/
rds-oracle-main.template.yaml
820 lines (802 loc) · 29.2 KB
/
rds-oracle-main.template.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
Description: "AWS VPC + Linux bastion host + RDS Oracle, Do Not Remove Apache License Version 2.0 (qs-4j2ios84d9) Aug 12, 2023"
Metadata:
LICENSE: Apache License Version 2.0
cfn-lint:
config:
ignore_checks:
- E9101
- I3011
###############################################################################
# Parameter groups
###############################################################################
AWS::CloudFormation::Interface:
ParameterGroups:
- Label:
default: Network configuration
Parameters:
- AvailabilityZones
- VPCCIDR
- PrivateSubnet1CIDR
- PrivateSubnet2CIDR
- PrivateSubnet3CIDR
- PublicSubnet1CIDR
- PublicSubnet2CIDR
- PublicSubnet3CIDR
- Label:
default: Linux Bastion Host configuration
Parameters:
- EnableBastion
- KeyPairName
- RemoteAccessCIDR
- EnableTCPForwarding
- Label:
default: Database General configuration
Parameters:
- DBArchitecture
- DBEdition
- DBEngineVersion
- DBLicense
- DBInstanceClass
- DBPort
- DBName
- DBMasterUsername
- ManageMasterUserPassword
- DBMasterUserPassword
- DBMultiAZ
- DBAutoMinorVersionUpgrade
- DBBackupRetentionPeriod
- Label:
default: Database Storage configuration
Parameters:
- DBStorageType
- DBAllocatedStorage
- DBAllocatedStorageEncrypted
- StorageIOPS
- StorageThroughput
- StorageAutoScaling
- MaxStorageThreshold
- Label:
default: Database Monitoring configuration
Parameters:
- DBExportLogToCloudwatch
- EnablePerformanceInsights
- PerformanceInsightsRetentionPeriod
- EnableEnhancedMonitoring
- MonitoringInterval
- EnableEventSubscription
- NotificationList
- Label:
default: "[Optional] Database tags"
Parameters:
- EnvironmentStage
- Application
- ApplicationVersion
- ProjectCostCenter
- Confidentiality
- Compliance
- Label:
default: Quick Start configuration
Parameters:
- QSS3BucketName
- QSS3BucketRegion
- QSS3KeyPrefix
###############################################################################
# Parameter labels
###############################################################################
ParameterLabels:
#VPC stack related parameter labels
AvailabilityZones:
default: Availability Zones
PrivateSubnet1CIDR:
default: Private subnet 1 CIDR
PrivateSubnet2CIDR:
default: Private subnet 2 CIDR
PrivateSubnet3CIDR:
default: Private subnet 3 CIDR
PublicSubnet1CIDR:
default: Public subnet 1 CIDR
PublicSubnet2CIDR:
default: Public subnet 2 CIDR
PublicSubnet3CIDR:
default: Public subnet 3 CIDR
VPCCIDR:
default: VPC CIDR
#Bastion host related parameter labels
EnableBastion:
default: Create bastion stack
EnableTCPForwarding:
default: Enable TCP Forwarding
KeyPairName:
default: Key Name
RemoteAccessCIDR:
default: Permitted IP range
#Quickstart related parameter labels
QSS3BucketName:
default: Quick Start S3 bucket name
QSS3BucketRegion:
default: Quick Start S3 bucket region
QSS3KeyPrefix:
default: Quick Start S3 key prefix
#RDS related parameter labels
Application:
default: Application name
ApplicationVersion:
default: Application version
Compliance:
default: Compliance classifier
Confidentiality:
default: Confidentiality classifier
DBAllocatedStorage:
default: Database allocated storage size in GiB
DBAllocatedStorageEncrypted:
default: Database encryption enabled
DBArchitecture:
default: CDB or NonCDB
DBAutoMinorVersionUpgrade:
default: Database auto minor version upgrade
DBBackupRetentionPeriod:
default: Database backup retention period
DBEdition:
default: Oracle Edition
DBEngineVersion:
default: Database Engine Version
DBExportLogToCloudwatch:
default: Export Database Log to CloudWatch
DBInstanceClass:
default: Database instance class
DBLicense:
default: Database license
DBMasterUsername:
default: Database master username
DBMasterUserPassword:
default: Database master password
DBMultiAZ:
default: RDS Multi-AZ DB Instance deployment
DBName:
default: Oracle SID
DBPort:
default: Database port
DBStorageType:
