feat: Add StreamWorkspace CloudFormation resource #1517

sivaram-mongodb · 2025-12-24T17:16:35Z

Proposed changes

Added new resource MongoDB::Atlas::StreamWorkspace for managing Atlas Stream Processing Workspaces.

Resource Configuration

Required Properties:

WorkspaceName: Human-readable label for the workspace
ProjectId: Atlas project identifier
DataProcessRegion: Cloud provider and region for stream processing (AWS only for CloudFormation)

Optional Properties:

StreamConfig: Configuration for stream processing capabilities
- Tier: Selected tier (SP2, SP5, SP10, SP30, SP50)
- MaxTierSize: Maximum tier size for auto-scaling (must be >= Tier)

Read-Only Properties:

Id: Unique workspace identifier
Connections: List of stream connections configured for the workspace
Hostnames: List of hostnames assigned to the workspace

Note: Resource is effectively immutable - all configurable properties are create-only.

Testing

CFN Contract Tests:

Stack Testing:

Successfully created stack using example template
Verified resource creation in Atlas UI
Confirmed stack deletion removes workspace

Jira ticket: CLOUDP-368428

Type of change:

New feature (non-breaking change which adds functionality)
This change requires a documentation update

Manual QA performed:

cfn invoke for each of CRUDL/cfn test
Updated resource in example
Published to AWS private registry
Used the template in example to create and update a stack in AWS
Deleted stack to ensure resources are deleted
Created multiple resources in same stack
Validated in Atlas UI

Required Checklist:

I have signed the MongoDB CLA
I have added tests that prove my fix is effective or that my feature works
I have checked that this change does not generate any credentials and that they are NOT accidentally logged anywhere.
I have added any necessary documentation (if appropriate)
I have run make fmt and formatted my code
For CFN Resources: I have released by changes in the private registry and proved by change works in Atlas

Screenshots

kpatel71716

Seems pretty good at a high level. I have some questions and small comments for now

kpatel71716 · 2025-12-30T06:49:48Z

cfn-resources/stream-workspace/docs/streamsconnection.md

+
+_Type_: String
+
+_Allowed Values_: <code>Kafka</code> | <code>Cluster</code> | <code>Sample</code>


[q] we have many other connection types. Should we add the connection docs and configs in a follow-up and remove all the stream connection code to simplify this PR?

removed connection docs (streamsconnection.md, streamskafkaauthentication.md, streamskafkasecurity.md) - will add in follow-up PR

kpatel71716 · 2025-12-30T06:53:18Z

cfn-resources/stream-workspace/cmd/resource/resource_test.go

+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := resource.ValidateTierComparison(tc.streamConfig)


[q] since this method is in the resource package, can we just do result := ValidateTierComparison(tc.streamConfig). Also do we need to export resource.ValidateTierComparison of can we just have validateTierComparison

exported ValidateTierComparison to resolve linter issue requiring resource_test.go to be in resource_test package. Since resource_test.go uses a separate package (resource_test) instead of resource package, these method need to be exported to be accessible in test cases. This follows the same pattern used in other resources like project and search-index.

kpatel71716 · 2025-12-30T06:54:07Z

cfn-resources/stream-workspace/cmd/resource/resource.go

+
+// GetTierValue returns a numeric value for tier comparison
+// SP2 < SP5 < SP10 < SP30 < SP50
+func GetTierValue(tier string) int {


[nit] does this method need to be exported? can we just have getTierValue? Same goes for the other methods in this package

exported GetTierValue and other methods to resolve linter issue requiring resource_test.go to be in resource_test package. Since resource_test.go uses a separate package (resource_test) instead of resource package, these functions need to be exported to be accessible in test cases. This follows the same pattern used in other resources like project and search-index.

That's fine. I was thinking that we could have the tests be in the resource package as well instead of their own package but not a blocker from me

kpatel71716 · 2025-12-30T06:56:47Z

cfn-resources/stream-workspace/cmd/resource/mappings_test.go

+	cloudProvider    = "AWS"
+	region           = "VIRGINIA_USA"
+	tier             = "SP30"
+	maxTierSize      = "100"


[minor] This should be a valid tier value to prevent confusion (even though this will be validated downstream in the api server code)

Fixed - changed maxTierSize from "100" to "SP50" to use a valid tier value.

kpatel71716 · 2025-12-30T07:02:42Z

cfn-resources/stream-workspace/cmd/resource/resource.go

+	}, nil
+}
+
+// Update is not supported for StreamWorkspace as all configurable properties are create-only.


just an fyi that update support wis on the roadmap to be supported soon (we support it unofficially in our apis, but it is hidden from the documentation as we test and communicate this to our blocked customers). No action needed for now but worth mentioning

@kpatel71716 is there a timeline on when we want to officially support Update? I believe we do support/expose it in our Terraform provider right?

