Description: The name of the Redshift Serverless namespace
  WorkgroupName: 
    Value: !Ref RedshiftServerlessWorkgroup
    Description: The name of the Redshift Serverless workgroup 