Skip to content

Commit 8d2c8c1

Browse files
nileshgadgianmolnagpal
nileshgadgi
and
anmolnagpal
authored
Feat: 🚀 Pull from master branch and create new release. (#9)
* [fix/docdb_structure]Fix: Removed the default secuirty group created with document module and restructure the module. * [fix/docdb_structure]Fix: Removed the default secuirty group created with document module and restructure the module. * [fix/docdb_structure]Fix: Removed the default secuirty group created with document module and restructure the module. * [fix/docdb_structure]Fix: Removed the default secuirty group created with document module and restructure the module. * [fix/docdb_structure]Fix: Removed the default secuirty group created with document module and restructure the module. * [fix/docdb_structure]Fix: Ignored the tfsec warning for kms key * [fix/docdb_structure]Fix: Ignored the tfsec warning for kms key * [fix/docdb_structure]Fix: Ignored the tfsec warning for kms key * [fix/docdb_structure]Feat:ignored the tfsec warning for kms key and update the security group with description * [fix/docdb_structure]Fix: Restructure and fix the documentDB terraform module. * feat: introduce certeficiate authority for cluster instance * feat: fixed tf checks * fix: ran terraform format * fix: add enable variable * fix: fixed lints * fix: fixed lints --------- Co-authored-by: Anmol Nagpal <ianmolnagpal@gmail.com> Co-authored-by: Anmol Nagpal <anmol@clouddrove.com>
1 parent 327bbb3 commit 8d2c8c1

File tree

11 files changed

+167
-147
lines changed

11 files changed

+167
-147
lines changed

‎README.md

Lines changed: 21 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -84,8 +84,10 @@ module "documentdb" {
8484
database_name = "rds"
8585
environment = "test"
8686
label_order = ["environment", "name"]
87-
master_password = "test123456"
87+
master_username = "db-user"
88+
master_password = "gfbaJpP00W0m413Bc1fe"
8889
instance_class = "db.t3.medium"
90+
cluster_family = "docdb5.0"
8991
cluster_size = 1
9092
}
9193
@@ -94,17 +96,24 @@ module "documentdb" {
9496
```hcl
9597
module "documentdb" {
9698
source = "clouddrove/terraform-aws-documentdb/aws"
97-
vpc_id = module.vpc.vpc_id
98-
subnet_list = module.subnets.private_subnet_id
99-
database_name = "rds"
100-
environment = "test"
101-
label_order = ["environment", "name"]
102-
skip_final_snapshot = false
103-
storage_encrypted = true
104-
kms_key_id = module.kms_key.key_arn
105-
tls_enabled = true
106-
instance_class = "db.t3.medium"
107-
cluster_size = 1
99+
name = "documentdb"
100+
environment = "test"
101+
label_order = ["environment", "name"]
102+
vpc_id = module.vpc.vpc_id
103+
subnet_list = module.subnets.private_subnet_id
104+
vpc_security_group_ids = [module.security_group-documentdb.security_group_ids]
105+
database_name = "test"
106+
master_username = "db-user"
107+
master_password = "QfbaJpP00W0m413Bw1fe"
108+
skip_final_snapshot = false
109+
storage_encrypted = true
110+
kms_key_id = module.kms_key.key_arn
111+
tls_enabled = true
112+
instance_class = "db.t3.medium"
113+
cluster_family = "docdb5.0"
114+
cluster_size = 2
115+
deletion_protection = true
116+
preferred_backup_window = "07:00-07:30"
108117
}
109118
110119
```

