diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..e9e51ed --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1 @@ +* @Datatamer/devops @Datatamer/ci-team diff --git a/README.md b/README.md index 13ce6e5..9017b64 100644 --- a/README.md +++ b/README.md @@ -29,6 +29,7 @@ Smallest complete fully working example. This example might require extra resour This terraform module will create: * an AWS RDS Postgres instance * a database parameter group +* a database subnet group * a security group for the rds instance @@ -49,11 +50,11 @@ This terraform module will create: | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| -| password | The postgres password | `string` | n/a | yes | +| password | The password for the master DB user. | `string` | n/a | yes | | rds\_subnet\_ids | VPC subnet IDs in subnet group | `list(string)` | n/a | yes | -| spark\_cluster\_sg\_ids | Security group is attached to the ec2 instances of EMR Spark | `list(string)` | n/a | yes | +| spark\_cluster\_sg\_ids | List of Spark service access security group IDs to allow ingress from | `list(string)` | n/a | yes | | subnet\_group\_name | The name of the subnet group to add the RDS instance to | `string` | n/a | yes | -| tamr\_vm\_sg\_id | Security group id attached to the tamr vm | `string` | n/a | yes | +| tamr\_vm\_sg\_id | Tamr VM security group ID to allow ingress from | `string` | n/a | yes | | vpc\_id | VPC ID for the rds security group | `string` | n/a | yes | | additional\_cidrs | Additional CIDR to connect to RDS Postgres instance | `list(string)` | `[]` | no | | additional\_tags | Additional tags to set on the RDS instance | `map` | `{}` | no | @@ -69,11 +70,11 @@ This terraform module will create: | max\_allocated\_storage | Max allocate storage | `number` | `1000` | no | | parameter\_group\_family | The family of the DB parameter group | `string` | `"postgres12"` | no | | parameter\_group\_name | The name of the rds parameter group | `string` | `"rds-postgres-pg"` | no | -| postgres\_name | The name of the postgres instance | `string` | `"tamr_rds_db"` | no | +| postgres\_name | The name of the postgres database to create on the DB instance | `string` | `"tamr_rds_db"` | no | | security\_group\_name | Name for the security group for the rds instance | `string` | `"tamr_rds_sg"` | no | | skip\_final\_snapshot | Skip final snapshot | `bool` | `true` | no | | storage\_type | Storage type (e.g. gp2, io1) | `string` | `"gp2"` | no | -| username | The postgres username | `string` | `"tamr"` | no | +| username | The username for the master DB user. | `string` | `"tamr"` | no | ## Outputs diff --git a/examples/minimal/README.md b/examples/minimal/README.md index c1e93a3..8fc9100 100644 --- a/examples/minimal/README.md +++ b/examples/minimal/README.md @@ -11,11 +11,10 @@ No provider. | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| -| identifier\_prefix | Identifier prefix for the resources | `string` | n/a | yes | -| parameter\_group\_name | Name of the parameter group | `string` | n/a | yes | -| pg\_password | Password for postgres | `string` | n/a | yes | -| pg\_username | Username for postgres | `string` | n/a | yes | -| postgres\_db\_name | Name of the postgres db | `string` | n/a | yes | +| spark\_service\_access\_sg\_ids | List of Spark service access security group IDs to allow ingress from | `list(string)` | n/a | yes | +| subnet\_ids | List of at least 2 subnets in different AZs for DB subnet group | `list(string)` | n/a | yes | +| tamr\_vm\_sg\_id | Security group ID of Tamr VM to allow ingress from | `string` | n/a | yes | +| vpc\_id | VPC ID of network. | `string` | n/a | yes | ## Outputs diff --git a/examples/minimal/local.tfvars b/examples/minimal/local.tfvars index 1efdbec..f0745ba 100644 --- a/examples/minimal/local.tfvars +++ b/examples/minimal/local.tfvars @@ -1 +1,4 @@ -postgres_db_name = "example_postgres_db" +vpc_id = "vpc-example" +subnet_ids = ["subnet-az1", "subnet-az2"] +spark_service_access_sg_ids = ["example-spark-service-access-sg"] +tamr_vm_sg_id = "example-tamr-vm-sg" diff --git a/examples/minimal/main.tf b/examples/minimal/main.tf index d614aa4..2f10ea4 100644 --- a/examples/minimal/main.tf +++ b/examples/minimal/main.tf @@ -1,15 +1,18 @@ module "rds_postgres" { - source = "git::https://github.com/Datatamer/terraform-aws-rds-postgres.git?ref=0.3.0" - postgres_name = "example_rds_postgres" + # source = "git::https://github.com/Datatamer/terraform-aws-rds-postgres.git?ref=0.3.0" + source = "../.." + + identifier_prefix = "example-rds-pg-" + postgres_name = "example0" parameter_group_name = "example-rds-postgres-pg" - identifier_prefix = "example-rds-" + username = "example-tamr-master" + password = "foo" #tfsec:ignore:GEN003 - username = "exampleUsername" - password = "examplePassword" + vpc_id = var.vpc_id + subnet_group_name = "example_subnet_group" + # Network requirement: DB subnet group needs a subnet in at least two Availability Zones + rds_subnet_ids = var.subnet_ids - subnet_group_name = "example_subnet" - rds_subnet_ids = ["example-subnet-1", "example-subnet-2"] - spark_cluster_sg_ids = ["sg-examplesecuritygroup1", "sg-examplesecuritygroup2"] - tamr_vm_sg_id = "sg-exampletamrsecuritygroup" - vpc_id = "vpc-examplevpcnetworkid" + spark_cluster_sg_ids = var.spark_service_access_sg_ids + tamr_vm_sg_id = var.tamr_vm_sg_id } diff --git a/examples/minimal/variables.tf b/examples/minimal/variables.tf index c602e2c..e68e9d9 100644 --- a/examples/minimal/variables.tf +++ b/examples/minimal/variables.tf @@ -1,24 +1,19 @@ -variable "postgres_db_name" { +variable "vpc_id" { type = string - description = "Name of the postgres db" + description = "VPC ID of network." } -variable "parameter_group_name" { - type = string - description = "Name of the parameter group" +variable "subnet_ids" { + type = list(string) + description = "List of at least 2 subnets in different AZs for DB subnet group" } -variable "identifier_prefix" { - type = string - description = "Identifier prefix for the resources" -} - -variable "pg_username" { - type = string - description = "Username for postgres" +variable "spark_service_access_sg_ids" { + type = list(string) + description = "List of Spark service access security group IDs to allow ingress from" } -variable "pg_password" { +variable "tamr_vm_sg_id" { type = string - description = "Password for postgres" + description = "Security group ID of Tamr VM to allow ingress from" } diff --git a/modules/rds-postgres-sg/main.tf b/modules/rds-postgres-sg/main.tf index 2436aad..6aa4efa 100644 --- a/modules/rds-postgres-sg/main.tf +++ b/modules/rds-postgres-sg/main.tf @@ -6,6 +6,7 @@ resource "aws_security_group" "rds_postgres_sg" { } resource "aws_security_group_rule" "tamr_vm" { + description = "Rule for ingress from Tamr VM to Postgres" from_port = 5432 protocol = "tcp" security_group_id = aws_security_group.rds_postgres_sg.id @@ -15,6 +16,7 @@ resource "aws_security_group_rule" "tamr_vm" { } resource "aws_security_group_rule" "spark_cluster" { + description = "Rule for ingress from Spark cluster to Postgres" count = length(var.spark_cluster_sg_ids) from_port = 5432 protocol = "tcp" @@ -25,6 +27,7 @@ resource "aws_security_group_rule" "spark_cluster" { } resource "aws_security_group_rule" "additional_cidrs" { + description = "Rule for ingress from additional CIDRs to Postgres" count = length(var.additional_cidrs) == 0 ? 0 : 1 from_port = 5432 protocol = "tcp" diff --git a/variables.tf b/variables.tf index 20762d3..f794ea9 100644 --- a/variables.tf +++ b/variables.tf @@ -1,16 +1,16 @@ variable "password" { - description = "The postgres password" + description = "The password for the master DB user." type = string } variable "username" { - description = "The postgres username" + description = "The username for the master DB user." type = string default = "tamr" } variable "postgres_name" { - description = "The name of the postgres instance" + description = "The name of the postgres database to create on the DB instance" type = string default = "tamr_rds_db" } @@ -23,7 +23,7 @@ variable "parameter_group_name" { variable "identifier_prefix" { description = "Identifier prefix for the RDS instance" - type = "string" + type = string default = "tamr-rds-" } @@ -110,12 +110,12 @@ variable "security_group_name" { } variable "tamr_vm_sg_id" { - description = "Security group id attached to the tamr vm" + description = "Tamr VM security group ID to allow ingress from" type = string } variable "spark_cluster_sg_ids" { - description = "Security group is attached to the ec2 instances of EMR Spark" + description = "List of Spark service access security group IDs to allow ingress from" type = list(string) }