I would estimate this will be publicly available in around a month. Terraform is a bit different as it actually destroys and recreates the workspace to update it (which I understand is a bit confusing)

maastha · 2026-01-05T13:16:45Z

cfn-resources/stream-workspace/cmd/resource/mappings.go

+	return NewStreamsTenant(model)
+}
+
+// NewStreamsTenant maps CFN model to Atlas API StreamsTenant (kept for backward compatibility)


can you elaborate on "(kept for backward compatibility)"?

Removed the vague backward compatibility comment; the function NewStreamWorkspaceCreateReq is the standard mapping function with no legacy dependencies

maastha · 2026-01-05T13:18:35Z

cfn-resources/stream-workspace/cmd/resource/mappings.go

+			Name: connection.Name,
+			Type: connection.Type,
+		}
+		if connection.GetType() == "Kafka" {


can we make "Kafka" & "Cluster" constants & reuse here & in tests?

replaced string literals with the existing Kafka and Cluster constants and updated tests to use them.

maastha · 2026-01-05T13:19:45Z

cfn-resources/stream-workspace/cmd/resource/mappings_test.go

@@ -0,0 +1,190 @@
+// Copyright 2024 MongoDB Inc


Copyright year updated to 2026.

maastha · 2026-01-05T13:21:46Z

cfn-resources/stream-workspace/cmd/resource/resource.go

+	}
+
+	// Validate tier comparison: MaxTierSize must not be less than Tier
+	if errEvent := ValidateTierComparison(currentModel.StreamConfig); errEvent != nil {


[q] does the API validate this as well?

Removed the tier comparison validation; the API enforces that MaxTierSize must not be less than Tier.

maastha · 2026-01-05T13:24:11Z

cfn-resources/stream-workspace/cmd/resource/resource.go

+		return handleError(resp, constants.CREATE, err)
+	}
+
+	currentModel.Id = createdStreamWorkspace.Id


instead of only updating the id in currentModel, why don't we re-build it from createdStreamWorkspace completely using GetStreamWorkspaceModel?

Updated to rebuild the complete model using GetStreamWorkspaceModel instead of only updating the Id field.

maastha · 2026-01-05T13:25:35Z

cfn-resources/stream-workspace/cmd/resource/mappings.go

+}
+
+// GetStreamWorkspaceModel maps API response to CFN model, preserving primary identifier fields from currentModel
+func GetStreamWorkspaceModel(streamTenant *admin.StreamsTenant, currentModel *Model) *Model {


which "primary identifier fields" are being referred to here?

Removed the vague comment

maastha · 2026-01-05T13:32:16Z

cfn-resources/stream-workspace/cmd/resource/resource.go

+// Update is not supported for StreamWorkspace as all configurable properties are create-only.
+// All properties (WorkspaceName, ProjectId, Profile, StreamConfig, DataProcessRegion) are in createOnlyProperties,
+// which means CloudFormation will require resource replacement for any changes.
+// Since the resource has a custom name (WorkspaceName), CloudFormation cannot perform replacement.


"Since the resource has a custom name (WorkspaceName), CloudFormation cannot perform replacement." found this a bit confusing

Removed the confusing comment; the Update function is implemented and updates DataProcessRegion.Region, while other properties remain create-only per the schema.

maastha · 2026-01-05T13:34:31Z

cfn-resources/stream-workspace/cmd/resource/resource.go

+	}
+
+	// Validate tier comparison: MaxTierSize must not be less than Tier
+	if errEvent := ValidateTierComparison(currentModel.StreamConfig); errEvent != nil {


can Tier be updated? IIUC then no right? since the object is immutable & StreamConfig is createOnly.
Do we still need this validation here?

Removed the tier comparison validation from Update

maastha · 2026-01-05T13:36:13Z

cfn-resources/stream-workspace/cmd/resource/resource.go

+		return handleError(resp, constants.UPDATE, err)
+	}
+
+	// Resource exists but is immutable - return current state (no-op update)


can we add a log here that an update isn't actually supported & we're just returning the current state?

