-
-
Notifications
You must be signed in to change notification settings - Fork 54
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat!: Increase Terraform and AWS provider minimum supported versions…
…; update `auth` configuration schema (#17) Co-authored-by: Orest Kapko <[email protected]> Co-authored-by: Amitai Getzler <[email protected]> Co-authored-by: Orest Kapko <[email protected]> Co-authored-by: Bryant Biggs <[email protected]> Co-authored-by: Anton Babenko <[email protected]>
- Loading branch information
6 people
authored
Jun 9, 2023
1 parent
5d1c5e6
commit cc39e9d
Showing
31 changed files
with
626 additions
and
750 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,79 @@ | ||
| # Upgrade from v2.x to v3.x | ||
|
|
||
| If you have any questions regarding this upgrade process, please consult the `examples` directory. | ||
| If you find a bug, please open an issue with supporting configuration to reproduce. | ||
|
|
||
| ## List of backwards incompatible changes | ||
|
|
||
| - Minimum supported Terraform version is now 1.0 | ||
| - Minimum supported AWS provider version is now 5.0 | ||
| - The manner in which authentication is configured has changed - previously auth settings were provided under `secrets` in conjunction with `auth_scheme` and `iam_auth` variables. Now, auth settings are provided under the `auth` variable for multiple auth entries. | ||
|
|
||
| ### Variable and output changes | ||
|
|
||
| 1. Removed variables: | ||
|
|
||
| - `auth_scheme` is now set under the `auth` variable for a given auth entry | ||
| - `iam_auth` is now set under the `auth` variable for a given auth entry | ||
|
|
||
| 2. Renamed variables: | ||
|
|
||
| - `create_proxy` -> `create` | ||
| - `secrets` -> `auth` | ||
| - `db_proxy_endpoints` -> `endpoints` | ||
|
|
||
| 3. Added variables: | ||
|
|
||
| - `kms_key_arns` - list of KMS key ARNs to use allowing permission to decrypt SecretsManager secrets | ||
|
|
||
| 4. Removed outputs: | ||
|
|
||
| - None | ||
|
|
||
| 5. Renamed outputs: | ||
|
|
||
| - None | ||
|
|
||
| 6. Added outputs: | ||
|
|
||
| - None | ||
|
|
||
| ## Diff of Before (v2.x) vs After (v3.x) | ||
|
|
||
| ```diff | ||
| module "rds_proxy" { | ||
| source = "terraform-aws-modules/rds-proxy/aws" | ||
| - version = "~> 2.0" | ||
| + version = "~> 3.0" | ||
|
|
||
| # Only the affected attributes are shown | ||
| - create_proxy = true | ||
| + create = true | ||
|
|
||
| - db_proxy_endpoints = { | ||
| - ... | ||
| - } | ||
| + endpoints = { | ||
| + ... | ||
| + } | ||
|
|
||
| - secrets = { | ||
| - "superuser" = { | ||
| - description = "Aurora PostgreSQL superuser password" | ||
| - arn = "arn:aws:secretsmanager:eu-west-1:123456789012:secret:superuser-6gsjLD" | ||
| - kms_key_id = "6ca29066-552a-46c5-a7d7-7bf9a15fc255" | ||
| - } | ||
| - } | ||
| + auth = { | ||
| + "superuser" = { | ||
| + description = "Aurora PostgreSQL superuser password" | ||
| + secret_arn = "arn:aws:secretsmanager:us-east-1:123456789012:secret:superuser-6gsjLD" | ||
| + } | ||
| + } | ||
| + kms_key_arns = ["arn:aws:kms:eu-west-1:123456789012:key/6ca29066-552a-46c5-a7d7-7bf9a15fc255"] | ||
| } | ||
| ``` | ||
|
|
||
| ### State Changes | ||
|
|
||
| - None |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,144 @@ | ||
| provider "aws" { | ||
| region = local.region | ||
| } | ||
|
|
||
| data "aws_availability_zones" "available" {} | ||
|
|
||
| locals { | ||
| name = "ex-${basename(path.cwd)}" | ||
| region = "eu-west-1" | ||
|
|
||
| vpc_cidr = "10.0.0.0/16" | ||
| azs = slice(data.aws_availability_zones.available.names, 0, 3) | ||
|
|
||
| tags = { | ||
| Example = local.name | ||
| GithubRepo = "terraform-aws-rds-proxy" | ||
| GithubOrg = "terraform-aws-modules" | ||
| } | ||
| } | ||
