RDSC-4001 Example for RDS Aurora Postgres DB failover #4

actgardner · 2025-11-21T13:34:15Z

Add an example of PrivateLink for RDS Aurora Postgres based on the AWS blog: https://aws.amazon.com/blogs/database/access-amazon-rds-across-vpcs-using-aws-privatelink-and-network-load-balancer/

RDS database cluster with 2 instances (one writer, one read-only)
PrivateLink Service pointing at an NLB with no targets (yet)
Lambda Function to update the NLB targets based on how the RDS DNS resolves (so it points to the writer)
RDS notification to SNS that triggers the Lambda Function when the database fails over

Additional notes:

The Lambda runs once manually to setup the initial LB target, once the instances are ready.
The database is populated with the Chinook dataset by running psql locally against the load balancer public hostname
./psql.sh connects to the DB via the public LB hostname so we can do demos.

jit-ci

❌ Jit has detected 4 important findings in this PR that you should review.
The findings are detailed below as separate comments.
It’s highly recommended that you fix these security issues before merge.

Repository Risks:

Database Integration: Connects to a database, often involving sensitive data that must be securely managed.
Internally Accessible: Accessible only within the internal network, reducing exposure to external threats but still requiring proper controls.
High Severity Findings: Indicates that the resource has high severity security findings that need attention.

Repository Context:

graph LR
    GitHub$Repository_U23_redis/rdi_U2D_cloud_U2D_automation["GitHub Repository<br/>redis/rdi-cloud-automation"]:::GitHub$Repository
    DBIntegration_U23_postgres["DBIntegration<br/>postgres"]:::DBIntegration
    GitHub$Repository_U23_redis/rdi_U2D_cloud_U2D_automation -- "Is accessible to" --> DBIntegration_U23_postgres

jit-ci · 2025-11-21T13:36:58Z

modules/aws-rds-lambda/sns.tf

@@ -0,0 +1,61 @@
+# SNS Topic
+resource "aws_sns_topic" "rdi_failover_topic" {


Security control: Iac Misconfig Detection Terraform

Sns (Simple Notification Service) Topic Should Be Encrypted

SNS (Simple Notification Service) Topic should be encrypted

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_ignore_type_in_file Ignore any finding of type "SNS (Simple Notification Service) Topic should be encrypted" in modules/aws-rds-lambda/sns.tf; future occurrences will also be ignored.

#jit_undo_ignore Undo ignore command

jit-ci · 2025-11-21T13:36:58Z

modules/aws-rds-chinook/main.tf

@@ -0,0 +1,34 @@
+resource "aws_rds_cluster" "postgresql" {


Security control: Iac Misconfig Detection Terraform

Amazon Aurora Does Not Have Encryption For Data At Rest Enabled. To Prevent Such A Scenario, Update The Attribute 'Storageencrypted' To 'True'.

Amazon Aurora does not have encryption for data at rest enabled. To prevent such a scenario, update the attribute 'StorageEncrypted' to 'true'.

Severity: HIGH

Learn more about this issue

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_ignore_type_in_file Ignore any finding of type "Amazon Aurora does not have encryption for data at rest enabled. To prevent such a scenario, update the attribute 'StorageEncrypted' to 'true'." in modules/aws-rds-chinook/main.tf; future occurrences will also be ignored.

#jit_undo_ignore Undo ignore command

jit-ci · 2025-11-21T13:36:58Z

modules/aws-rds-chinook/main.tf

@@ -0,0 +1,34 @@
+resource "aws_rds_cluster" "postgresql" {


Security control: Iac Misconfig Detection Terraform

Rds Storage Should Be Encrypted, Which Means The Attribute 'Storage Encrypted' Should Be Set To 'True'

RDS Storage should be encrypted, which means the attribute 'storage_encrypted' should be set to 'true'

Severity: HIGH

Learn more about this issue

Fix suggestion:

This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.

Suggestion guidelines

Issue Type: MissingAttribute
Expected value: aws_rds_cluster.storage_encrypted should be set to true
Actual value: aws_rds_cluster.storage_encrypted is undefined

Suggested change

resource "aws_rds_cluster" "postgresql" {

resource "aws_rds_cluster" "postgresql" {

storage_encrypted = true

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_ignore_type_in_file Ignore any finding of type "RDS Storage should be encrypted, which means the attribute 'storage_encrypted' should be set to 'true'" in modules/aws-rds-chinook/main.tf; future occurrences will also be ignored.

