Skip to content

Commit ffaeadf

Browse files
hanimaohanimao
committed
modified infra
1 parent 1441e0f commit ffaeadf

12 files changed

Lines changed: 111 additions & 145 deletions

File tree

‎infra/environments/dev/backend.tf‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,14 @@
11
terraform {
22
required_providers {
33
aws = {
4-
source = "hashicorp/aws"
4+
source = "hashicorp/aws"
55
version = "6.24.0"
66
}
7+
8+
archive = {
9+
source = "hashicorp/archive"
10+
version = "2.7.1"
11+
}
712
}
813
}
914

@@ -31,6 +36,3 @@ provider "aws" {
3136
}
3237

3338

34-
35-
36-

‎infra/environments/dev/component.tf‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
resource "aws_vpc_endpoint" "main" {
2+
vpc_id = module.networking.vpc_id
3+
private_dns_enabled = true
4+
vpc_endpoint_type = "Interface"
5+
subnet_ids = module.networking.private_subnet_ids
6+
security_group_ids = [aws_security_group.vpc_endpoint.id]
7+
service_name = "com.amazonaws.eu-west-2.secretsmanager"
8+
9+
tags = {
10+
Environment = "dev"
11+
}
12+
depends_on = [module.lambda]
13+
}
14+
15+
16+
resource "aws_security_group" "vpc_endpoint" {
17+
name = "${var.project_name}-${var.environment}-endpoint-sg"
18+
description = "Security group for vpc endpoint"
19+
vpc_id = module.networking.vpc_id
20+
21+
ingress {
22+
from_port = 443
23+
to_port = 443
24+
protocol = "tcp"
25+
security_groups = [module.lambda.security_group_id]
26+
}
27+
28+
29+
egress {
30+
from_port = 0
31+
to_port = 0
32+
protocol = "-1"
33+
cidr_blocks = ["0.0.0.0/0"]
34+
}
35+
36+
tags = merge(var.tags, {
37+
Name = "${var.project_name}-${var.environment}-endpoint-sg"
38+
})
39+
}
40+
41+
resource "aws_security_group_rule" "lambda_to_rds" {
42+
type = "ingress"
43+
from_port = 1433
44+
to_port = 1433
45+
protocol = "tcp"
46+
security_group_id = module.database.security_group_id
47+
source_security_group_id = module.lambda.security_group_id
48+
description = "Allow Lambda to connect to RDS"
49+
depends_on = [module.lambda]
50+
}

‎infra/environments/dev/main.tf‎

Lines changed: 14 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -1,50 +1,17 @@
1-
data "aws_subnets" "private" {
2-
filter {
3-
name = "vpc-id"
4-
values = [data.aws_vpc.main.id]
5-
}
6-
7-
filter {
8-
name = "tag:Name"
9-
values = ["${var.environment}-private-subnet"]
10-
}
11-
}
12-
13-
data "aws_subnets" "private-b" {
14-
filter {
15-
name = "vpc-id"
16-
values = [data.aws_vpc.main.id]
17-
}
18-
19-
filter {
20-
name = "tag:Name"
21-
values = ["${var.environment}-private-subnet2"]
22-
}
23-
}
24-
1+
module "networking" {
2+
source = "../../modules/networking"
253

26-
data "aws_vpc" "main" {
27-
filter {
28-
name = "tag:Name"
29-
values = ["${var.environment}-vpc"]
30-
}
314
}
325

33-
346
module "database" {
357
source = "../../modules/database"
368

37-
project_name = var.project_name
38-
environment = var.environment
39-
database_name = var.db_name
40-
vpc_id = data.aws_vpc.main.id
41-
# security_groups = [aws_security_group.rds.id]
42-
private_subnet_ids = concat(
43-
data.aws_subnets.private.ids,
44-
data.aws_subnets.private-b.ids
45-
)
46-
instance_class = var.db_instance_class
47-
master_username = var.db_master_username
9+
project_name = var.project_name
10+
environment = var.environment
11+
vpc_id = module.networking.vpc_id
12+
private_subnet_ids = module.networking.private_subnet_ids
13+
instance_class = var.db_instance_class
14+
master_username = var.db_master_username
4815

4916
}
5017

@@ -53,21 +20,15 @@ module "lambda" {
5320

5421
project_name = var.project_name
5522
environment = var.environment
56-
vpc_id = data.aws_vpc.main.id
57-
private_subnet_ids = concat(
58-
data.aws_subnets.private.ids,
59-
data.aws_subnets.private-b.ids
60-
)
61-
# memory_size = 512
23+
vpc_id = module.networking.vpc_id
24+
private_subnet_ids = module.networking.private_subnet_ids
6225
log_retention_days = var.log_retention_days
63-
64-
db_host = module.database.address
65-
db_port = module.database.port
66-
db_name = module.database.database_name
67-
db_secret_arn = module.database.db_secret_arn
26+
db_host = module.database.address
27+
db_port = module.database.port
28+
db_secret_arn = module.database.db_secret_arn
6829

6930

70-
depends_on = [module.database]
31+
depends_on = [module.database]
7132
}
7233

7334

@@ -82,12 +43,6 @@ module "api" {
8243
log_retention_days = var.log_retention_days
8344
}
8445

85-
# module "networking" {
86-
# source = "../../modules/networking"
87-
88-
# }
89-
90-
9146

