feat: rds/mysql module based on rds/postgres

rds/mysql/README.md

@@ -0,0 +1,73 @@
+# RDS MySQL
+
+Creates an RDS MySQL database instance
+
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+| Name | Version |
+|------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 2.40.0 |
+| <a name="requirement_random"></a> [random](#requirement\_random) | >= 2.1.2 |
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 2.40.0 |
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_management_lambda"></a> [management\_lambda](#module\_management\_lambda) | ./management_lambda |  |
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [aws_db_instance.db](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance) | resource |
+| [aws_db_subnet_group.db](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_subnet_group) | resource |
+| [aws_security_group.db](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
+| [aws_security_group_rule.management_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
+| [aws_security_group_rule.private](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
+| [aws_security_group_rule.public](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_backup_retention_period"></a> [backup\_retention\_period](#input\_backup\_retention\_period) | The days to retain backups for. Must be between 0 and 35. | `number` | `7` | no |
+| <a name="input_create"></a> [create](#input\_create) | Should resources be created | `bool` | `true` | no |
+| <a name="input_create_management_lambda"></a> [create\_management\_lambda](#input\_create\_management\_lambda) | Should the management lambda function be created | `bool` | `true` | no |
+| <a name="input_db"></a> [db](#input\_db) | The name of the database to create when the DB instance is created, defaults to project name converted to snake\_case | `string` | `null` | no |
+| <a name="input_environment"></a> [environment](#input\_environment) | Kebab-cased environment name, eg. development, staging, production | `string` | n/a | yes |
+| <a name="input_instance_type"></a> [instance\_type](#input\_instance\_type) | The instance type of the RDS instance | `string` | n/a | yes |
+| <a name="input_multi_az"></a> [multi\_az](#input\_multi\_az) | Specifies if the RDS instance is multi-AZ | `bool` | `true` | no |
+| <a name="input_mysql_version"></a> [mysql\_version](#input\_mysql\_version) | RDS MySQL engine version | `string` | `"5.7.28"` | no |
+| <a name="input_password"></a> [password](#input\_password) | Password for the master DB user | `string` | n/a | yes |
+| <a name="input_port"></a> [port](#input\_port) | The port on which the DB accepts connections | `number` | `3306` | no |
+| <a name="input_prevent_destroy"></a> [prevent\_destroy](#input\_prevent\_destroy) | Should the DB be protected from accidental deletion | `bool` | `true` | no |
+| <a name="input_project"></a> [project](#input\_project) | Kebab-cased project name | `string` | n/a | yes |
+| <a name="input_public"></a> [public](#input\_public) | Should the DB be publicly accessible, will have no effect if placed in a private subnet | `bool` | `false` | no |
+| <a name="input_security_group_ids"></a> [security\_group\_ids](#input\_security\_group\_ids) | Security group ids which should have access to the DB | `list(string)` | `[]` | no |
+| <a name="input_storage"></a> [storage](#input\_storage) | The allocated storage in gibibytes | `number` | n/a | yes |
+| <a name="input_subnet_ids"></a> [subnet\_ids](#input\_subnet\_ids) | VPC subnet IDs in which the DB should be created | `list(string)` | n/a | yes |
+| <a name="input_tags"></a> [tags](#input\_tags) | Tags to add to resources that support them | `map(string)` | `{}` | no |
+| <a name="input_username"></a> [username](#input\_username) | Username for the master DB user | `string` | n/a | yes |
+| <a name="input_vpc_id"></a> [vpc\_id](#input\_vpc\_id) | VPC ID in which the DB should be created | `string` | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_db"></a> [db](#output\_db) | DB name |
+| <a name="output_host"></a> [host](#output\_host) | DB host |
+| <a name="output_management_lambda"></a> [management\_lambda](#output\_management\_lambda) | Management lambda function outputs |
+| <a name="output_password"></a> [password](#output\_password) | DB master password |
+| <a name="output_port"></a> [port](#output\_port) | DB port |
+| <a name="output_security_group_id"></a> [security\_group\_id](#output\_security\_group\_id) | DB security group id |
+| <a name="output_url"></a> [url](#output\_url) | DB connection url |
+| <a name="output_username"></a> [username](#output\_username) | DB master username |
+<!-- END_TF_DOCS -->

