Skip to content

Commit ecd4696

Browse files
author
bbrauneck
committed
feat: initial module resources
1 parent 58cc3e2 commit ecd4696

File tree

7 files changed

+198
-7
lines changed

7 files changed

+198
-7
lines changed

‎.github/workflows/megalinter.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323
VALIDATE_ALL_CODEBASE: true
2424
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
2525
DISABLE: COPYPASTE,SPELL
26-
DISABLE_LINTERS: TERRAFORM_TERRASCAN
26+
DISABLE_LINTERS: TERRAFORM_TERRASCAN, TERRAFORM_CHECKOV
2727
- name: Archive production artifacts
2828
if: ${{ success() }} || ${{ failure() }}
2929
uses: actions/upload-artifact@v2

‎.pre-commit-config.yaml

-3
Original file line numberDiff line numberDiff line change
@@ -36,14 +36,11 @@ repos:
3636
hooks:
3737
- id: terraform_fmt
3838
- id: terraform_tflint
39-
args:
40-
- --args=--enable-plugin=aws
4139
- id: terraform_docs
4240
args:
4341
- --hook-config=--path-to-file=README.md
4442
- --hook-config=--add-to-existing-file=true
4543
- --hook-config=--create-file-if-not-exist=true
46-
- id: terraform_tfsec
4744
- repo: https://github.com/Checkmarx/kics
4845
rev: v1.5.4
4946
hooks:

‎README.md

+29-3
Original file line numberDiff line numberDiff line change
@@ -109,27 +109,53 @@ Please be aware that this is mainly a copy operation which means all your curren
109109

110110
## Providers
111111

112-
No providers.
112+
| Name | Version |
113+
|------|---------|
114+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.8.0 |
115+
| <a name="provider_random"></a> [random](#provider\_random) | n/a |
113116

114117
## Modules
115118

116-
No modules.
119+
| Name | Source | Version |
120+
|------|--------|---------|
121+
| <a name="module_this_label"></a> [this\_label](#module\_this\_label) | git::github.com/xoap-io/terraform-aws-misc-label | v0.1.0 |
122+
| <a name="module_this_label_snapshot"></a> [this\_label\_snapshot](#module\_this\_label\_snapshot) | git::github.com/xoap-io/terraform-aws-misc-label | v0.1.0 |
117123

118124
## Resources
119125

120-
No resources.
126+
| Name | Type |
127+
|------|------|
128+
| [aws_db_instance.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance) | resource |
129+
| [aws_db_option_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_option_group) | resource |
130+
| [aws_db_parameter_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_parameter_group) | resource |
131+
| [aws_db_subnet_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_subnet_group) | resource |
132+
| [random_password.this](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) | resource |
133+
| [random_string.this_snapshot](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
121134

122135
## Inputs
123136

124137
| Name | Description | Type | Default | Required |
125138
|------|-------------|------|---------|:--------:|
139+
| <a name="input_backup"></a> [backup](#input\_backup) | The backup configuration for the RDS instance | <pre>object({<br> enabled = bool<br> retention_days = number<br> })</pre> | n/a | yes |
126140
| <a name="input_context"></a> [context](#input\_context) | Default context for naming and tagging purpose | <pre>object({<br> organization = string<br> environment = string<br> account = string<br> product = string<br> tags = map(string)<br> })</pre> | n/a | yes |
141+
| <a name="input_enable_performance_insights"></a> [enable\_performance\_insights](#input\_enable\_performance\_insights) | Whether to enable Performance Insights | `bool` | n/a | yes |
142+
| <a name="input_instance"></a> [instance](#input\_instance) | The RDS instance to create | <pre>object({<br> type = string<br> engine = string<br> engine_version = string<br> major_engine_version = string<br> family = string<br> multi_az = bool<br> publicly_accessible = bool<br> deletion_protection = bool<br> allow_upgrades = bool<br> port = number<br> })</pre> | n/a | yes |
143+
| <a name="input_logging"></a> [logging](#input\_logging) | The logging configuration for the RDS instance | <pre>object({<br> enabled = bool<br> types = set(string)<br> })</pre> | n/a | yes |
144+
| <a name="input_name"></a> [name](#input\_name) | The name of the RDS instance | `string` | n/a | yes |
145+
| <a name="input_parameters"></a> [parameters](#input\_parameters) | The parameters to pass to the RDS instance | `map(string)` | n/a | yes |
146+
| <a name="input_storage"></a> [storage](#input\_storage) | The storage configuration for the RDS instance | <pre>object({<br> max_allocated_storage = number<br> allocated_storage = number<br> kms_arn = string<br> })</pre> | n/a | yes |
147+
| <a name="input_vpc"></a> [vpc](#input\_vpc) | The VPC to create the RDS instance in | <pre>object({<br> id = string<br> subnets = list(string)<br> security_groups = list(string)<br> })</pre> | n/a | yes |
127148

