feat(aws): storage.redshift — @aws-cdk/aws-redshift-alpha port (scope-reduced)

[so0k]

Storage slice PR 10 — storage.redshift: the @aws-cdk/aws-redshift-alpha port (v2.263.0-alpha.0, scope-reduced)

Stacked on #152. Third alpha port — same disciplines as #151/#152: alpha-churn tracker on the barrel, provenance headers, TERRACONSTRUCTS DEVIATION notes at every divergence. 67 live unit tests across 5 suites.

Scope reduction (fully reversible)

The Table/User/UserPrivileges surface is backed upstream by a Custom::RedshiftDatabaseQuery Lambda custom-resource provider (executes live SQL against the cluster via the Redshift Data API). Custom-resource providers are not in this slice, so table.ts, user.ts, and the entire private/ tree (plus their 9 upstream test files) ship as fully commented-out ports headed by TODO(scope-reduction) blocks with permalinks — zero non-comment lines, ready to comment back in.

Mapping notes

• addDefaultIamRole() goes native: upstream shells out to modifyClusterIamRoles via an AwsCustomResource (no CFN property exists). aws_redshift_cluster exposes default_iam_role_arn natively — same public API and validation, no Lambda, destroy naturally clears it. Live-proven (read back via DescribeClusters.DefaultIamRoleArn).
• loggingProperties via standalone aws_redshift_logging: provider 6.x moved audit logging off the cluster resource; the port wires the S3 bucket policy exactly as upstream and emits the standalone resource.
• enableRebootForParameterChanges() omitted (commented, permalinks) — Lambda-backed custom resource.
• encrypted is string-typed in this provider binding (unlike CFN's boolean) — stringified with a deviation note.
• kms_key_id fed the key ARN (the feat(aws): storage.elasticache — elasticache-alpha port [stacked on #150] #151 id-vs-ARN lesson pre-applied), with an exact-value unit assertion.
• House patterns: generated-secret master_password double-freeze (ignore_changes), grid-lowercased identifiers on all three named resources (cluster/subnet-group/parameter-group, Token-guarded), skipFinalSnapshot/finalSnapshotIdentifier + synth warning, attach() merging dbClusterIdentifier/engine: "redshift"/host/number-typed port.
• Rotation single/multi-user carry excludeCharacters from the generated secret (documented deviation — upstream omits it).

Live integ (make redshift.cluster) — receipts in thread

Real single-node ra3.large cluster in an isolated VPC: status/node-shape/encryption read-backs, ClusterParameterGroup attachment, IAM role association + DefaultIamRoleArn read back from AWS (the native deviation), attached secret with merged connection fields, grid-lowercased identifier live, drift oracle, clean destroy.

[so0k]

Live integ receipts — make redshift.cluster (aws-vault → tcons-vincent, us-east-1) — first-attempt PASS, 257.71s

Apply complete! Resources: 14 added, 0 changed, 0 destroyed.
redshift-cluster: redshiftclustercluster72c1dbef available (ra3.large x1, encrypted, private)
redshift-cluster: parameter group redshiftclusterparams6f3d50d3 attached
redshift-cluster: default IAM role arn:aws:iam::694710432912:role/gcccccccc-cccc-reds.clusterClusterRoleb1577c618dbf2de92dc13f24a5 set natively
redshift-cluster: attached secret carries full connection details incl. dbClusterIdentifier=redshiftclustercluster72c1dbef
No changes. Your infrastructure matches the configuration.   <-- post-apply drift oracle (tofu plan -detailed-exitcode == 0)
Destroy complete! Resources: 14 destroyed.
--- PASS: TestRedshiftCluster (257.71s)

Highlights:

• DefaultIamRoleArn read back from AWS — the native default_iam_role_arn replacement for upstream's AwsCustomResource/modifyClusterIamRoles round-trip, live-proven.
• Zero-drift re-plan proves the generated-secret master_password double-freeze (the regenerating aws_secretsmanager_random_password data source is fenced by ignore_changes on both the cluster and the secret version).
• Grid-lowercased identifiers (redshiftclustercluster72c1dbef, redshiftclusterparams6f3d50d3) accepted by the provider at plan AND read back verbatim.
• Attached secret merges dbClusterIdentifier/engine: "redshift"/host/number-typed port (CFN SecretTargetAttachment parity).
• Second consecutive first-attempt pass of the slice — the accumulated defect-class pattern set (id-vs-ARN, lowercase names, double-freeze, edge-whitespace) pre-empted all known live failure modes.