rds/mysql/example/bin/mysql

@@ -0,0 +1,23 @@
+#!/bin/sh
+
+set -e
+
+environment=${1:-development}
+
+eval "$(
+  terraform output --json ${environment}_db | \
+  jq -r '@sh "
+    DB_HOST=\(.host)
+    DB_PORT=\(.port)
+    DB_USER=\(.user)
+    DB_PASSWORD=\(.password)
+    DB_NAME=\(.name)
+  "'
+)"
+
+docker run -it mysql:5.7 mysql \
+  --host "$DB_HOST" \
+  --port "$DB_PORT" \
+  --user "$DB_USER" \
+  --password="$DB_PASSWORD" \
+  "$DB_NAME" "$@"

rds/mysql/example/main.tf

@@ -0,0 +1,171 @@
+provider "aws" {
+  region = "eu-west-1"
+}
+
+data "aws_vpc" "default" {
+  default = true
+}
+
+data "aws_availability_zones" "all" {
+}
+
+data "aws_subnet" "a" {
+  vpc_id            = data.aws_vpc.default.id
+  availability_zone = data.aws_availability_zones.all.names[0]
+  default_for_az    = true
+}
+
+data "aws_subnet" "b" {
+  vpc_id            = data.aws_vpc.default.id
+  availability_zone = data.aws_availability_zones.all.names[1]
+  default_for_az    = true
+}
+
+resource "random_password" "master_password" {
+  length  = 32
+  special = false
+}
+
+module "db" {
+  source = "./.."
+
+  project     = "terraform-modules-mysql"
+  environment = "example"
+
+  vpc_id     = data.aws_vpc.default.id
+  subnet_ids = [data.aws_subnet.a.id, data.aws_subnet.b.id]
+  multi_az   = false
+
+  instance_type = "db.t2.micro"
+  storage       = 20
+  public        = true
+  username      = "terraform_modules"
+  password      = random_password.master_password.result
+
+  prevent_destroy = false
+}
+
+output "master_db_url" {
+  value     = module.db.url
+  sensitive = true
+}
+
+# Management lambda invocation examples ---------------------------------------
+
+locals {
+  environments = toset(["development", "production"])
+}
+
+resource "null_resource" "environment_db_user" {
+  for_each = local.environments
+
+  triggers = {
+    name = "terraform_modules_${each.key}"
+  }
+
+  provisioner "local-exec" {
+    when    = create
+    command = module.db.management_lambda.invoke_script
+    environment = { EVENT = jsonencode({
+      queries = ["CREATE USER '${self.triggers.name}'@'%'"]
+    }) }
+  }
+
+  provisioner "local-exec" {
+    when    = destroy
+    command = module.db.management_lambda.invoke_script
+    environment = { EVENT = jsonencode({
+      queries = ["DROP USER '${self.triggers.name}'@'%'"]
+    }) }
+  }
+}
+
+resource "random_password" "environment_db_password" {
+  for_each = local.environments
+
+  length  = 32
+  special = false
+}
+
+resource "null_resource" "environment_db_password" {
+  for_each = local.environments
+
+  triggers = {
+    name     = null_resource.environment_db_user[each.key].triggers.name
+    password = random_password.environment_db_password[each.key].result
+  }
+
+  provisioner "local-exec" {
+    when    = create
+    command = module.db.management_lambda.invoke_script
+    environment = { EVENT = jsonencode({
+      queries = [
+        "ALTER USER '${self.triggers.name}'@'%' IDENTIFIED BY '${self.triggers.password}'"
+      ]
+    }) }
+  }
+}
+
+resource "null_resource" "environment_db" {
+  for_each = local.environments
+
+  triggers = {
+    name  = null_resource.environment_db_user[each.key].triggers.name
+    owner = null_resource.environment_db_user[each.key].triggers.name
+  }
+
+  provisioner "local-exec" {
+    when    = create
+    command = module.db.management_lambda.invoke_script
+    environment = { EVENT = jsonencode({
+      queries = [
+        "CREATE DATABASE ${self.triggers.name}",
+        "GRANT ALL ON ${self.triggers.name}.* TO '${self.triggers.owner}'@'%'"
+      ]
+    }) }
+  }
+
+  provisioner "local-exec" {
+    when    = destroy
+    command = module.db.management_lambda.invoke_script
+    environment = { EVENT = jsonencode({
+      queries = ["DROP DATABASE ${self.triggers.name}"]
+    }) }
+  }
+}
+
+locals {
+  environment_dbs = {
+    for environment in local.environments : environment => {
+      host     = module.db.host
+      port     = module.db.port
+      name     = null_resource.environment_db[environment].triggers.name
+      user     = null_resource.environment_db_user[environment].triggers.name
+      password = null_resource.environment_db_password[environment].triggers.password
+    }
+  }
+  environment_db_urls = {
+    for environment, database in local.environment_dbs : environment =>
+    "mysql://${database.user}:${database.password}@${database.host}:${database.port}/${database.name}"
+  }
+}
+
+output "development_db" {
+  value     = local.environment_dbs.development
+  sensitive = true
+}
+
+output "development_db_url" {
+  value     = local.environment_db_urls.development
+  sensitive = true
+}
+
+output "production_db" {
+  value     = local.environment_dbs.production
+  sensitive = true
+}
+
+output "production_db_url" {
+  value     = local.environment_db_urls.production
+  sensitive = true
+}

