Skip to content

Commit 3b3362a

Browse files
committed
Initial commit
1 parent cd1a46d commit 3b3362a

File tree

14 files changed

+848
-59
lines changed

14 files changed

+848
-59
lines changed

.github/settings.yml

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,7 @@
11
# Upstream changes from _extends are only recognized when modifications are made to this file in the default branch.
22
_extends: .github
33
repository:
4-
name: template
5-
description: Template for Terraform Components
4+
name: aws-aurora-postgres-resources
5+
description: 'This component is responsible for provisioning Aurora Postgres resources: additional databases, users, permissions, grants, etc'
66
homepage: https://cloudposse.com/accelerate
77
topics: terraform, terraform-component
8-
9-
10-
11-

README.yaml

Lines changed: 166 additions & 48 deletions
Large diffs are not rendered by default.

src/main.tf

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,77 @@
11
locals {
22
enabled = module.this.enabled
3+
4+
# If pulling passwords from SSM, determine the SSM path for passwords for each user
5+
# example SSM password source: /rds/acme-platform-use1-dev-rds-shared/%s/password
6+
read_passwords_from_ssm = local.enabled && var.read_passwords_from_ssm
7+
password_users_to_fetch = local.read_passwords_from_ssm ? toset(keys(var.additional_grants)) : []
8+
ssm_path_prefix = format("/%s/%s", var.ssm_path_prefix, module.aurora_postgres.outputs.cluster_identifier)
9+
ssm_password_source = length(var.ssm_password_source) > 0 ? var.ssm_password_source : format("%s/%s", local.ssm_path_prefix, "%s/password")
10+
11+
kms_key_arn = module.aurora_postgres.outputs.kms_key_arn
12+
13+
default_schema_owner = "postgres"
14+
}
15+
16+
data "aws_ssm_parameter" "password" {
17+
for_each = local.password_users_to_fetch
18+
19+
name = format(local.ssm_password_source, each.key)
20+
21+
with_decryption = true
322
}
423

24+
resource "postgresql_database" "additional" {
25+
for_each = local.enabled ? var.additional_databases : []
526

27+
name = each.key
28+
}
629

30+
resource "postgresql_schema" "additional" {
31+
for_each = local.enabled ? var.additional_schemas : {}
32+
33+
name = each.key
34+
database = try(each.value.database, null) # If null, the database used by your provider configuration
35+
}
736

37+
module "additional_users" {
38+
for_each = local.enabled ? var.additional_users : {}
39+
source = "./modules/postgresql-user"
840