default: Database storage type
EnableEnhancedMonitoring:
default: Enable Enhanced Monitoring
EnableEventSubscription:
default: Enable Event Subscription
EnablePerformanceInsights:
default: Enable RDS Performance Insights
EnvironmentStage:
default: Environment stage
ManageMasterUserPassword:
default: (NonCDB ONLY) Manage DB master user password with AWS Secrets Manager
MaxStorageThreshold:
default: Limit for storage auto scaling in GiB
MonitoringInterval:
default: Enhanced monitoring interval
NotificationList:
default: SNS notification email
PerformanceInsightsRetentionPeriod:
default: Number of days to retain Performance Insights data
ProjectCostCenter:
default: Project cost center
StorageIOPS:
default: Provisioned IOPS for gp3/io1 storage type
StorageThroughput:
default: Provisioned Throughput for gp3 storage type in MiBps
StorageAutoScaling:
default: Enable storage auto scaling
###############################################################################
# Parameters
###############################################################################
Parameters:
#VPC stack related parameters
AvailabilityZones:
Description: >-
List of Availability Zones to use for the subnets in the VPC. Only three
Availability Zones are used for this deployment, and the logical order of
your selections is preserved.
Type: 'List<AWS::EC2::AvailabilityZone::Name>'
PrivateSubnet1CIDR:
AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
Default: 10.0.0.0/19
Description: CIDR block for private subnet 1 located in Availability Zone 1.
Type: String
PrivateSubnet2CIDR:
AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
Default: 10.0.32.0/19
Description: CIDR block for private subnet 2 located in Availability Zone 2.
Type: String
PrivateSubnet3CIDR:
AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
Default: 10.0.64.0/19
Description: CIDR block for private subnet 3 located in Availability Zone 3.
Type: String
PublicSubnet1CIDR:
AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
Default: 10.0.96.0/20
Description: CIDR block for the public subnet 1 located in Availability Zone 1.
Type: String
PublicSubnet2CIDR:
AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
Default: 10.0.128.0/20
Description: CIDR block for the public subnet 2 located in Availability Zone 2.
Type: String
PublicSubnet3CIDR:
AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
Default: 10.0.160.0/20
Description: CIDR block for the public subnet 3 located in Availability Zone 3.
Type: String
VPCCIDR:
AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
Default: 10.0.0.0/16
Description: CIDR block for the VPC.
Type: String
#Bastion host related parameters
EnableBastion:
AllowedValues:
- "true"
- "false"
Default: "true"
Description: "If 'true', a bastion stack will be created."
Type: String
EnableTCPForwarding:
Type: String
Description: Enable/Disable TCP Forwarding for the bastion host
Default: 'false'
AllowedValues:
- 'true'
- 'false'
KeyPairName:
ConstraintDescription: "Name of an existing EC2 key pair."
Description: Name of an existing public/private key pair, for connecting to the bastion host.
Type: "AWS::EC2::KeyPair::KeyName"
RemoteAccessCIDR:
AllowedPattern: "^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\\/([0-9]|[1-2][0-9]|3[0-2]))$"
ConstraintDescription: "CIDR block parameter must be in the form x.x.x.x/x"
Description: "Allowed CIDR block for external SSH access to the bastion host."
Default: 10.0.0.0/16
Type: String
#Quickstart related parameters
QSS3BucketName:
AllowedPattern: "^[0-9a-zA-Z]+([0-9a-zA-Z-]*[0-9a-zA-Z])*$"
ConstraintDescription: "Quick Start bucket name can include numbers, lowercase letters, uppercase letters, and hyphens (-). It cannot start or end with a hyphen (-)."
Default: aws-ia
Description: "S3 bucket name for the Quick Start assets. Quick Start bucket name can include numbers, lowercase letters, uppercase letters, and hyphens (-). It cannot start or end with a hyphen (-)."
