infra/db.tf at main · globalbibletools/infra · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
data "aws_rds_engine_version" "postgres" {
  engine = "postgres"
  parameter_group_family = "postgres14"
}

resource "aws_db_parameter_group" "postgres" {
  name = "gbt-platform"
  family = data.aws_rds_engine_version.postgres.parameter_group_family
  description = "Parameters for the Platform Postgres database"

  parameter {
    apply_method = "pending-reboot"
    name         = "cron.database_name"
    value        = "prod"
  }

  parameter {
    apply_method = "pending-reboot"
    name         = "shared_preload_libraries"
    value        = "pg_stat_statements,pg_cron"
  }
}

resource "aws_db_instance" "default" {
  identifier = var.db_identifier
  allocated_storage   = 20
  engine              = "postgres"
  instance_class      = "db.t4g.medium"
  password            = var.db_master_password
  username            = var.db_master_username
  deletion_protection = true
  backup_retention_period = 7
  enabled_cloudwatch_logs_exports = [
    "postgresql"
  ]
  performance_insights_enabled = true
  storage_encrypted = true
  publicly_accessible = true
  skip_final_snapshot = true
  parameter_group_name    = aws_db_parameter_group.postgres.name

  depends_on = [aws_cloudwatch_log_group.postgres]
}

resource "aws_cloudwatch_log_group" "postgres" {
  name = "/aws/rds/instance/${var.db_identifier}/postgresql"
}

provider "postgresql" {
  host            = aws_db_instance.default.address
  port            = aws_db_instance.default.port
  database        = "postgres"
  username        = var.db_master_username
  password        = var.db_master_password
  sslmode         = "require"
  connect_timeout = 15
  superuser       = false
}

resource "postgresql_database" "prod" {
  name = "prod"
}

resource "postgresql_role" "app" {
  login    = true
  name     = var.db_app_username
  password = var.db_app_password
}

resource "postgresql_grant" "create" {
  database    = postgresql_database.prod.name
  role        = postgresql_role.app.name
  schema      = "public"
  object_type = "database"
  privileges  = ["CREATE"]
}

resource "postgresql_role" "adrian" {
  login    = true
  name     = var.db_adrian_username
  password = var.db_adrian_password
}

resource "postgresql_grant" "create_adrian" {
  database    = postgresql_database.prod.name
  role        = postgresql_role.adrian.name
  schema      = "public"
  object_type = "database"
  privileges  = ["CREATE"]
}

locals {
    database_url = "postgresql://${postgresql_role.app.name}:${postgresql_role.app.password}@${aws_db_instance.default.address}:${aws_db_instance.default.port}/${postgresql_database.prod.name}"
}

# Backup
resource "aws_backup_vault" "rds" {
  name        = "rds_backup_vault"
}

resource "aws_backup_plan" "rds" {
  name = "rds-backup"

  rule {
    rule_name         = "daily"
    target_vault_name = aws_backup_vault.rds.name
    schedule          = "cron(30 6 * * ? *)" # 6:30 AM UTC
    lifecycle {
      delete_after = 7
    }
  }

  rule {
    rule_name         = "weekly"
    target_vault_name = aws_backup_vault.rds.name
    schedule          = "cron(0 7 ? * 2 *)" # 7 AM UTC every Monday
    lifecycle {
      delete_after = 6
    }
  }

  rule {
    rule_name         = "monthly"
    target_vault_name = aws_backup_vault.rds.name
    schedule          = "cron(30 7 1 * ? *)" # 7:30 AM UTC first of the month
    lifecycle {
      delete_after = 8
    }
  }
}

data "aws_iam_policy_document" "backup_assume_role" {
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["backup.amazonaws.com"]
    }

    actions = ["sts:AssumeRole"]
  }
}
resource "aws_iam_role" "backup" {
  name               = "backup"
  assume_role_policy = data.aws_iam_policy_document.backup_assume_role.json
}
resource "aws_iam_role_policy_attachment" "backup" {
  role       = aws_iam_role.backup.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup"
}

resource "aws_backup_selection" "rds" {
  name          = "rds-backup"
  plan_id = aws_backup_plan.rds.id
  iam_role_arn = aws_iam_role.backup.arn

  resources = [
    aws_db_instance.default.arn
  ]
}