terraform-aws-databases/rds-postgres/primary-instance/main.tf at 4133f36baa515ab2edda538ddbe4e31542c470b8 · thoughtbot/terraform-aws-databases · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
resource "aws_db_instance" "this" {
  allocated_storage               = var.allocated_storage
  apply_immediately               = var.apply_immediately
  auto_minor_version_upgrade      = var.auto_minor_version_upgrade
  backup_retention_period         = var.backup_retention_period
  backup_window                   = var.backup_window
  ca_cert_identifier              = var.ca_cert_id
  db_subnet_group_name            = local.subnet_group_name
  enabled_cloudwatch_logs_exports = var.enabled_cloudwatch_logs_exports
  engine                          = var.engine
  engine_version                  = var.engine_version
  identifier                      = var.identifier
  instance_class                  = var.instance_class
  iops                            = var.iops
  kms_key_id                      = var.kms_key_id
  maintenance_window              = var.maintenance_window
  max_allocated_storage           = var.max_allocated_storage
  multi_az                        = var.multi_az
  parameter_group_name            = local.parameter_group_name
  performance_insights_enabled    = var.performance_insights_enabled
  publicly_accessible             = var.publicly_accessible
  skip_final_snapshot             = var.skip_final_snapshot
  snapshot_identifier             = var.snapshot_identifier
  storage_encrypted               = var.storage_encrypted
  storage_type                    = var.storage_type
  tags                            = var.tags
  username                        = var.admin_username
  vpc_security_group_ids          = local.server_security_group_ids

  final_snapshot_identifier = join(
    "-",
    [var.identifier, random_id.snapshot_suffix.hex, "final"]
  )

  name = (
    var.create_default_db ?
    var.default_database :
    null
  )

  password = coalesce(var.initial_password, random_password.database.result)

  depends_on = [
    aws_db_subnet_group.this,
    module.parameter_group,
    module.server_security_group,
  ]

  lifecycle {
    ignore_changes = [password]
  }
}

resource "random_id" "snapshot_suffix" {
  byte_length = 4
}

resource "random_password" "database" {
  length  = 128
  special = false
}

module "parameter_group" {
  count  = var.create_parameter_group ? 1 : 0
  source = "../parameter-group"

  engine_version = var.engine_version
  force_ssl      = var.force_ssl
  name           = local.parameter_group_name
  tags           = var.tags
}

module "server_security_group" {
  count  = var.create_server_security_group ? 1 : 0
  source = "../../security-group"

  allowed_cidr_blocks = var.allowed_cidr_blocks
  description         = "RDS Postgres server: ${var.identifier}"
  randomize_name      = var.server_security_group_name == ""
  tags                = var.tags
  vpc_id              = var.vpc_id

  allowed_security_group_ids = concat(
    var.allowed_security_group_ids,
    module.client_security_group.*.id
  )

  name = coalesce(
    var.server_security_group_name,
    "${var.identifier}-server"
  )

  ports = {
    postgres = 5432
  }
}

module "client_security_group" {
  count  = var.create_client_security_group ? 1 : 0
  source = "../../security-group"

  allowed_cidr_blocks        = var.allowed_cidr_blocks
  allowed_security_group_ids = var.allowed_security_group_ids
  description                = "RDS Postgres client: ${var.identifier}"
  randomize_name             = var.client_security_group_name == ""
  tags                       = var.tags
  vpc_id                     = var.vpc_id

  name = coalesce(
    var.client_security_group_name,
    "${var.identifier}-client"
  )
}

module "alarms" {
  count  = var.create_cloudwatch_alarms ? 1 : 0
  source = "../cloudwatch-alarms"

  alarm_actions     = var.alarm_actions
  identifier        = aws_db_instance.this.identifier
  instance_class    = aws_db_instance.this.instance_class
  allocated_storage = var.allocated_storage
}

resource "aws_db_subnet_group" "this" {
  count = var.create_subnet_group ? 1 : 0
  name  = local.subnet_group_name

  description = var.subnet_group_description
  subnet_ids  = var.subnet_ids
  tags        = var.tags
}

locals {
  owned_vpc_security_group_ids  = module.server_security_group.*.id
  shared_vpc_security_group_ids = var.server_security_group_ids

  parameter_group_name = coalesce(
    var.parameter_group_name,
    var.identifier
  )

  subnet_group_name = coalesce(
    var.subnet_group_name,
    var.identifier
  )

  server_security_group_ids = concat(
    local.owned_vpc_security_group_ids,
    local.shared_vpc_security_group_ids
  )
}