a0799c0647
- Terraform modules: VPC, ECS Fargate, RDS PostgreSQL, ElastiCache Redis, S3, Secrets Manager, CloudWatch - Multi-environment support: staging and production configs - ECS auto-scaling: CPU-based scaling with configurable min/max - CI/CD: pnpm caching, Docker Buildx, Trivy security scanning, Terraform plan on PR - Deploy: ECS service updates with automatic rollback on health check failure - Backup: automated RDS snapshots, S3 versioning, ElastiCache snapshots - Monitoring: CloudWatch dashboards, CPU/memory/5xx alarms - Rollback script for manual service rollback - Infrastructure documentation with architecture overview
133 lines
3.1 KiB
HCL
133 lines
3.1 KiB
HCL
variable "environment" {
|
|
description = "Deployment environment"
|
|
type = string
|
|
}
|
|
|
|
variable "vpc_id" {
|
|
description = "VPC ID"
|
|
type = string
|
|
}
|
|
|
|
variable "subnet_ids" {
|
|
description = "Private subnet IDs"
|
|
type = list(string)
|
|
}
|
|
|
|
variable "security_group_id" {
|
|
description = "RDS security group ID"
|
|
type = string
|
|
}
|
|
|
|
variable "db_name" {
|
|
description = "Database name"
|
|
type = string
|
|
}
|
|
|
|
variable "db_instance_class" {
|
|
description = "RDS instance class"
|
|
type = string
|
|
}
|
|
|
|
variable "multi_az" {
|
|
description = "Multi-AZ deployment"
|
|
type = bool
|
|
}
|
|
|
|
variable "backup_retention" {
|
|
description = "Backup retention days"
|
|
type = number
|
|
}
|
|
|
|
variable "project_name" {
|
|
description = "Project name"
|
|
type = string
|
|
}
|
|
|
|
resource "aws_db_subnet_group" "main" {
|
|
name = "${var.project_name}-${var.environment}-db-subnet"
|
|
subnet_ids = var.subnet_ids
|
|
|
|
tags = {
|
|
Name = "${var.project_name}-${var.environment}-db-subnet"
|
|
}
|
|
}
|
|
|
|
resource "aws_db_instance" "main" {
|
|
identifier = "${var.project_name}-${var.environment}-db"
|
|
|
|
engine = "postgres"
|
|
engine_version = "16.2"
|
|
instance_class = var.db_instance_class
|
|
allocated_storage = var.environment == "production" ? 100 : 20
|
|
|
|
db_name = var.db_name
|
|
username = "shieldai"
|
|
password = random_password.db_password.result
|
|
|
|
multi_az = var.multi_az
|
|
db_subnet_group_name = aws_db_subnet_group.main.name
|
|
vpc_security_group_ids = [var.security_group_id]
|
|
|
|
backup_retention_period = var.backup_retention
|
|
backup_window = "03:00-04:00"
|
|
maintenance_window = "sun:04:00-sun:05:00"
|
|
|
|
skip_final_snapshot = var.environment != "production"
|
|
final_snapshot_identifier = "${var.project_name}-${var.environment}-final"
|
|
|
|
storage_encrypted = true
|
|
storage_type = "gp3"
|
|
iops = var.environment == "production" ? 3000 : 1000
|
|
|
|
deletion_protection = var.environment == "production"
|
|
copy_tags_to_snapshot = true
|
|
|
|
tags = {
|
|
Name = "${var.project_name}-${var.environment}-db"
|
|
}
|
|
}
|
|
|
|
resource "random_password" "db_password" {
|
|
length = 16
|
|
special = true
|
|
|
|
keepers = {
|
|
environment = var.environment
|
|
}
|
|
}
|
|
|
|
resource "aws_secretsmanager_secret_version" "db_password" {
|
|
secret_id = aws_secretsmanager_secret.db_password.id
|
|
secret_string = jsonencode({
|
|
username = "shieldai"
|
|
password = random_password.db_password.result
|
|
engine = "postgres"
|
|
host = aws_db_instance.main.address
|
|
port = aws_db_instance.main.port
|
|
})
|
|
}
|
|
|
|
resource "aws_secretsmanager_secret" "db_password" {
|
|
name = "${var.project_name}-${var.environment}-db-password"
|
|
|
|
tags = {
|
|
Name = "${var.project_name}-${var.environment}-db-password"
|
|
}
|
|
}
|
|
|
|
output "db_endpoint" {
|
|
description = "RDS endpoint"
|
|
value = aws_db_instance.main.endpoint
|
|
sensitive = true
|
|
}
|
|
|
|
output "db_instance_identifier" {
|
|
description = "RDS instance identifier"
|
|
value = aws_db_instance.main.identifier
|
|
}
|
|
|
|
output "db_password_secret_arn" {
|
|
description = "DB password secret ARN"
|
|
value = aws_secretsmanager_secret.db_password.arn
|
|
}
|