Type: String
QSS3BucketRegion:
Default: 'us-east-1'
Description: 'The AWS Region where the Quick Start S3 bucket (QSS3BucketName) is hosted. When using your own bucket, you must specify this value.'
Type: String
QSS3KeyPrefix:
AllowedPattern: "^[0-9a-zA-Z-/]*$"
ConstraintDescription: "Quick Start key prefix can include numbers, lowercase letters, uppercase letters, hyphens (-), and forward slash (/)."
Default: cfn-ps-amazon-rds/
Description: "S3 key prefix for the Quick Start assets. Quick Start key prefix can include numbers, lowercase letters, uppercase letters, hyphens (-), and forward slash (/)."
Type: String
#RDS related parameters
DBAllocatedStorage:
Default: 100
Description: Allocated storage size in GiB. For gp2 and gp3, must be an integer from 20 to 65536. For io1, must be an integer from 100 to 65536.
Type: Number
MinValue: 20
MaxValue: 65536
ConstraintDescription: Must be an integer from 20 to 65536 for gp2/gp3 and 100 to 65536 for io1.
DBAllocatedStorageEncrypted:
Default: "true"
AllowedValues:
- "true"
- "false"
Description: Whether or not to encrypt the database.
Type: String
DBArchitecture:
Description: "Select multitenant architecture"
Type: String
Default: NonCDB
AllowedValues:
- NonCDB
- CDB
DBAutoMinorVersionUpgrade:
AllowedValues:
- "true"
- "false"
Default: "true"
Description: "Select 'true' to set up auto minor version upgrade."
Type: String
DBBackupRetentionPeriod:
Default: 35
Description: "The number of days for which automatic database snapshots are retained."
Type: Number
MinValue: 0
MaxValue: 35
DBEdition:
Description: "Select Oracle Edition"
Type: String
Default: OracleEnterpriseEdition
AllowedValues:
- OracleEnterpriseEdition
- OracleStandardEditionTwo
DBEngineVersion:
Description: Select Database Engine Version
Type: String
Default: 19.0.0.0.ru-2023-07.rur-2023-07.r1
AllowedValues:
- 19.0.0.0.ru-2019-07.rur-2019-07.r1
- 19.0.0.0.ru-2019-10.rur-2019-10.r1
- 19.0.0.0.ru-2020-01.rur-2020-01.r1
- 19.0.0.0.ru-2020-04.rur-2020-04.r1
- 19.0.0.0.ru-2020-07.rur-2020-07.r1
- 19.0.0.0.ru-2020-10.rur-2020-10.r1
- 19.0.0.0.ru-2021-01.rur-2021-01.r1
- 19.0.0.0.ru-2021-01.rur-2021-01.r2
- 19.0.0.0.ru-2021-04.rur-2021-04.r1
- 19.0.0.0.ru-2021-07.rur-2021-07.r1
- 19.0.0.0.ru-2021-10.rur-2021-10.r1
- 19.0.0.0.ru-2022-01.rur-2022-01.r1
- 19.0.0.0.ru-2022-04.rur-2022-04.r1
- 19.0.0.0.ru-2022-07.rur-2022-07.r1
- 19.0.0.0.ru-2022-10.rur-2022-10.r1
- 19.0.0.0.ru-2023-01.rur-2023-01.r1
- 19.0.0.0.ru-2023-01.rur-2023-01.r2
- 19.0.0.0.ru-2023-04.rur-2023-04.r1
- 19.0.0.0.ru-2023-07.rur-2023-07.r1
- 21.0.0.0.ru-2022-01.rur-2022-01.r1
- 21.0.0.0.ru-2022-04.rur-2022-04.r1
- 21.0.0.0.ru-2022-07.rur-2022-07.r1
- 21.0.0.0.ru-2022-10.rur-2022-10.r1
- 21.0.0.0.ru-2023-01.rur-2023-01.r1
- 21.0.0.0.ru-2023-01.rur-2023-01.r2
- 21.0.0.0.ru-2023-04.rur-2023-04.r1
- 21.0.0.0.ru-2023-07.rur-2023-07.r1
DBExportLogToCloudwatch:
Default: ''
Description: Specify the comma-delimited list of database logs (alert, audit, listener, trace) to export to CloudWatch Logs.
