Fix IAM permissions to query Redshift dev database via Data API.

sureshc · sureshc · commit e8770add2a81 · 2026-06-17T11:38:44.000-07:00
diff --git a/aws/cloudformation/cloud_formation_stack.yml.erb b/aws/cloudformation/cloud_formation_stack.yml.erb
@@ -535,12 +535,18 @@ Resources:
                   - !Sub
                     - "arn:aws:redshift:${AWS::Region}:${AWS::AccountId}:dbuser:${ClusterNamespace}/etl_client"
                     - ClusterNamespace: !ImportValue "DATA-production-RedshiftClusterIdentifier"
+                  # Legacy Database Migration Service exports Learning Platform tables to the `dashboard` database.
                   - !Sub
                     - "arn:aws:redshift:${AWS::Region}:${AWS::AccountId}:dbname:${ClusterNamespace}/dashboard"
                     - ClusterNamespace: !ImportValue "DATA-production-RedshiftClusterIdentifier"
+                  # Zero ETL exports Learning Platform tables to the `[environment type]_learningplatform_mysql_zeroetl` database.
                   - !Sub
                     - "arn:aws:redshift:${AWS::Region}:${AWS::AccountId}:dbname:${ClusterNamespace}/<%=rack_env%>_learningplatform_mysql_zeroetl"
                     - ClusterNamespace: !ImportValue "DATA-production-RedshiftClusterIdentifier"
+                  # We provision Materialized Views on Zero ETL tables in the `dev` database.
+                  - !Sub
+                    - "arn:aws:redshift:${AWS::Region}:${AWS::AccountId}:dbname:${ClusterNamespace}/dev"
+                    - ClusterNamespace: !ImportValue "DATA-production-RedshiftClusterIdentifier"
 <% end -%>
 <% if rack_env?(:production) -%>
         - PolicyName: StopInactiveAdhocInstances