41+
service_name = each.key
42+
db_user = each.value.db_user
43+
db_password = each.value.db_password
44+
grants = each.value.grants
45+
ssm_path_prefix = local.ssm_path_prefix
46+
kms_key_id = local.kms_key_arn
47+
48+
depends_on = [
49+
postgresql_database.additional,
50+
postgresql_schema.additional,
51+
]
52+
53+
context = module.this.context
54+
}
55+
56+
module "additional_grants" {
57+
for_each = var.additional_grants
58+
source = "./modules/postgresql-user"
59+
60+
service_name = each.key
61+
grants = each.value
62+
kms_key_id = local.kms_key_arn
63+
64+
# If `read_passwords_from_ssm` is true, that means passwords already exist in SSM
65+
# If no password is given, a random password will be created
66+
db_password = local.read_passwords_from_ssm ? data.aws_ssm_parameter.password[each.key].value : ""
67+
# If generating a password, store it in SSM. Otherwise, we don't need to save an existing password in SSM
68+
save_password_in_ssm = local.read_passwords_from_ssm ? false : true
69+
ssm_path_prefix = local.ssm_path_prefix
70+
71+
depends_on = [
72+
postgresql_database.additional,
73+
postgresql_schema.additional,
74+
]
75+
76+
context = module.this.context
77+
}
Lines changed: 279 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,279 @@
1+
#
2+
# ONLY EDIT THIS FILE IN github.com/cloudposse/terraform-null-label
3+
# All other instances of this file should be a copy of that one
4+
#
5+
#
6+
# Copy this file from https://github.com/cloudposse/terraform-null-label/blob/master/exports/context.tf
7+
# and then place it in your Terraform module to automatically get
8+
# Cloud Posse's standard configuration inputs suitable for passing
9+
# to Cloud Posse modules.
10+
#
11+
# curl -sL https://raw.githubusercontent.com/cloudposse/terraform-null-label/master/exports/context.tf -o context.tf
12+
#
13+
# Modules should access the whole context as `module.this.context`
14+
# to get the input variables with nulls for defaults,
15+
# for example `context = module.this.context`,
16+
# and access individual variables as `module.this.<var>`,
17+
# with final values filled in.
18+
#
19+
# For example, when using defaults, `module.this.context.delimiter`
20+
# will be null, and `module.this.delimiter` will be `-` (hyphen).
21+
#
22+
23+
module "this" {
24+
source = "cloudposse/label/null"
25+
version = "0.25.0" # requires Terraform >= 0.13.0
26+
27+
enabled = var.enabled
28+
namespace = var.namespace
29+
tenant = var.tenant
30+
environment = var.environment
31+
stage = var.stage
32+
name = var.name
33+
delimiter = var.delimiter
34+
attributes = var.attributes
35+
tags = var.tags
36+
additional_tag_map = var.additional_tag_map
37+
label_order = var.label_order
38+
regex_replace_chars = var.regex_replace_chars
39+
id_length_limit = var.id_length_limit
40+
label_key_case = var.label_key_case
41+
label_value_case = var.label_value_case
42+
descriptor_formats = var.descriptor_formats
43+
labels_as_tags = var.labels_as_tags
44+
45+
context = var.context
46+
}
47+
48+
# Copy contents of cloudposse/terraform-null-label/variables.tf here
49+
50+
variable "context" {
51+
type = any
52+
default = {
53+
enabled = true
54+
namespace = null
55+
tenant = null
56+
environment = null
57+
stage = null
58+
name = null
59+
delimiter = null
60+
attributes = []
61+
tags = {}
62+
additional_tag_map = {}
63+
regex_replace_chars = null
64+
label_order = []
65+
id_length_limit = null
66+
label_key_case = null
67+
label_value_case = null
68+
descriptor_formats = {}
69+
# Note: we have to use [] instead of null for unset lists due to
70+
# https://github.com/hashicorp/terraform/issues/28137
71+
# which was not fixed until Terraform 1.0.0,
72+
# but we want the default to be all the labels in `label_order`
73+
# and we want users to be able to prevent all tag generation
74+
# by setting `labels_as_tags` to `[]`, so we need
75+
# a different sentinel to indicate "default"
76+
labels_as_tags = ["unset"]
77+
}
78+
description = <<-EOT
79+
Single object for setting entire context at once.
80+
See description of individual variables for details.
81+
Leave string and numeric variables as `null` to use default value.
82+
Individual variable settings (non-null) override settings in context object,
83+
except for attributes, tags, and additional_tag_map, which are merged.
84+
EOT
85+
86+
validation {
87+
condition = lookup(var.context, "label_key_case", null) == null ? true : contains(["lower", "title", "upper"], var.context["label_key_case"])
88+
error_message = "Allowed values: `lower`, `title`, `upper`."
89+
}
90+
91+
validation {
92+
condition = lookup(var.context, "label_value_case", null) == null ? true : contains(["lower", "title", "upper", "none"], var.context["label_value_case"])
93+
error_message = "Allowed values: `lower`, `title`, `upper`, `none`."
94+
}
95+
}
96+
97+
variable "enabled" {
98+
type = bool
99+
default = null
100+
description = "Set to false to prevent the module from creating any resources"
101+
}
102+
103+
variable "namespace" {
104+
type = string
105+
default = null
106+
description = "ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique"
107+
}
108+
109+
variable "tenant" {
110+
type = string
111+
default = null
112+
description = "ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for"
113+
}
114+
115+
variable "environment" {
116+
type = string
117+
default = null
118+
description = "ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'"
119+
}
120+
121+
variable "stage" {
122+
type = string
123+
default = null
124+
description = "ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'"