Type: CommaDelimitedList
DBInstanceClass:
Default: db.r5.large
Description: >-
The database instance type.
Please see supported instance types for the RDS Oracle Engine version and edition selected https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.DBInstanceClass.html.
Type: String
AllowedValues:
- db.m5.12xlarge
- db.m5.16xlarge
- db.m5.24xlarge
- db.m5.2xlarge
- db.m5.4xlarge
- db.m5.8xlarge
- db.m5d.12xlarge
- db.m5d.16xlarge
- db.m5d.24xlarge
- db.m5d.2xlarge
- db.m5d.4xlarge
- db.m5d.8xlarge
- db.m5d.large
- db.m5d.xlarge
- db.m5.large
- db.m5.xlarge
- db.m6i.12xlarge
- db.m6i.16xlarge
- db.m6i.24xlarge
- db.m6i.2xlarge
- db.m6i.32xlarge
- db.m6i.4xlarge
- db.m6i.8xlarge
- db.m6i.large
- db.m6i.xlarge
- db.r5.12xlarge
- db.r5.12xlarge.tpc2.mem2x
- db.r5.16xlarge
- db.r5.24xlarge
- db.r5.2xlarge
- db.r5.2xlarge.tpc1.mem2x
- db.r5.2xlarge.tpc2.mem4x
- db.r5.2xlarge.tpc2.mem8x
- db.r5.4xlarge
- db.r5.4xlarge.tpc2.mem2x
- db.r5.4xlarge.tpc2.mem3x
- db.r5.4xlarge.tpc2.mem4x
- db.r5.6xlarge.tpc2.mem4x
- db.r5.8xlarge
- db.r5.8xlarge.tpc2.mem3x
- db.r5b.12xlarge
- db.r5b.16xlarge
- db.r5b.24xlarge
- db.r5b.2xlarge
- db.r5b.2xlarge.tpc1.mem2x
- db.r5b.2xlarge.tpc2.mem4x
- db.r5b.2xlarge.tpc2.mem8x
- db.r5b.4xlarge
- db.r5b.4xlarge.tpc2.mem2x
- db.r5b.4xlarge.tpc2.mem3x
- db.r5b.4xlarge.tpc2.mem4x
- db.r5b.6xlarge.tpc2.mem4x
- db.r5b.8xlarge
- db.r5b.8xlarge.tpc2.mem3x
- db.r5b.large
- db.r5b.large.tpc1.mem2x
- db.r5b.xlarge
- db.r5b.xlarge.tpc2.mem2x
- db.r5b.xlarge.tpc2.mem4x
- db.r5d.12xlarge
- db.r5d.16xlarge
- db.r5d.24xlarge
- db.r5d.2xlarge
- db.r5d.4xlarge
- db.r5d.8xlarge
- db.r5d.large
- db.r5d.xlarge
- db.r5.large
- db.r5.large.tpc1.mem2x
- db.r5.xlarge
- db.r5.xlarge.tpc2.mem2x
- db.r5.xlarge.tpc2.mem4x
- db.r6i.12xlarge
- db.r6i.16xlarge
- db.r6i.24xlarge
- db.r6i.2xlarge
- db.r6i.32xlarge
- db.r6i.4xlarge
- db.r6i.8xlarge
- db.r6i.large
- db.r6i.xlarge
- db.t3.2xlarge
- db.t3.large
- db.t3.medium
- db.t3.small
- db.t3.xlarge
- db.x1.16xlarge
- db.x1.32xlarge
- db.x1e.16xlarge
- db.x1e.2xlarge
- db.x1e.32xlarge
- db.x1e.4xlarge
- db.x1e.8xlarge
- db.x1e.xlarge
- db.x2idn.16xlarge
- db.x2idn.24xlarge
- db.x2idn.32xlarge
- db.x2iedn.16xlarge
- db.x2iedn.24xlarge
- db.x2iedn.2xlarge
- db.x2iedn.32xlarge
- db.x2iedn.4xlarge
- db.x2iedn.8xlarge
- db.x2iedn.xlarge
- db.x2iezn.12xlarge
- db.x2iezn.2xlarge
- db.x2iezn.4xlarge
- db.x2iezn.6xlarge
- db.x2iezn.8xlarge
- db.z1d.12xlarge
- db.z1d.2xlarge
- db.z1d.3xlarge
- db.z1d.6xlarge
- db.z1d.large
- db.z1d.xlarge
DBLicense:
Default: bring-your-own-license
Description: >-
Database license. Only valid for Oracle Standard Edition Two.