128149
## Outputs
129150

130151
| Name | Description |
131152
|------|-------------|
153+
| <a name="output_auth"></a> [auth](#output\_auth) | Exported auth information for passing between modules |
132154
| <a name="output_context"></a> [context](#output\_context) | Exported context from input variable |
155+
| <a name="output_db_instance"></a> [db\_instance](#output\_db\_instance) | Exported output from aws\_db\_instance |
156+
| <a name="output_option_group"></a> [option\_group](#output\_option\_group) | Exported output from aws\_db\_option\_group |
157+
| <a name="output_parameter_group"></a> [parameter\_group](#output\_parameter\_group) | Exported output from aws\_db\_parameter\_group |
158+
| <a name="output_subnet_group"></a> [subnet\_group](#output\_subnet\_group) | Exported output from aws\_db\_subnet\_group |
133159
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
134160
<!-- markdownlint-disable -->
135161
<!-- prettier-ignore-end -->

‎kics.config

+1
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ exclude-paths:
44
- "*/.terraform"
55
exclude-queries:
66
- e592a0c5-5bdb-414c-9066-5dba7cdea370 #IAM Access Analyzer Undefined - always disable
7+
- 35113e6f-2c6b-414d-beec-7a9482d3b2d1 #AWS DB instance public accessible
78
fail-on:
89
- high
910
- medium

‎main.tf

+85
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
locals {
2+
admin_user = "installer"
3+
}
4+
module "this_label" {
5+
source = "git::github.com/xoap-io/terraform-aws-misc-label?ref=v0.1.0"
6+
context = var.context
7+
attributes = [var.instance.engine, var.name]
8+
}
9+
resource "random_string" "this_snapshot" {
10+
length = 5
11+
special = false
12+
}
13+
module "this_label_snapshot" {
14+
source = "git::github.com/xoap-io/terraform-aws-misc-label?ref=v0.1.0"
15+
context = var.context
16+
attributes = ["snapshot", var.instance.engine, var.name, random_string.this_snapshot.result]
17+
}
18+
resource "random_password" "this" {
19+
length = 32
20+
}
21+
resource "aws_db_subnet_group" "this" {
22+
name = module.this_label.id
23+
description = "Subnet group for RDS instance ${module.this_label.id}"
24+
subnet_ids = var.vpc.subnets
25+
}
26+
resource "aws_db_parameter_group" "this" {
27+
name = module.this_label.id
28+
description = "Parameter group for RDS instance ${module.this_label.id}"
29+
family = var.instance.family
30+
31+
dynamic "parameter" {
32+
for_each = var.parameters
33+
content {
34+
name = parameter.key
35+
value = parameter.value
36+
}
37+
}
38+
lifecycle {
39+
create_before_destroy = true
40+
}
41+
}
42+
resource "aws_db_option_group" "this" {
43+
name = module.this_label.id
44+
option_group_description = "Parameter group for RDS instance ${module.this_label.id}"
45+
46+
engine_name = var.instance.engine
47+
major_engine_version = var.instance.major_engine_version
48+
lifecycle {
49+
create_before_destroy = true
50+
}
51+
}
52+
resource "aws_db_instance" "this" {
53+
engine = var.instance.engine
54+
engine_version = var.instance.engine_version
55+
instance_class = var.instance.type
56+
identifier = module.this_label.id
57+
username = local.admin_user
58+
password = random_password.this.result
59+
skip_final_snapshot = false
60+
allocated_storage = var.storage.allocated_storage
61+
max_allocated_storage = var.storage.max_allocated_storage
62+
storage_encrypted = var.storage.kms_arn != ""
63+
kms_key_id = var.storage.kms_arn
64+
final_snapshot_identifier = module.this_label_snapshot.id
65+
multi_az = var.instance.multi_az
66+
publicly_accessible = var.instance.publicly_accessible
67+
deletion_protection = var.instance.deletion_protection
68+
auto_minor_version_upgrade = var.instance.allow_upgrades
69+
allow_major_version_upgrade = true
70+
db_subnet_group_name = aws_db_subnet_group.this.id
71+
parameter_group_name = aws_db_parameter_group.this.id
72+
option_group_name = aws_db_option_group.this.id
73+
maintenance_window = var.backup.enabled == true ? "Mon:00:00-Mon:03:00" : null
74+
backup_window = var.backup.enabled == true ? "03:00-06:00" : null
75+
backup_retention_period = var.backup.enabled == true ? var.backup.retention_days : 0
76+
vpc_security_group_ids = var.vpc.security_groups
77+
performance_insights_enabled = var.enable_performance_insights
78+
apply_immediately = true
79+
iam_database_authentication_enabled = true
80+
enabled_cloudwatch_logs_exports = var.logging.types
81+
tags = {
82+
Name = module.this_label.id
83+
Restriction = "Restricted"
84+
}
85+
}