125+
}
126+
127+
variable "name" {
128+
type = string
129+
default = null
130+
description = <<-EOT
131+
ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.
132+
This is the only ID element not also included as a `tag`.
133+
The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input.
134+
EOT
135+
}
136+
137+
variable "delimiter" {
138+
type = string
139+
default = null
140+
description = <<-EOT
141+
Delimiter to be used between ID elements.
142+
Defaults to `-` (hyphen). Set to `""` to use no delimiter at all.
143+
EOT
144+
}
145+
146+
variable "attributes" {
147+
type = list(string)
148+
default = []
149+
description = <<-EOT
150+
ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,
151+
in the order they appear in the list. New attributes are appended to the
152+
end of the list. The elements of the list are joined by the `delimiter`
153+
and treated as a single ID element.
154+
EOT
155+
}
156+
157+
variable "labels_as_tags" {
158+
type = set(string)
159+
default = ["default"]
160+
description = <<-EOT
161+
Set of labels (ID elements) to include as tags in the `tags` output.
162+
Default is to include all labels.
163+
Tags with empty values will not be included in the `tags` output.
164+
Set to `[]` to suppress all generated tags.
165+
**Notes:**
166+
The value of the `name` tag, if included, will be the `id`, not the `name`.
167+
Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be
168+
changed in later chained modules. Attempts to change it will be silently ignored.
169+
EOT
170+
}
171+
172+
variable "tags" {
173+
type = map(string)
174+
default = {}
175+
description = <<-EOT
176+
Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).
177+
Neither the tag keys nor the tag values will be modified by this module.
178+
EOT
179+
}
180+
181+
variable "additional_tag_map" {
182+
type = map(string)
183+
default = {}
184+
description = <<-EOT
185+
Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`.
186+
This is for some rare cases where resources want additional configuration of tags
187+
and therefore take a list of maps with tag key, value, and additional configuration.
188+
EOT
189+
}
190+
191+
variable "label_order" {
192+
type = list(string)
193+
default = null
194+
description = <<-EOT
195+
The order in which the labels (ID elements) appear in the `id`.
196+
Defaults to ["namespace", "environment", "stage", "name", "attributes"].
197+
You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present.
198+
EOT
199+
}
200+
201+
variable "regex_replace_chars" {
202+
type = string
203+
default = null
204+
description = <<-EOT
205+
Terraform regular expression (regex) string.
206+
Characters matching the regex will be removed from the ID elements.
207+
If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits.
208+
EOT
209+
}
210+
211+
variable "id_length_limit" {
212+
type = number
213+
default = null
214+
description = <<-EOT
215+
Limit `id` to this many characters (minimum 6).
216+
Set to `0` for unlimited length.
217+
Set to `null` for keep the existing setting, which defaults to `0`.
218+
Does not affect `id_full`.
219+
EOT
220+
validation {
221+
condition = var.id_length_limit == null ? true : var.id_length_limit >= 6 || var.id_length_limit == 0
222+
error_message = "The id_length_limit must be >= 6 if supplied (not null), or 0 for unlimited length."
223+
}
224+
}
225+
226+
variable "label_key_case" {
227+
type = string
228+
default = null
229+
description = <<-EOT
230+
Controls the letter case of the `tags` keys (label names) for tags generated by this module.
231+
Does not affect keys of tags passed in via the `tags` input.
232+
Possible values: `lower`, `title`, `upper`.
233+
Default value: `title`.
234+
EOT
235+
236+
validation {
237+
condition = var.label_key_case == null ? true : contains(["lower", "title", "upper"], var.label_key_case)
238+
error_message = "Allowed values: `lower`, `title`, `upper`."
239+
}
240+
}
241+
242+
variable "label_value_case" {
243+
type = string
244+
default = null
245+
description = <<-EOT
246+
Controls the letter case of ID elements (labels) as included in `id`,
247+
set as tag values, and output by this module individually.
248+
Does not affect values of tags passed in via the `tags` input.
249+
Possible values: `lower`, `title`, `upper` and `none` (no transformation).
250+
Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs.
251+
Default value: `lower`.
252+
EOT
253+
254+
validation {
255+
condition = var.label_value_case == null ? true : contains(["lower", "title", "upper", "none"], var.label_value_case)
256+
error_message = "Allowed values: `lower`, `title`, `upper`, `none`."
257+
}
258+
}
259+
260+
variable "descriptor_formats" {
261+
type = any
262+
default = {}
263+
description = <<-EOT
264+
Describe additional descriptors to be output in the `descriptors` output map.
265+
Map of maps. Keys are names of descriptors. Values are maps of the form
266+
`{
267+
format = string
268+
labels = list(string)
269+
}`
270+
(Type is `any` so the map values can later be enhanced to provide additional options.)
271+
`format` is a Terraform format string to be passed to the `format()` function.
272+
`labels` is a list of labels, in order, to pass to `format()` function.
273+
Label values will be normalized before being passed to `format()` so they will be
274+
identical to how they appear in `id`.
275+
Default is `{}` (`descriptors` output will be empty).
276+
EOT
277+
}
278+
279+
#### End of copy of cloudposse/terraform-null-label/variables.tf

0 commit comments

Comments
 (0)