Skip to content

Commit 7b53eff

Browse files
jamesiarmesjamesiarmes
committed
fix: Move database configuration to its own module.
1 parent a9f0263 commit 7b53eff

11 files changed

Lines changed: 188 additions & 74 deletions

File tree

‎tofu/config/development/infra/main.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ module "app" {
5656
environment = "development"
5757
program = each.value.program
5858
services = each.value.services
59-
database_engine = each.value.database.type
59+
database_engine = try(each.value.database.type, null)
6060
database_version = try(each.value.database.version, null)
6161
domain = try(
6262
each.value.domain,

‎tofu/modules/app/database.tf‎

Lines changed: 20 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,24 @@
1-
resource "aws_kms_key" "database" {
2-
description = "Database encryption key for ${var.project} ${var.environment}"
3-
deletion_window_in_days = local.production ? 30 : 7
4-
enable_key_rotation = true
5-
policy = jsonencode(yamldecode(templatefile("${path.module}/templates/key-policy.yaml.tftpl", {
6-
account_id : data.aws_caller_identity.identity.account_id,
7-
partition : data.aws_partition.current.partition,
8-
region : data.aws_region.current.name,
9-
})))
1+
module "database" {
2+
source = "../database"
103

11-
tags = local.tags
4+
project = var.project
5+
environment = var.environment
6+
program = var.program
7+
private_subnets = var.private_subnets
8+
vpc_id = var.vpc_id
9+
10+
database_engine = var.database_engine
11+
database_version = var.database_version
12+
logging_key_arn = var.logging_key_arn
13+
secrets_key_arn = module.secrets.kms_key_arn
1214
}
1315

14-
resource "aws_kms_alias" "database" {
15-
name = "alias/${var.project}/${var.environment}/database"
16-
target_key_id = aws_kms_key.database.id
16+
resource "aws_vpc_security_group_ingress_rule" "database" {
17+
for_each = module.service
18+
security_group_id = module.database.security_group_id
19+
20+
ip_protocol = "tcp"
21+
from_port = module.database.port
22+
to_port = module.database.port
23+
referenced_security_group_id = each.value.security_group_id
1724
}

‎tofu/modules/app/main.tf‎

Lines changed: 4 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -29,74 +29,18 @@ module "service" {
2929
create_version_parameter = true
3030

3131
environment_variables = {
32-
DATABASE_HOST = module.mssql.db_instance_endpoint
32+
DATABASE_HOST = module.database.host
33+
DATABASE_PORT = module.database.port
3334
}
3435

3536
environment_secrets = {
36-
DATABASE_USERNAME = "${module.mssql.db_instance_master_user_secret_arn}:username"
37-
DATABASE_PASSWORD = "${module.mssql.db_instance_master_user_secret_arn}:password"
37+
DATABASE_USERNAME = "${module.database.secret_arn}:username"
38+
DATABASE_PASSWORD = "${module.database.secret_arn}:password"
3839
}
3940

4041
tags = local.tags
4142
}
4243

43-
module "mssql" {
44-
source = "terraform-aws-modules/rds/aws"
45-
version = ">= 6.12"
46-
47-
identifier = local.prefix
48-
instance_use_identifier_prefix = true
49-
engine = local.database_engine
50-
engine_version = data.aws_rds_engine_version.this.version
51-
auto_minor_version_upgrade = true
52-
apply_immediately = !local.production
53-
subnet_ids = var.private_subnets
54-
create_db_subnet_group = true
55-
create_db_option_group = false
56-
family = data.aws_rds_engine_version.this.parameter_group_family
57-
instance_class = "db.t3.small"
58-
allocated_storage = 20
59-
max_allocated_storage = 100
60-
username = "root"
61-
storage_type = "gp3"
62-
kms_key_id = aws_kms_key.database.arn
63-
master_user_secret_kms_key_id = module.secrets.kms_key_arn
64-
performance_insights_kms_key_id = var.logging_key_arn
65-
cloudwatch_log_group_kms_key_id = var.logging_key_arn
66-
cloudwatch_log_group_retention_in_days = local.production ? 31 : 7
67-
create_cloudwatch_log_group = true
68-
create_monitoring_role = true
69-
enabled_cloudwatch_logs_exports = data.aws_rds_engine_version.this.exportable_log_types
70-
vpc_security_group_ids = [module.database_security_group.security_group_id]
71-
72-
allow_major_version_upgrade = !local.production
73-
74-
tags = local.tags
75-
}
76-
77-
# Create an empty security group for the database. To avoid a circular
78-
# dependency between the database and the services, we create the security group
79-
# here and then add the ingress rules in a separate resource.
80-
module "database_security_group" {
81-
source = "terraform-aws-modules/security-group/aws"
82-
version = "~> 5.3"
83-
84-
name = "${local.prefix}-database"
85-
vpc_id = var.vpc_id
86-
87-
tags = local.tags
88-
}
89-
90-
resource "aws_vpc_security_group_ingress_rule" "database" {
91-
for_each = module.service
92-
security_group_id = module.database_security_group.security_group_id
93-
94-
ip_protocol = "tcp"
95-
from_port = module.mssql.db_instance_port
96-
to_port = module.mssql.db_instance_port
97-
referenced_security_group_id = each.value.security_group_id
98-
}
99-
10044
resource "aws_cloudwatch_log_subscription_filter" "datadog" {
10145
depends_on = [module.service]
10246
for_each = length(local.datadog_lambda) > 0 ? local.log_groups : toset([])

‎tofu/modules/app/variables.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
variable "database_engine" {
22
description = "The database engine to use for the application."
33
type = string
4+
default = null
45
}
56

