rds_instance: Add purge_security_groups

[alinabuzachis]

SUMMARY

rds_instance: Add purge_security_groups parameter for both db_security_groups and vpc_security_groups_ids.
Should fix: #385

ISSUE TYPE

• Bugfix Pull Request

COMPONENT NAME

rds_instance

ADDITIONAL INFORMATION

According to the boto3 documentation https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/rds.html#RDS.Client.describe_db_instances, describe_db_instances() provides this information for the associated security groups

'DBSecurityGroups': [
                {
                    'DBSecurityGroupName': 'string',
                    'Status': 'string'
                },
            ],
 'VpcSecurityGroups': [
                {
                    'VpcSecurityGroupId': 'string',
                    'Status': 'string'
                },
            ],

With this patch the status is reflected accordingly as showed in the following example.

- name: Create a DB instance in the VPC with two security groups
   rds_instance:
     id: "{{ instance_id }}"
     state: present
     engine: mariadb
     username: "{{ username }}"
     password: "{{ password }}"
     db_instance_class: "{{ db_instance_class }}"
     allocated_storage: "{{ allocated_storage }}"
     vpc_security_group_ids:
            - "sg-1"
            - "sg-2"

This gives:

....
"vpc_security_groups": [
        {
            "status": "active",
            "vpc_security_group_id": "sg-1"
        },
        {
            "status": "active",
            "vpc_security_group_id": "sg-2"
        }
    ]

And then if we want to set the a new security group sg-3 (purge_security_groups=True by default).

- name: Add a new security group (purge_security_groups=True by default)
   rds_instance:
     id: "{{ instance_id }}"
     state: present
     vpc_security_group_ids:
            - "sg-3"

The log produced:

"vpc_security_groups": [
        {
            "status": "removing",
            "vpc_security_group_id": "sg-1"
        },
        {
            "status": "removing",
            "vpc_security_group_id": "sg-2"
        },
        {
            "status": "adding",
            "vpc_security_group_id": "sg-3"
        }
    ]

Since some vpc security groups are reported "removing" status, do we want to show them? Others are also with "adding" state. I was wondering if there is a way to only show security groups with an active status or however wait until a security group passes from "adding" to "active".

[alinabuzachis]

@s-hertel Could you please take a look at this?

[ansibullbot]

cc @jillr @tremble @wimnat
click here for bot help

[s-hertel]

@alinabuzachis Yes, will review in a day or two. Thanks for fixing this!

[s-hertel]

Looks great!

I was wondering if there is a way to only show security groups with an active status or however wait until a security group passes from "adding" to "active".

You could add a waiter to return only 'active' security groups by using a pathAll matcher - something like

"DBInstanceActiveSecurityGroups": {
    "delay": 20,
    "maxAttempts": 60,
    "operation": "DescribeDBInstances",
    "acceptors": [
        {
            "state": "success",
            "matcher": "pathAll",
            "argument": "DBInstances[].VpcSecurityGroups[].Status",
            "expected": "active"  # check if this is lowercase pre-camel_to_snake_case
        },
        {
            "state": "success",
            "matcher": "pathAll",
            "argument": "DBInstances[].DBSecurityGroups[].Status",
            "expected": "active"
        },
}

But I actually like this as it is, so it's your call/others can weigh in if that would be useful.

[tremble]

Generally looks good. A couple of white-space nit-picks.

I'm currently running the tests locally, assuming they pass I'll get this merged.

[tremble]

Tests passed successfully after unrelated fixes.