|
| 1 | +locals { |
| 2 | + region = "us-east-2" |
| 3 | + name = "postgresql" |
| 4 | + family = "postgres15" |
| 5 | + vpc_cidr = "10.20.0.0/16" |
| 6 | + environment = "prod" |
| 7 | + storage_type = "gp3" |
| 8 | + engine_version = "15.2" |
| 9 | + instance_class = "db.m5d.large" |
| 10 | + replica_enable = true |
| 11 | + replica_count = 1 |
| 12 | + current_identity = data.aws_caller_identity.current.arn |
| 13 | + allowed_security_groups = ["sg-0a680afd35"] |
| 14 | + additional_tags = { |
| 15 | + Owner = "Organization_Name" |
| 16 | + Expires = "Never" |
| 17 | + Department = "Engineering" |
| 18 | + } |
| 19 | +} |
| 20 | + |
| 21 | +data "aws_caller_identity" "current" {} |
| 22 | +data "aws_region" "current" {} |
| 23 | + |
| 24 | +module "kms" { |
| 25 | + source = "terraform-aws-modules/kms/aws" |
| 26 | + |
| 27 | + deletion_window_in_days = 7 |
| 28 | + description = "Complete key example showing various configurations available" |
| 29 | + enable_key_rotation = true |
| 30 | + is_enabled = true |
| 31 | + key_usage = "ENCRYPT_DECRYPT" |
| 32 | + multi_region = true |
| 33 | + |
| 34 | + # Policy |
| 35 | + enable_default_policy = true |
| 36 | + key_owners = [local.current_identity] |
| 37 | + key_administrators = [local.current_identity] |
| 38 | + key_users = [local.current_identity] |
| 39 | + key_service_users = [local.current_identity] |
| 40 | + key_statements = [ |
| 41 | + { |
| 42 | + sid = "CloudWatchLogs" |
| 43 | + actions = [ |
| 44 | + "kms:Encrypt*", |
| 45 | + "kms:Decrypt*", |
| 46 | + "kms:ReEncrypt*", |
| 47 | + "kms:GenerateDataKey*", |
| 48 | + "kms:Describe*" |
| 49 | + ] |
| 50 | + resources = ["*"] |
| 51 | + |
| 52 | + principals = [ |
| 53 | + { |
| 54 | + type = "AWS" |
| 55 | + identifiers = ["*"] |
| 56 | + } |
| 57 | + ] |
| 58 | + } |
| 59 | + ] |
| 60 | + |
| 61 | + # Aliases |
| 62 | + aliases = ["${local.name}"] |
| 63 | + |
| 64 | + tags = local.additional_tags |
| 65 | +} |
| 66 | + |
| 67 | + |
| 68 | +module "vpc" { |
| 69 | + source = "squareops/vpc/aws" |
| 70 | + name = local.name |
| 71 | + vpc_cidr = local.vpc_cidr |
| 72 | + environment = local.environment |
| 73 | + availability_zones = ["us-east-2a", "us-east-2b"] |
| 74 | + public_subnet_enabled = true |
| 75 | + auto_assign_public_ip = true |
| 76 | + intra_subnet_enabled = false |
| 77 | + private_subnet_enabled = true |
| 78 | + one_nat_gateway_per_az = false |
| 79 | + database_subnet_enabled = true |
| 80 | +} |
| 81 | + |
| 82 | +module "rds-pg" { |
| 83 | + source = "squareops/rds-postgresql/aws" |
| 84 | + name = local.name |
| 85 | + db_name = "postgres" |
| 86 | + family = local.family |
| 87 | + multi_az = "true" |
| 88 | + vpc_id = module.vpc.vpc_id |
| 89 | + subnet_ids = module.vpc.database_subnets ## db subnets |
| 90 | + environment = local.environment |
| 91 | + replica_enable = local.replica_enable |
| 92 | + replica_count = local.replica_count |
| 93 | + kms_key_arn = module.kms.key_arn |
| 94 | + storage_type = local.storage_type |
| 95 | + engine_version = local.engine_version |
| 96 | + instance_class = local.instance_class |
| 97 | + master_username = "pguser" |
| 98 | + allocated_storage = "20" |
| 99 | + max_allocated_storage = 120 |
| 100 | + publicly_accessible = false |
| 101 | + skip_final_snapshot = true |
| 102 | + backup_window = "03:00-06:00" |
| 103 | + maintenance_window = "Mon:00:00-Mon:03:00" |
| 104 | + final_snapshot_identifier_prefix = "final" |
| 105 | + major_engine_version = local.engine_version |
| 106 | + deletion_protection = true |
| 107 | + cloudwatch_metric_alarms_enabled = true |
| 108 | + alarm_cpu_threshold_percent = 70 |
| 109 | + disk_free_storage_space = "10000000" # in bytes |
| 110 | + slack_username = "Admin" |
| 111 | + slack_channel = "postgresql-notification" |
| 112 | + slack_webhook_url = "https://hooks/xxxxxxxx" |
| 113 | +} |
0 commit comments