Type: String
AllowedValues:
- bring-your-own-license
- license-included
DBMasterUsername:
AllowedPattern: "[a-zA-Z][a-zA-Z0-9]*"
ConstraintDescription: "Must begin with a letter and contain only alphanumeric characters."
Description: (Required) The database master username. Must begin with a letter and contain only alphanumeric characters.
MaxLength: "16"
MinLength: "1"
Type: String
DBMasterUserPassword:
AllowedPattern: >-
^(?=^.{8,255}$)(?=.*[a-z])(?=.*[A-Z])(?=.*\d)((?=.*[^A-Za-z0-9])(?!.*[@/"'])).*$
ConstraintDescription: Min 8 chars. Must include 1 uppercase, 1 lowercase, 1 number, 1 (non / @ " ') symbol
Description: (Required) The database master user password. Min 8 chars. Must include 1 uppercase, 1 lowercase, 1 number, 1 (non / @ " ') symbol. Ignored if 'Manage DB master user password with AWS Secrets Manager' option is set to 'true'.
MaxLength: "30"
MinLength: "8"
NoEcho: "True"
Type: String
DBMultiAZ:
AllowedValues:
- "true"
- "false"
Default: "false"
Description: "Select 'true' to deploy a RDS Multi-AZ DB instance."
Type: String
DBName:
AllowedPattern: "[a-zA-Z0-9]*"
Description: "Oracle SID"
MaxLength: "8"
MinLength: "0"
Default: 'ORCL'
Type: String
DBPort:
Default: 1521
Description: "The port the instance will listen for connections on."
Type: Number
ConstraintDescription: 'Must be in the range [1150-65535].'
MinValue: 1150
MaxValue: 65535
DBStorageType:
Default: io1
Description: Select the EBS storage type for the RDS Oracle database.
Type: String
AllowedValues:
- gp2
- gp3
- io1
EnableEnhancedMonitoring:
AllowedValues:
- "true"
- "false"
Default: "true"
Description: Enables Enhanced Monitoring.
Type: String
EnableEventSubscription:
AllowedValues:
- "true"
- "false"
Default: "true"
Description: Enables event subscription to Notification List.
Type: String
EnablePerformanceInsights:
AllowedValues:
- "true"
- "false"
Default: "true"
Description: Enables RDS Performance Insights.
Type: String
ManageMasterUserPassword:
AllowedValues:
- "true"
- "false"
Default: "false"
Description: Set to 'true' to manage the master user password with AWS Secrets Manager if choosing NonCDB instance.
Type: String
MaxStorageThreshold:
Default: 150
Description: >-
The maximum storage threshold is the limit that you set for autoscaling the DB instance.
Must be at least 10% more than the current allocated storage.
For details, refer https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PIOPS.StorageTypes.html#USER_PIOPS.Autoscaling
Type: Number
MonitoringInterval:
Default: 10
Description: "The interval, in seconds, between points when Enhanced Monitoring metrics are collected for the database."
Type: Number
AllowedValues:
- 1
- 5
- 10
- 15
- 30
- 60
ConstraintDescription: Valid values are 0, 1, 5, 10, 15, 30, 60 seconds.
NotificationList:
Type: String
Default: 'db-ops@domain.com'
Description: The email notification used to configure an SNS topic for sending CloudWatch alarm and RDS event notifications.
AllowedPattern: '^(([^<>()\[\]\\.,;:\s@"]+(\.[^<>()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$'
ConstraintDescription: Provide a valid email address.
PerformanceInsightsRetentionPeriod:
Default: 7
Description: "The number of days for which automatic database snapshots are retained. Specify days based on (month * 31), where month is a number of months from 1-23."