‎outputs.tf

+25
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,28 @@ output "context" {
22
value = var.context
33
description = "Exported context from input variable"
44
}
5+
output "db_instance" {
6+
value = aws_db_instance.this
7+
description = "Exported output from aws_db_instance"
8+
}
9+
output "option_group" {
10+
value = aws_db_option_group.this
11+
description = "Exported output from aws_db_option_group"
12+
}
13+
output "parameter_group" {
14+
value = aws_db_parameter_group.this
15+
description = "Exported output from aws_db_parameter_group"
16+
}
17+
output "subnet_group" {
18+
value = aws_db_subnet_group.this
19+
description = "Exported output from aws_db_subnet_group"
20+
}
21+
output "auth" {
22+
value = {
23+
host = aws_db_instance.this.endpoint
24+
port = aws_db_instance.this.port
25+
username = aws_db_instance.this.username
26+
password = aws_db_instance.this.password
27+
}
28+
description = "Exported auth information for passing between modules"
29+
}

‎variables.tf

+57
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,60 @@
1+
variable "name" {
2+
type = string
3+
description = "The name of the RDS instance"
4+
}
5+
variable "vpc" {
6+
type = object({
7+
id = string
8+
subnets = list(string)
9+
security_groups = list(string)
10+
})
11+
description = "The VPC to create the RDS instance in"
12+
}
13+
variable "instance" {
14+
type = object({
15+
type = string
16+
engine = string
17+
engine_version = string
18+
major_engine_version = string
19+
family = string
20+
multi_az = bool
21+
publicly_accessible = bool
22+
deletion_protection = bool
23+
allow_upgrades = bool
24+
port = number
25+
})
26+
description = "The RDS instance to create"
27+
}
28+
variable "storage" {
29+
type = object({
30+
max_allocated_storage = number
31+
allocated_storage = number
32+
kms_arn = string
33+
})
34+
description = "The storage configuration for the RDS instance"
35+
}
36+
variable "backup" {
37+
type = object({
38+
enabled = bool
39+
retention_days = number
40+
})
41+
description = "The backup configuration for the RDS instance"
42+
}
43+
variable "logging" {
44+
type = object({
45+
enabled = bool
46+
types = set(string)
47+
})
48+
description = "The logging configuration for the RDS instance"
49+
}
50+
variable "parameters" {
51+
type = map(string)
52+
description = "The parameters to pass to the RDS instance"
53+
}
54+
variable "enable_performance_insights" {
55+
type = bool
56+
description = "Whether to enable Performance Insights"
57+
}
158
variable "context" {
259
type = object({
360
organization = string

0 commit comments

Comments
 (0)