Michael Freno
7b925c89bd
- P2: Replace wget with curl for ECS health check (Alpine lacks wget) - P2: Add AWS credentials step to CI terraform-plan job for S3 backend auth - P3: Remove unused GitHub provider from infra/main.tf Co-Authored-By: Paperclip <noreply@paperclip.ing>
139 lines
3.2 KiB
HCL
139 lines
3.2 KiB
HCL
variable "environment" {
|
|
description = "Deployment environment"
|
|
type = string
|
|
}
|
|
|
|
variable "vpc_id" {
|
|
description = "VPC ID"
|
|
type = string
|
|
}
|
|
|
|
variable "subnet_ids" {
|
|
description = "Private subnet IDs"
|
|
type = list(string)
|
|
}
|
|
|
|
variable "security_group_id" {
|
|
description = "RDS security group ID"
|
|
type = string
|
|
}
|
|
|
|
variable "db_name" {
|
|
description = "Database name"
|
|
type = string
|
|
}
|
|
|
|
variable "db_instance_class" {
|
|
description = "RDS instance class"
|
|
type = string
|
|
}
|
|
|
|
variable "multi_az" {
|
|
description = "Multi-AZ deployment"
|
|
type = bool
|
|
}
|
|
|
|
variable "backup_retention" {
|
|
description = "Backup retention days"
|
|
type = number
|
|
}
|
|
|
|
variable "project_name" {
|
|
description = "Project name"
|
|
type = string
|
|
}
|
|
|
|
resource "aws_db_subnet_group" "main" {
|
|
name = "${var.project_name}-${var.environment}-db-subnet"
|
|
subnet_ids = var.subnet_ids
|
|
|
|
tags = {
|
|
Name = "${var.project_name}-${var.environment}-db-subnet"
|
|
}
|
|
}
|
|
|
|
resource "aws_db_instance" "main" {
|
|
identifier = "${var.project_name}-${var.environment}-db"
|
|
|
|
engine = "postgres"
|
|
engine_version = "16.2"
|
|
instance_class = var.db_instance_class
|
|
allocated_storage = var.environment == "production" ? 100 : 20
|
|
|
|
db_name = var.db_name
|
|
username = "shieldai"
|
|
password = random_password.db_password.result
|
|
|
|
multi_az = var.multi_az
|
|
db_subnet_group_name = aws_db_subnet_group.main.name
|
|
vpc_security_group_ids = [var.security_group_id]
|
|
|
|
backup_retention_period = var.backup_retention
|
|
backup_window = "03:00-04:00"
|
|
maintenance_window = "sun:04:00-sun:05:00"
|
|
|
|
skip_final_snapshot = var.environment != "production"
|
|
final_snapshot_identifier = "${var.project_name}-${var.environment}-final"
|
|
|
|
storage_encrypted = true
|
|
storage_type = "gp3"
|
|
iops = var.environment == "production" ? 3000 : 1000
|
|
|
|
deletion_protection = var.environment == "production"
|
|
copy_tags_to_snapshot = true
|
|
|
|
tags = {
|
|
Name = "${var.project_name}-${var.environment}-db"
|
|
}
|
|
}
|
|
|
|
resource "random_password" "db_password" {
|
|
length = 16
|
|
special = true
|
|
|
|
keepers = {
|
|
environment = var.environment
|
|
}
|
|
}
|
|
|
|
resource "aws_secretsmanager_secret_version" "db_password" {
|
|
secret_id = aws_secretsmanager_secret.db_password.id
|
|
secret_string = jsonencode({
|
|
username = "shieldai"
|
|
password = random_password.db_password.result
|
|
engine = "postgres"
|
|
host = aws_db_instance.main.address
|
|
port = aws_db_instance.main.port
|
|
})
|
|
}
|
|
|
|
resource "aws_secretsmanager_secret" "db_password" {
|
|
name = "${var.project_name}-${var.environment}-db-password"
|
|
|
|
tags = {
|
|
Name = "${var.project_name}-${var.environment}-db-password"
|
|
}
|
|
}
|
|
|
|
output "db_endpoint" {
|
|
description = "RDS endpoint"
|
|
value = aws_db_instance.main.endpoint
|
|
sensitive = true
|
|
}
|
|
|
|
output "db_instance_identifier" {
|
|
description = "RDS instance identifier"
|
|
value = aws_db_instance.main.identifier
|
|
}
|
|
|
|
output "db_password_secret_arn" {
|
|
description = "DB password secret ARN"
|
|
value = aws_secretsmanager_secret.db_password.arn
|
|
}
|
|
|
|
output "db_password" {
|
|
description = "Generated DB password"
|
|
value = random_password.db_password.result
|
|
sensitive = true
|
|
}
|