Type: Number
MinValue: 7
MaxValue: 713
StorageAutoScaling:
Default: "true"
Description: >-
With storage autoscaling enabled, when Amazon RDS detects that you are running out of free database space it automatically scales up your storage.
For details, refer https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PIOPS.StorageTypes.html#USER_PIOPS.Autoscaling
Type: String
AllowedValues:
- "true"
- "false"
StorageIOPS:
Default: '0'
Description: >-
If you choose gp3 (and allocate >= 200 GiB) or io1, you must specify provisioned IOPS. Leave at default value otherwise.
For io1, the ratio of provisioned IOPS to allocated storage (in GiB) must be from 0.5 to 50, and range of provisioned IOPS is 1,000-256,000.
For gp3, the maximum ratio of provisioned IOPS to allocated storage (in GiB) is 500, and range of provisioned IOPS is 12,000–64,000.
For details, refer https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Storage.html
Type: String
StorageThroughput:
Default: '0'
Description: >-
Provisioned throughput in MiBps.
If you choose gp3 (and allocate >= 200 GiB) as storage type, you must specify provisioned throughput. Leave at default value otherwise.
The maximum ratio of provisioned storage throughput (in MiBps) to IOPS is 0.25 and the range of provisioned storage throughput is 500–4,000 MiBps.
For details, refer https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Storage.html
Type: String
#Optional parameters
Application:
Type: String
Default: ''
Description: "[Optional] Designates the application of the associated AWS resource."
ApplicationVersion:
Type: String
Description: "[Optional] Designates the specific version of the application."
Default: ''
Compliance:
Type: String
Default: ''
Description: "[Optional] Designates the compliance level for the AWS resource."
AllowedValues:
- hipaa
- sox
- fips
- other
- ''
Confidentiality:
Type: String
Default: ''
Description: "[Optional] Designates the confidentiality classification of the data that is associated with the resource."
AllowedValues:
- public
- private
- confidential
- pii/phi
- ''
EnvironmentStage:
Type: String
Description: "[Optional] Designates the environment stage of the associated AWS resource."
AllowedValues:
- dev
- test
- pre-prod
- prod
- none
Default: none
ProjectCostCenter:
Type: String
Default: ''
Description: "[Optional] Designates the cost center associated with the project of the given AWS resource."
###############################################################################
# Conditions
###############################################################################
Conditions:
EnableBastionAccess: !Equals
- !Ref EnableBastion
- "true"
UsingDefaultBucket: !Equals [!Ref QSS3BucketName, 'aws-ia']
###############################################################################
# Rules
###############################################################################
Rules:
IOPSForIO1:
Assertions:
- Assert: !Or [!Not [!Equals [!Ref DBStorageType, 'io1']], !Not [!Equals [!Ref StorageIOPS, '0']]]
AssertDescription: "For io1 storage type, you must specify provisioned IOPS"
MaxStorageThresholdforAutoScaling:
Assertions:
- Assert: !Or [!Not [!Equals [!Ref StorageAutoScaling, 'true']], !Not [!Equals [!Ref MaxStorageThreshold, '0']]]
AssertDescription: "Please enter a non-zero value for autoscaling limit, if enabling storage autoscaling."