#jit_undo_ignore Undo ignore command

jit-ci · 2025-11-21T13:36:58Z

modules/aws-rds-chinook/security.tf

+    from_port   = var.db_port
+    to_port     = var.db_port
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]


Security control: Iac Misconfig Detection Terraform

Security Groups Allow Ingress From 0.0.0.0:0 And/Or ::/0

Security groups allow ingress from 0.0.0.0:0 and/or ::/0

Severity: HIGH

Learn more about this issue

Fix suggestion:

This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.

Suggestion guidelines

This recipe will modify the ingress rule in the AWS security group to restrict the ingress, changing the 'cidr_blocks' value from '0.0.0.0/0' to a specific CIDR block representing your internal IP range. Make sure to replace 'your-ip-range' with the actual CIDR block relevant to your network.

Suggested change

cidr_blocks = ["0.0.0.0/0"]

1your-ip-range2]

Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

#jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”

#jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”

#jit_ignore_type_in_file Ignore any finding of type "Security groups allow ingress from 0.0.0.0:0 and/or ::/0" in modules/aws-rds-chinook/security.tf; future occurrences will also be ignored.

#jit_undo_ignore Undo ignore command

actgardner · 2025-11-21T19:05:29Z

examples/aws-ec2-privatelink/main.tf

  subnets            = module.rdi_quickstart_postgres.vpc_public_subnets
  target_type        = "instance"
-  target             = module.rdi_quickstart_postgres.instance_id
+  targets            = [module.rdi_quickstart_postgres.instance_id]


Allow 0 or more targets instead of requiring exactly 1. This way we can reuse the module for both examples.

jmahonin · 2025-11-21T20:38:12Z

Can we update the root README.md please?

jmahonin · 2025-11-21T22:28:57Z

Also small nit, but can we rename the examples folder aws-rds-privatelink to aws-rds-privatelink-failover?

actgardner added 7 commits November 20, 2025 18:26

RDSC-4001 Example for RDS Aurora Postgres DB failover

32068e7

Add example directory

2ac890b

Add one-off run of lambda for setup

a52f488

fmt

9980502

Update docs

73a3a52

update psql.sh

f71b409

Remove empty file

48f5427

jit-ci bot reviewed Nov 21, 2025

View reviewed changes

actgardner added 2 commits November 21, 2025 12:25

Fix timing of initial lambda

6b13f9d

fmt

626d0e5

actgardner requested a review from jmahonin November 21, 2025 19:04

actgardner commented Nov 21, 2025

View reviewed changes

Remove unused inputs and outputs

77acbdb

actgardner marked this pull request as ready for review November 21, 2025 20:28

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

RDSC-4001 Example for RDS Aurora Postgres DB failover #4

RDSC-4001 Example for RDS Aurora Postgres DB failover #4

Uh oh!

actgardner commented Nov 21, 2025 •

edited

Loading

Uh oh!

jit-ci bot left a comment

Uh oh!

jit-ci bot Nov 21, 2025

Uh oh!

jit-ci bot Nov 21, 2025

Uh oh!

jit-ci bot Nov 21, 2025

Uh oh!

jit-ci bot Nov 21, 2025

Uh oh!

actgardner Nov 21, 2025

Uh oh!

jmahonin commented Nov 21, 2025

Uh oh!

jmahonin commented Nov 21, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		@@ -0,0 +1,61 @@
		# SNS Topic
		resource "aws_sns_topic" "rdi_failover_topic" {

	resource "aws_rds_cluster" "postgresql" {
	resource "aws_rds_cluster" "postgresql" {
	storage_encrypted = true

RDSC-4001 Example for RDS Aurora Postgres DB failover #4

Are you sure you want to change the base?

RDSC-4001 Example for RDS Aurora Postgres DB failover #4

Uh oh!

Conversation

actgardner commented Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jit-ci bot left a comment

Choose a reason for hiding this comment

Uh oh!

jit-ci bot Nov 21, 2025

Choose a reason for hiding this comment

Uh oh!

jit-ci bot Nov 21, 2025

Choose a reason for hiding this comment

Uh oh!

jit-ci bot Nov 21, 2025

Choose a reason for hiding this comment

Uh oh!

jit-ci bot Nov 21, 2025

Choose a reason for hiding this comment

Uh oh!

actgardner Nov 21, 2025

Choose a reason for hiding this comment

Uh oh!

jmahonin commented Nov 21, 2025

Uh oh!

jmahonin commented Nov 21, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

actgardner commented Nov 21, 2025 •

edited

Loading