Update function now performs actual updates (DataProcessRegion.Region); removed the immutable comment since updates are supported.

kpatel71716 · 2026-01-08T08:24:43Z

cfn-resources/stream-workspace/mongodb-atlas-streamworkspace.json

+      "type": "object",
+      "description": "Configuration options for an Atlas Stream Processing Workspace.",
+      "properties": {
+        "Tier": {


[q] is it difficult to to make the Tier property required here? Does doing so break any automated schema generation? If so, then no action needed

Marking Tier as required should be straightforward. The Atlas SDK defines Tier as optional (json:"tier,omitempty"), so this adds CloudFormation schema-level validation. No code changes needed.

kpatel71716

this looks good at a high level from another pass. I'll tag someone on my team as well to take a look and we'll give it another pass to make sure we don't miss anything

jwongmongodb · 2026-01-09T14:12:38Z

this looks good at a high level from another pass. I'll tag someone on my team as well to take a look and we'll give it another pass to make sure we don't miss anything

I'll take a look EOD today or early monday morning.

maastha · 2026-01-09T15:43:08Z

cfn-resources/stream-workspace/cmd/resource/resource_test.go

+	"go.mongodb.org/atlas-sdk/v20250312010/mockadmin"
+)
+
+func createTestStreamWorkspaceModel() *resource.Model {


@sivaram-mongodb could have a look at the recent guidelines shared on Slack & revisit this PR once?
Do all these tests actually add any value?

Also can you update the screenshots in the description to include all CRUD operations?

Removed this resource_test.go

jwongmongodb · 2026-01-13T01:59:47Z

cfn-resources/stream-workspace/cmd/resource/mappings.go

+			Name: connection.Name,
+			Type: connection.Type,
+		}
+		if connection.GetType() == Kafka {


[q] do we only support two connection types for cloudformation (kafka and cluster?)

This is also removed.

jwongmongodb · 2026-01-13T02:01:04Z

cfn-resources/stream-workspace/cmd/resource/mappings.go

+	}
+}
+
+func NewModelConnections(streamConfig *[]admin.StreamsConnection) []StreamsConnection {


[q] should this be called streamConnections instead of streamConfig? We already have another function above for streamConfig which can be confusing.

func newModelStreamConfig(streamConfig *admin.StreamConfig) *StreamConfig {

removed the stream connections references since this is a stream workspace resource

jwongmongodb · 2026-01-13T02:04:44Z

cfn-resources/stream-workspace/cmd/resource/model.go

+	DataProcessRegion *StreamsDataProcessRegion `json:",omitempty"`
+	StreamConfig      *StreamConfig             `json:",omitempty"`
+	Id                *string                   `json:",omitempty"`
+	Connections       []StreamsConnection       `json:",omitempty"`


[q] for terraform, we have connections as its own resource, in cloudformation, do we include other resources in the workspace model like this vs as a separate resource model?

Connections is being removed from this code.

…m-Workspace

…pace

maastha · 2026-01-15T20:43:51Z

cfn-resources/stream-workspace/mongodb-atlas-streamworkspace.json

+          "type": "string",
+          "description": "Selected tier for the Stream Workspace. Configures Memory / VCPU allowances.",
+          "title": "Stream Workspace Tier",
+          "enum": ["SP2", "SP5", "SP10", "SP30", "SP50"]


can we remove the enum values here and below for maxTierSize and instead include those in the field description?

maastha · 2026-01-15T20:48:24Z

examples/atlas-streams/stream-workspace/README.md

+- **AWS Only**: This CloudFormation resource is designed for AWS deployments. The CloudProvider parameter is constrained to "AWS" only.
+- **Create-Only Properties**: `WorkspaceName`, `ProjectId`, and `Profile` are create-only properties. To change these, you must delete and recreate the stack.
+- **Updateable Properties**: `StreamConfig.Tier` and `StreamConfig.MaxTierSize` can be updated after creation.
+- **Read-Only Properties**: `Id`, `Hostnames`, and `Connections` are read-only and returned by CloudFormation but cannot be set.


is connections still applicable?

maastha · 2026-01-15T20:49:08Z

examples/atlas-streams/stream-workspace/README.md

+- `MaxTierSize`: SP50
+- `Profile`: default
+
+## Notes


I think we can remove this section. It may be better to include in the field description itself instead

maastha · 2026-01-15T20:50:22Z

examples/atlas-streams/stream-workspace/README.md

+
+- Verify Atlas API keys are correctly stored in AWS Secrets Manager
+- Check CloudWatch logs for handler execution errors
+- Ensure the resource type is registered in your private registry


I dont believe this is a requirement for users as long as they have the extension activated in their account

maastha · 2026-01-15T20:55:42Z

examples/atlas-streams/stream-workspace/README.md

+- Ensure the resource type is registered in your private registry
+- Verify your IP address is on the Atlas IP Access List
+
+**Workspace Not Found in Atlas:**