###############################################################################
# Resources
###############################################################################
Resources:
VPCStack:
Type: 'AWS::CloudFormation::Stack'
Properties:
TemplateURL:
Fn::Sub:
- 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}submodules/cfn-ps-aws-vpc/templates/aws-vpc.template.yaml'
- S3Region: !If
- UsingDefaultBucket
- !Ref AWS::Region
- !Ref QSS3BucketRegion
S3Bucket: !If
- UsingDefaultBucket
- !Sub '${QSS3BucketName}-${AWS::Region}'
- !Ref QSS3BucketName
Parameters:
AvailabilityZones: !Join
- ','
- !Ref AvailabilityZones
NumberOfAZs: '3'
PrivateSubnet1ACIDR: !Ref PrivateSubnet1CIDR
PrivateSubnet2ACIDR: !Ref PrivateSubnet2CIDR
PrivateSubnet3ACIDR: !Ref PrivateSubnet3CIDR
PublicSubnet1CIDR: !Ref PublicSubnet1CIDR
PublicSubnet2CIDR: !Ref PublicSubnet2CIDR
PublicSubnet3CIDR: !Ref PublicSubnet3CIDR
VPCCIDR: !Ref VPCCIDR
BastionStack:
Condition: EnableBastionAccess
Type: 'AWS::CloudFormation::Stack'
Properties:
TemplateURL:
!Sub
- 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}submodules/cfn-ps-linux-bastion/templates/linux-bastion-entrypoint-existing-vpc.template.yaml'
- S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion]
S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
Parameters:
KeyPairName: !Ref KeyPairName
PublicSubnet1ID: !GetAtt
- VPCStack
- Outputs.PublicSubnet1ID
PublicSubnet2ID: !GetAtt
- VPCStack
- Outputs.PublicSubnet2ID
EnableTCPForwarding: !Ref EnableTCPForwarding
RemoteAccessCIDR: !Ref RemoteAccessCIDR
VPCID: !GetAtt
- VPCStack
- Outputs.VPCID
QSS3BucketName: !Ref QSS3BucketName
QSS3BucketRegion: !Ref QSS3BucketRegion
QSS3KeyPrefix: !Sub ${QSS3KeyPrefix}submodules/cfn-ps-linux-bastion/
RDSNS:
Type: AWS::CloudFormation::Stack
Properties:
TemplateURL:
!Sub
- 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}templates/rds-oracle.template.yaml'
- S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion]
S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName]
Parameters:
#Database Network configuration
VPCID:
Fn::GetAtt:
- VPCStack
- Outputs.VPCID
Subnet1ID:
Fn::GetAtt:
- VPCStack
- Outputs.PrivateSubnet1AID
Subnet2ID:
Fn::GetAtt:
- VPCStack
- Outputs.PrivateSubnet2AID
Subnet3ID:
Fn::GetAtt:
- VPCStack
- Outputs.PrivateSubnet3AID
DBAccessCIDR: !Ref VPCCIDR
#Database General configuration
DBArchitecture: !Ref DBArchitecture
DBEdition: !Ref DBEdition
DBEngineVersion: !Ref DBEngineVersion
DBInstanceClass: !Ref DBInstanceClass
DBPort: !Ref DBPort
DBName: !Ref DBName
DBMasterUsername: !Ref DBMasterUsername
DBLicense: !Ref DBLicense
ManageMasterUserPassword: !Ref ManageMasterUserPassword
DBMasterUserPassword: !Ref DBMasterUserPassword
DBMultiAZ: !Ref DBMultiAZ
DBAutoMinorVersionUpgrade: !Ref DBAutoMinorVersionUpgrade
DBBackupRetentionPeriod: !Ref DBBackupRetentionPeriod
#Database Storage configuration
DBStorageType: !Ref DBStorageType
DBAllocatedStorage: !Ref DBAllocatedStorage
DBAllocatedStorageEncrypted: !Ref DBAllocatedStorageEncrypted
MaxStorageThreshold: !Ref MaxStorageThreshold
StorageIOPS: !Ref StorageIOPS
StorageThroughput: !Ref StorageThroughput
StorageAutoScaling: !Ref StorageAutoScaling
#Database Monitoring configuration
DBExportLogToCloudwatch: !Join
- ','
- !Ref DBExportLogToCloudwatch
EnablePerformanceInsights: !Ref EnablePerformanceInsights
PerformanceInsightsRetentionPeriod: !Ref PerformanceInsightsRetentionPeriod
EnableEnhancedMonitoring: !Ref EnableEnhancedMonitoring
MonitoringInterval: !Ref MonitoringInterval
EnableEventSubscription: !Ref EnableEventSubscription
NotificationList: !Ref NotificationList
#Database tags (optional)
EnvironmentStage: !Ref EnvironmentStage
Application: !Ref Application
ApplicationVersion: !Ref ApplicationVersion
ProjectCostCenter: !Ref ProjectCostCenter
Confidentiality: !Ref Confidentiality
Compliance: !Ref Compliance