9247

9348

‎infra/environments/dev/terraform.tfvars‎

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,8 @@
1-
project_name = "node-api"
2-
environment = "dev"
3-
aws_region = "eu-west-2"
4-
db_name = "master"
5-
db_master_username = "sqladmin"
6-
db_instance_class = "db.t3.medium"
7-
db_engine_version = "15.00"
8-
memory_size = 512
9-
log_retention_days = 7
1+
project_name = "node-api"
2+
environment = "dev"
3+
aws_region = "eu-west-2"
4+
db_master_username = "sqladmin"
5+
db_instance_class = "db.t3.medium"
6+
db_engine_version = "15.00"
7+
memory_size = 512
8+
log_retention_days = 7

‎infra/environments/dev/variables.tf‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ variable "db_master_username" {
1414

1515

1616
variable "db_allocated_storage" {
17-
type = number
17+
type = number
1818
default = 10
1919
}
2020

@@ -32,6 +32,8 @@ variable "db_instance_class" {
3232
type = string
3333
}
3434

35-
variable "db_name" {
36-
type = string
35+
36+
variable "tags" {
37+
type = map(string)
38+
default = {}
3739
}

‎infra/modules/database/main.tf‎

Lines changed: 5 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -3,24 +3,6 @@ resource "aws_security_group" "rds" {
33
description = "Security group for RDS SQL Server"
44
vpc_id = var.vpc_id
55

6-
7-
8-
ingress {
9-
from_port = 1433
10-
to_port = 1433
11-
protocol = "tcp"
12-
# cidr_blocks
13-
security_groups = [aws_security_group.lambda.id]
14-
15-
}
16-
17-
egress {
18-
from_port = 0
19-
to_port = 0
20-
protocol = "-1"
21-
cidr_blocks = ["0.0.0.0/0"]
22-
}
23-
246
tags = merge(var.tags, {
257
Name = "${var.project_name}-${var.environment}-rds-sg"
268
})
@@ -38,9 +20,11 @@ resource "aws_db_subnet_group" "main" {
3820
}
3921

4022
resource "random_password" "master" {
41-
length = 16
42-
special = true
43-
override_special = "!#$%&*()-_=+[]{}:?"
23+
length = 12
24+
upper = true
25+
lower = true
26+
numeric = true
27+
special = false
4428

4529
}
4630

@@ -68,11 +52,9 @@ resource "aws_db_instance" "main" {
6852
allocated_storage = 20
6953
storage_type = "gp3"
7054
storage_encrypted = true
71-
db_name = var.database_name
7255
username = "sqladmin"
7356
password = random_password.master.result
7457
port = 1433
75-
7658
db_subnet_group_name = aws_db_subnet_group.main.name
7759
vpc_security_group_ids = [aws_security_group.rds.id]
7860
publicly_accessible = false

‎infra/modules/database/outputs.tf‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,6 @@ output "port" {
1010
value = aws_db_instance.main.port
1111
}
1212

13-
output "database_name" {
14-
value = aws_db_instance.main.db_name
15-
}
1613

1714
output "db_secret_arn" {
1815
value = aws_secretsmanager_secret.db_credentials.arn

‎infra/modules/database/variables.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,9 @@ variable "private_subnet_ids" {
1616
type = list(string)
1717
}
1818

19-
variable "database_name" {
20-
type = string
21-
}
19+
# variable "database_name" {
20+
# type = string
21+
# }
2222

2323
variable "master_username" {
2424
type = string

‎infra/modules/lambda/main.tf‎

Lines changed: 20 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
# creates your s3 bucket for your codee
2-
31
resource "aws_s3_bucket" "lambda_artifacts" {
42
bucket = "${var.project_name}-${var.environment}-lambda-artifacts"
53

@@ -8,7 +6,7 @@ resource "aws_s3_bucket" "lambda_artifacts" {
86
})
97
}
108

11-
# Creates an IAM Role for a Lambda function
9+
1210
resource "aws_iam_role" "lambda" {
1311
name = "${var.project_name}-${var.environment}-lambda-role"
1412

@@ -55,8 +53,9 @@ resource "aws_lambda_function" "api" {
5553
function_name = "${var.project_name}-${var.environment}-api"
5654
role = aws_iam_role.lambda.arn
5755

58-
s3_bucket = aws_s3_bucket.lambda_artifacts.bucket
59-
s3_key = "deployment.zip"
56+
filename = data.archive_file.lambda_zip.output_path
57+
source_code_hash = data.archive_file.lambda_zip.output_base64sha256
58+
6059

6160
handler = "index.handler"
6261
runtime = "nodejs20.x"
@@ -96,7 +95,7 @@ resource "aws_iam_policy" "lambda_secrets_policy" {
9695
{
9796
Effect = "Allow",
9897
Action = ["secretsmanager:GetSecretValue"],
99-
Resource = var.db_secret_arn # must be the full secret ARN
98+
Resource = var.db_secret_arn
10099
}
101100
]
102101
})
@@ -114,3 +113,18 @@ resource "aws_iam_role_policy_attachment" "lambda_basic" {
114113
role = aws_iam_role.lambda.name
115114
policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
116115
}
116+
117+
118+
data "archive_file" "lambda_zip" {
119+
type = "zip"
120+
source_dir = "${path.module}/../../../src/handler"
121+
output_path = "${path.module}/../../../src/handler/deployment.zip"
122+
}
123+
124+
125+
resource "aws_s3_object" "main" {
126+
bucket = aws_s3_bucket.lambda_artifacts.bucket
127+
key = "deployment.zip"
128+
source = data.archive_file.lambda_zip.output_path
129+
130+
}

‎infra/modules/lambda/variables.tf‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -39,9 +39,6 @@ variable "db_port" {
3939
default = 1433
4040
}
4141

42-
variable "db_name" {
43-
type = string
44-
}
4542

4643
variable "db_secret_arn" {
4744
type = string

0 commit comments

Comments
 (0)