Can you explain why do we need this? does it happen very often?

maastha · 2026-01-16T22:14:32Z

@sivaram-mongodb @ParthasarathyV can we also have these contract tests run in Github CI?

sivaram-mongodb requested a review from a team as a code owner December 24, 2025 17:16

sivaram-mongodb force-pushed the CLOUDP-368426-Stream-Workspace branch from a46c35f to 38ccb32 Compare December 26, 2025 14:55

kpatel71716 reviewed Dec 30, 2025

View reviewed changes

ParthasarathyV changed the title ~~feat: Add StreamWorkspace ClooudFormation resource~~ feat: Add StreamWorkspace CloudFormation resource Dec 31, 2025

sivaram-mongodb force-pushed the CLOUDP-368426-Stream-Workspace branch from 38ccb32 to 003592f Compare January 2, 2026 06:54

sivaram-mongodb requested a review from kpatel71716 January 2, 2026 07:05

maastha reviewed Jan 5, 2026

View reviewed changes

sivaram-mongodb force-pushed the CLOUDP-368426-Stream-Workspace branch 3 times, most recently from be161ea to 8aee0e6 Compare January 7, 2026 12:55

kpatel71716 reviewed Jan 8, 2026

View reviewed changes

sivaram-mongodb force-pushed the CLOUDP-368426-Stream-Workspace branch from 8aee0e6 to 9aa4e50 Compare January 8, 2026 16:01

maastha reviewed Jan 9, 2026

View reviewed changes

sivaram-mongodb force-pushed the CLOUDP-368426-Stream-Workspace branch from 9aa4e50 to 018f1a6 Compare January 12, 2026 14:44

feat: Add StreamWorkspace ClooudFormation resource

82de04d

sivaram-mongodb force-pushed the CLOUDP-368426-Stream-Workspace branch from 018f1a6 to 82de04d Compare January 12, 2026 15:15

jwongmongodb reviewed Jan 13, 2026

View reviewed changes

sivaram-mongodb marked this pull request as draft January 14, 2026 05:59

ParthasarathyV added 9 commits January 14, 2026 15:05

CLOUDP-368426-Stream-Workspace Testig Region Update

9eba65d

Merge remote-tracking branch 'origin/master' into CLOUDP-368426-Strea…

4cd9802

…m-Workspace

CLOUDP-368426-Stream-Workspace latest version update

42ca5af

CLOUDP-368426-Stream-Workspace Delete resource_test.go

e3a8c9e

CLOUDP-368426-Stream-Workspace Removing Connections from stream works…

013d2ce

…pace

CLOUDP-368426-Stream-Workspace remove bin file

04654b4

CLOUDP-368426-Stream-Workspace Lint fix

fa3433c

CLOUDP-368426-Stream-Workspace error codes standard

ea07f4b

CLOUDP-368426-Stream-Workspace Copyright addition

6e53b2e

ParthasarathyV marked this pull request as ready for review January 15, 2026 15:51

maastha reviewed Jan 15, 2026

View reviewed changes

CLOUDP-368426-Stream-Workspace Review comments

8479e75

maastha approved these changes Jan 16, 2026

View reviewed changes

rakhul-mongo force-pushed the CLOUDP-368426-Stream-Workspace branch from 389a5e5 to 7f9571d Compare January 19, 2026 14:53

Add workflow for cfn test

0972221

rakhul-mongo force-pushed the CLOUDP-368426-Stream-Workspace branch from 7f9571d to 0972221 Compare January 19, 2026 17:49

Merge branch 'master' into CLOUDP-368426-Stream-Workspace

08452de

ParthasarathyV added this pull request to the merge queue Jan 20, 2026

Merged via the queue into master with commit 37d949a Jan 20, 2026
40 checks passed

ParthasarathyV deleted the CLOUDP-368426-Stream-Workspace branch January 20, 2026 03:01


		_Type_: String

		_Allowed Values_: <code>Kafka</code> \| <code>Cluster</code> \| <code>Sample</code>

feat: Add StreamWorkspace CloudFormation resource #1517

feat: Add StreamWorkspace CloudFormation resource #1517

Uh oh!

Conversation

sivaram-mongodb commented Dec 24, 2025 • edited by ParthasarathyV Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed changes

Resource Configuration

Testing

Type of change:

Manual QA performed:

Required Checklist:

Screenshots

Uh oh!

kpatel71716 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

maastha Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

sivaram-mongodb commented Dec 24, 2025 •

edited by ParthasarathyV

Loading

maastha Jan 5, 2026 •

edited

Loading

maastha Jan 9, 2026 •

edited

Loading