‎README.yaml

Lines changed: 21 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -50,8 +50,10 @@ usage: |-
5050
database_name = "rds"
5151
environment = "test"
5252
label_order = ["environment", "name"]
53-
master_password = "test123456"
53+
master_username = "db-user"
54+
master_password = "gfbaJpP00W0m413Bc1fe"
5455
instance_class = "db.t3.medium"
56+
cluster_family = "docdb5.0"
5557
cluster_size = 1
5658
}
5759
@@ -60,17 +62,24 @@ usage: |-
6062
```hcl
6163
module "documentdb" {
6264
source = "clouddrove/terraform-aws-documentdb/aws"
63-
vpc_id = module.vpc.vpc_id
64-
subnet_list = module.subnets.private_subnet_id
65-
database_name = "rds"
66-
environment = "test"
67-
label_order = ["environment", "name"]
68-
skip_final_snapshot = false
69-
storage_encrypted = true
70-
kms_key_id = module.kms_key.key_arn
71-
tls_enabled = true
72-
instance_class = "db.t3.medium"
73-
cluster_size = 1
65+
name = "documentdb"
66+
environment = "test"
67+
label_order = ["environment", "name"]
68+
vpc_id = module.vpc.vpc_id
69+
subnet_list = module.subnets.private_subnet_id
70+
vpc_security_group_ids = [module.security_group-documentdb.security_group_ids]
71+
database_name = "test"
72+
master_username = "db-user"
73+
master_password = "QfbaJpP00W0m413Bw1fe"
74+
skip_final_snapshot = false
75+
storage_encrypted = true
76+
kms_key_id = module.kms_key.key_arn
77+
tls_enabled = true
78+
instance_class = "db.t3.medium"
79+
cluster_family = "docdb5.0"
80+
cluster_size = 2
81+
deletion_protection = true
82+
preferred_backup_window = "07:00-07:30"
7483
}
7584
7685
```

‎example/basic/main.tf

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
provider "aws" {
2-
region = "eu-west-1"
2+
region = "us-east-1"
33
}
44

55
module "vpc" {
@@ -33,11 +33,12 @@ module "subnets" {
3333

3434
module "documentdb" {
3535
source = "../../"
36-
database_name = "rds"
36+
enable = true
3737
environment = "test"
38-
vpc_id = module.vpc.vpc_id
39-
subnet_list = module.subnets.private_subnet_id
4038
label_order = ["environment", "name"]
39+
subnet_list = module.subnets.private_subnet_id
40+
database_name = "test-db"
41+
master_username = "test"
4142
master_password = var.master_password
4243
instance_class = var.instance_class
4344
cluster_size = var.cluster_size

‎example/basic/variable.tf

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,17 @@
11
variable "master_password" {
22
type = string
3-
default = "test123456"
4-
description = ""
3+
default = "QfbaJpP00W0m413Bw1fe"
4+
description = "Master password for documentDB."
55
}
66

77
variable "instance_class" {
88
type = string
99
default = "db.t3.medium"
10-
description = ""
10+
description = "Instance class for DocumentDB Cluster."
1111
}
1212

1313
variable "cluster_size" {
1414
type = number
1515
default = 1
16-
description = ""
16+
description = "cluster size of DocumentDB."
1717
}

‎example/secured/main.tf

Lines changed: 32 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11

22
provider "aws" {
3-
region = "eu-west-1"
3+
region = "us-east-1"
44
}
55

66
module "vpc" {
@@ -19,7 +19,7 @@ module "subnets" {
1919
version = "2.0.1"
2020

2121
name = "subnets"
22-
environment = "sandbox"
22+
environment = "test"
2323
label_order = ["environment", "name"]
2424

2525
nat_gateway_enabled = true
@@ -63,42 +63,38 @@ data "aws_iam_policy_document" "kms" {
6363

6464
}
6565

66-
data "aws_iam_policy_document" "default" {
67-
statement {
68-
effect = "Allow"
69-
actions = ["sts:AssumeRole"]
70-
principals {
71-
type = "Service"
72-
identifiers = ["ec2.amazonaws.com"]
73-
}
74-
}
75-
}
66+
module "security_group-documentdb" {
67+
source = "clouddrove/security-group/aws"
68+
version = "1.3.0"
69+
70+
name = "documentdb"
71+
environment = "test"
72+
protocol = "tcp"
73+
label_order = ["environment", "name"]
74+
vpc_id = module.vpc.vpc_id
75+
allowed_ip = ["172.16.0.0/16"]
76+
description = "Instance default security group"
77+
allowed_ports = [27017]
7678

77-
data "aws_iam_policy_document" "iam-policy" {
78-
statement {
79-
actions = [
80-
"ssm:UpdateInstanceInformation",
81-
"ssmmessages:CreateControlChannel",
82-
"ssmmessages:CreateDataChannel",
83-
"ssmmessages:OpenControlChannel",
84-
"ssmmessages:OpenDataChannel"]
85-
effect = "Allow"
86-
resources = ["*"]
87-
}
8879
}
8980