rds/mysql/main.tf

@@ -0,0 +1,111 @@
+locals {
+  name = "${var.project}-${var.environment}"
+  db   = var.db != null ? var.db : replace(var.project, "-", "_")
+
+  default_tags = {
+    Name        = local.name
+    Project     = var.project
+    Environment = var.environment
+  }
+
+  tags = merge(local.default_tags, var.tags)
+}
+
+resource "aws_db_subnet_group" "db" {
+  count = var.create ? 1 : 0
+
+  name       = local.name
+  subnet_ids = var.subnet_ids
+  tags       = local.tags
+}
+
+resource "aws_security_group" "db" {
+  count = var.create ? 1 : 0
+
+  name   = "${local.name}-db"
+  vpc_id = var.vpc_id
+  tags = merge(
+    local.tags,
+    {
+      "Name" = "${local.name}-db"
+    },
+  )
+}
+
+resource "aws_security_group_rule" "private" {
+  count = var.create ? length(var.security_group_ids) : 0
+
+  security_group_id        = aws_security_group.db[0].id
+  type                     = "ingress"
+  from_port                = 0
+  to_port                  = 0
+  protocol                 = "-1"
+  source_security_group_id = element(var.security_group_ids, count.index)
+}
+
+resource "aws_security_group_rule" "public" {
+  count = var.create && var.public ? 1 : 0
+
+  security_group_id = aws_security_group.db[0].id
+  type              = "ingress"
+  from_port         = 0
+  to_port           = 0
+  protocol          = "-1"
+  cidr_blocks       = ["0.0.0.0/0"]
+}
+
+resource "aws_db_instance" "db" {
+  count = var.create ? 1 : 0
+
+  identifier = local.name
+
+  engine                     = "mysql"
+  engine_version             = var.mysql_version
+  storage_type               = "gp2"
+  allocated_storage          = var.storage
+  instance_class             = var.instance_type
+  db_subnet_group_name       = aws_db_subnet_group.db[0].name
+  multi_az                   = var.multi_az
+  deletion_protection        = var.prevent_destroy
+  final_snapshot_identifier  = "${local.name}-final"
+  vpc_security_group_ids     = [aws_security_group.db[0].id]
+  publicly_accessible        = var.public
+  backup_retention_period    = var.backup_retention_period
+  copy_tags_to_snapshot      = true
+  auto_minor_version_upgrade = false
+
+  port     = var.port
+  name     = local.db
+  username = var.username
+  password = var.password
+
+  tags = local.tags
+}
+
+locals {
+  host   = var.create ? aws_db_instance.db[0].address : ""
+  port   = var.create ? aws_db_instance.db[0].port : ""
+  db_url = var.create ? "mysql://${var.username}:${var.password}@${local.host}:${local.port}/${local.db}" : ""
+}
+
+module "management_lambda" {
+  source = "./management_lambda"
+  create = var.create && var.create_management_lambda
+
+  name         = "${local.name}-db-management"
+  tags         = var.tags
+  database_url = local.db_url
+  vpc_id       = var.vpc_id
+  subnet_ids   = var.subnet_ids
+}
+
+resource "aws_security_group_rule" "management_lambda" {
+  count = var.create && var.create_management_lambda ? 1 : 0
+
+  security_group_id        = aws_security_group.db[0].id
+  type                     = "ingress"
+  from_port                = 0
+  to_port                  = 0
+  protocol                 = "-1"
+  source_security_group_id = module.management_lambda.security_group_id
+}