67
variable "database_version" {

‎tofu/modules/database/data.tf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
data "aws_caller_identity" "identity" {}
2+
3+
data "aws_partition" "current" {}
4+
5+
data "aws_region" "current" {}
6+
7+
data "aws_rds_engine_version" "this" {
8+
engine = local.database_engine
9+
version = var.database_version
10+
latest = true
11+
}

‎tofu/modules/database/local.tf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
locals {
2+
database_engine = var.database_engine == "mssql" ? "sqlserver-web" : var.database_engine
3+
prefix = "${var.project}-${var.environment}"
4+
production = var.environment == "production"
5+
tags = {
6+
application = "${var.project}-${var.environment}"
7+
program = var.program
8+
project = var.project
9+
environment = var.environment
10+
}
11+
}

‎tofu/modules/database/main.tf‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
resource "aws_kms_key" "database" {
2+
description = "Database encryption key for ${var.project} ${var.environment}"
3+
deletion_window_in_days = local.production ? 30 : 7
4+
enable_key_rotation = true
5+
policy = jsonencode(yamldecode(templatefile("${path.module}/templates/key-policy.yaml.tftpl", {
6+
account_id : data.aws_caller_identity.identity.account_id,
7+
partition : data.aws_partition.current.partition,
8+
region : data.aws_region.current.name,
9+
})))
10+
11+
tags = local.tags
12+
}
13+
14+
resource "aws_kms_alias" "database" {
15+
name = "alias/${var.project}/${var.environment}/database"
16+
target_key_id = aws_kms_key.database.id
17+
}
18+
19+
module "mssql" {
20+
source = "terraform-aws-modules/rds/aws"
21+
version = ">= 6.12"
22+
for_each = var.database_engine == "mssql" ? toset(["this"]) : toset([])
23+
24+
identifier = local.prefix
25+
instance_use_identifier_prefix = true
26+
engine = local.database_engine
27+
engine_version = data.aws_rds_engine_version.this.version
28+
auto_minor_version_upgrade = true
29+
apply_immediately = !local.production
30+
subnet_ids = var.private_subnets
31+
create_db_subnet_group = true
32+
create_db_option_group = false
33+
family = data.aws_rds_engine_version.this.parameter_group_family
34+
instance_class = "db.t3.small"
35+
allocated_storage = 20
36+
max_allocated_storage = 100
37+
username = "root"
38+
storage_type = "gp3"
39+
kms_key_id = aws_kms_key.database.arn
40+
master_user_secret_kms_key_id = var.secrets_key_arn
41+
performance_insights_kms_key_id = var.logging_key_arn
42+
cloudwatch_log_group_kms_key_id = var.logging_key_arn
43+
cloudwatch_log_group_retention_in_days = local.production ? 31 : 7
44+
create_cloudwatch_log_group = true
45+
create_monitoring_role = true
46+
enabled_cloudwatch_logs_exports = data.aws_rds_engine_version.this.exportable_log_types
47+
vpc_security_group_ids = [module.database_security_group.security_group_id]
48+
49+
allow_major_version_upgrade = !local.production
50+
51+
tags = local.tags
52+
}
53+
54+
# Create an empty security group for the database. To avoid a circular
55+
# dependency between the database and the services, we create the security group
56+
# here and then add the ingress rules in a separate resource.
57+
module "database_security_group" {
58+
source = "terraform-aws-modules/security-group/aws"
59+
version = "~> 5.3"
60+
61+
name = "${local.prefix}-database"
62+
vpc_id = var.vpc_id
63+
64+
tags = local.tags
65+
}

‎tofu/modules/database/outputs.tf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
output "security_group_id" {
2+
description = "Security group ID for the database."
3+
value = module.database_security_group.security_group_id
4+
}
5+
6+
output "host" {
7+
description = "Host on which the database is accessible."
8+
value = try(module.mssql["this"].db_instance_address, "")
9+
}
10+
11+
output "port" {
12+
description = "Port on which the database is accessible."
13+
value = try(module.mssql["this"].db_instance_port, "")
14+
}
15+
16+
output "secret_arn" {
17+
description = "ARN of the secret containing the database credentials."
18+
value = try(module.mssql["this"].db_instance_master_user_secret_arn, "")
19+
}

tofu/modules/app/templates/key-policy.yaml.tftpl renamed to tofu/modules/database/templates/key-policy.yaml.tftpl

File renamed without changes.

‎tofu/modules/database/variables.tf‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
variable "database_engine" {
2+
description = "The database engine to use for the application."
3+
type = string
4+
default = null
5+
}
6+
7+
variable "database_version" {
8+
description = "The version of the database engine to use."
9+
type = string
10+
default = null
11+
}
12+
13+
variable "environment" {
14+
description = "The environment for the application."
15+
type = string
16+
}
17+
18+
variable "logging_key_arn" {
19+
description = "The ARN of the KMS key used for logging."
20+
type = string
21+
}
22+
23+
variable "private_subnets" {
24+
description = "List of private subnets for the application."
25+
type = list(string)
26+
}
27+
28+
variable "program" {
29+
description = "The program the application is associated with."
30+
type = string
31+
}
32+
33+
variable "project" {
34+
description = "The name of the project."
35+
type = string
36+
}
37+
38+
variable "secrets_key_arn" {
39+
description = "The ARN of the KMS key used for secrets."
40+
type = string
41+
}
42+
43+
variable "vpc_id" {
44+
description = "The VPC ID where the application will be deployed."
45+
type = string
46+
}

0 commit comments

Comments
 (0)