|
|
||
| ################################################################################ | ||
| # RDS Proxy | ||
| ################################################################################ | ||
|
|
||
| module "rds_proxy" { | ||
| source = "../../" | ||
|
|
||
| name = local.name | ||
| iam_role_name = local.name | ||
| vpc_subnet_ids = module.vpc.private_subnets | ||
| vpc_security_group_ids = [module.rds_proxy_sg.security_group_id] | ||
|
|
||
| endpoints = { | ||
| read_write = { | ||
| name = "read-write-endpoint" | ||
| vpc_subnet_ids = module.vpc.private_subnets | ||
| vpc_security_group_ids = [module.rds_proxy_sg.security_group_id] | ||
| tags = local.tags | ||
| }, | ||
| read_only = { | ||
| name = "read-only-endpoint" | ||
| vpc_subnet_ids = module.vpc.private_subnets | ||
| vpc_security_group_ids = [module.rds_proxy_sg.security_group_id] | ||
| target_role = "READ_ONLY" | ||
| tags = local.tags | ||
| } | ||
| } | ||
|
|
||
| auth = { | ||
| "root" = { | ||
| description = "Cluster generated master user password" | ||
| secret_arn = module.rds.cluster_master_user_secret[0].secret_arn | ||
| } | ||
| } | ||
|
|
||
| engine_family = "MYSQL" | ||
| debug_logging = true | ||
|
|
||
| # Target Aurora cluster | ||
| target_db_cluster = true | ||
| db_cluster_identifier = module.rds.cluster_id | ||
|
|
||
| tags = local.tags | ||
| } | ||
|
|
||
| ################################################################################ | ||
| # Supporting Resources | ||
| ################################################################################ | ||
|
|
||
| module "vpc" { | ||
| source = "terraform-aws-modules/vpc/aws" | ||
| version = "~> 5.0" | ||
|
|
||
| name = local.name | ||
| cidr = local.vpc_cidr | ||
|
|
||
| azs = local.azs | ||
| public_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k)] | ||
| private_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 3)] | ||
| database_subnets = [for k, v in local.azs : cidrsubnet(local.vpc_cidr, 8, k + 6)] | ||
|
|
||
| tags = local.tags | ||
| } | ||
|
|
||
| module "rds" { | ||
| source = "terraform-aws-modules/rds-aurora/aws" | ||
| version = "~> 8.0" | ||
|
|
||
| name = local.name | ||
| engine = "aurora-mysql" | ||
| engine_version = "8.0" | ||
| master_username = "root" | ||
|
|
||
| # When using RDS Proxy w/ IAM auth - Database must be username/password auth, not IAM | ||
| iam_database_authentication_enabled = false | ||
|
|
||
| instance_class = "db.r6g.large" | ||
| instances = { | ||
| 1 = {} | ||
| 2 = {} | ||
| } | ||
|
|
||
| vpc_id = module.vpc.vpc_id | ||
| db_subnet_group_name = module.vpc.database_subnet_group_name | ||
| security_group_rules = { | ||
| vpc_ingress = { | ||
| cidr_blocks = module.vpc.private_subnets_cidr_blocks | ||
| } | ||
| } | ||
|
|
||
| apply_immediately = true | ||
| skip_final_snapshot = true | ||
|
|
||
| tags = local.tags | ||
| } | ||
|
|
||
| module "rds_proxy_sg" { | ||
| source = "terraform-aws-modules/security-group/aws" | ||
| version = "~> 5.0" | ||
|
|
||
| name = "${local.name}-proxy" | ||
| description = "PostgreSQL RDS Proxy example security group" | ||
| vpc_id = module.vpc.vpc_id | ||
|
|
||
| revoke_rules_on_delete = true | ||
|
|
||
| ingress_with_cidr_blocks = [ | ||
| { | ||
| description = "Private subnet MySQL access" | ||
| rule = "mysql-tcp" | ||
| cidr_blocks = join(",", module.vpc.private_subnets_cidr_blocks) | ||
| } | ||
| ] | ||
|
|
||
| egress_with_cidr_blocks = [ | ||
| { | ||
| description = "Database subnet MySQL access" | ||
| rule = "mysql-tcp" | ||
| cidr_blocks = join(",", module.vpc.database_subnets_cidr_blocks) | ||
| }, | ||
| ] | ||
|
|
||
| tags = local.tags | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
Oops, something went wrong.