9081
module "documentdb" {
91-
source = "../../"
92-
database_name = "rds"
93-
environment = "test"
94-
label_order = ["environment", "name"]
95-
vpc_id = module.vpc.vpc_id
96-
subnet_list = module.subnets.private_subnet_id
97-
skip_final_snapshot = var.skip_final_snapshot
98-
storage_encrypted = var.storage_encrypted
99-
kms_key_id = module.kms_key.key_arn
100-
tls_enabled = var.tls_enabled
101-
instance_class = var.instance_class
102-
cluster_size = var.cluster_size
103-
deletion_protection = true
82+
source = "../../"
83+
enable = true
84+
name = "documentdb"
85+
environment = "test"
86+
label_order = ["environment", "name"]
87+
subnet_list = module.subnets.private_subnet_id
88+
vpc_security_group_ids = [module.security_group-documentdb.security_group_ids]
89+
database_name = "test"
90+
skip_final_snapshot = var.skip_final_snapshot
91+
storage_encrypted = var.storage_encrypted
92+
kms_key_id = module.kms_key.key_arn
93+
tls_enabled = var.tls_enabled
94+
instance_class = var.instance_class
95+
cluster_family = "docdb5.0"
96+
cluster_size = var.cluster_size
97+
deletion_protection = true
98+
preferred_backup_window = "07:00-07:30"
99+
ca_cert_identifier = "rds-ca-rsa2048-g1"
104100
}

‎example/secured/variable.tf

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,29 @@
11
variable "skip_final_snapshot" {
22
type = bool
3+
description = "Determines whether a final DB snapshot is created before the DB cluster is deleted."
34
default = false
4-
description = ""
55
}
66

77
variable "storage_encrypted" {
88
type = bool
9+
description = "Specifies whether the DB cluster is encrypted."
910
default = true
10-
description = ""
1111
}
1212

1313
variable "tls_enabled" {
1414
type = bool
1515
default = true
16-
description = ""
16+
description = "When true than cluster using TLS for communication."
1717
}
1818

1919
variable "instance_class" {
2020
type = string
2121
default = "db.t3.medium"
22-
description = ""
22+
description = "The instance class to use. For more details, see https://docs.aws.amazon.com/documentdb/latest/developerguide/db-instance-classes.html#db-instance-class-specs ."
2323
}
2424

2525
variable "cluster_size" {
26-
type = number
27-
default = 1
28-
description = ""
29-
}
26+
type = string
27+
default = "1"
28+
description = "Number of DB instances to create in the cluster"
29+
}

‎example/secured/versions.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ terraform {
55
required_providers {
66
aws = {
77
source = "hashicorp/aws"
8-
version = ">= 5.31.0"
8+
version = ">= 5.30"
99
}
1010
}
1111
}

‎main.tf

Lines changed: 35 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,46 +1,33 @@
1-
#Module : Label
2-
#Description : This terraform module is designed to generate consistent label names and tags
3-
# for resources. You can use terraform-labels to implement a strict naming
4-
# convention.
1+
##-----------------------------------------------------------------------------
2+
## label Module.
3+
##-----------------------------------------------------------------------------
54
module "labels" {
65
source = "clouddrove/labels/aws"
76
version = "1.3.0"
7+
enabled = var.enable
88
name = var.name
99
repository = var.repository
1010
environment = var.environment
1111
managedby = var.managedby
1212
label_order = var.label_order
1313
}
1414

15-
#Module : DocumentDB
16-
#Description : This terraform module is designed to create DocumentDB
17-
resource "aws_security_group" "this" {
18-
name = "security_group-allow_all_documentdb-${var.database_name}"
19-
description = "Allow inbound traffic"
20-
21-
vpc_id = var.vpc_id
22-
23-
ingress {
24-
from_port = var.port
25-
to_port = var.port
26-
protocol = "tcp"
27-
cidr_blocks = ["0.0.0.0/0"]
28-
}
29-
30-
egress {
31-
from_port = 0
32-
to_port = 0
33-
protocol = "-1"
34-
cidr_blocks = ["0.0.0.0/0"]
35-
}
36-
}
15+
##-----------------------------------------------------------------------------
16+
## Random password genrator
17+
##-----------------------------------------------------------------------------
3718

3819
resource "random_password" "master" {
39-
count = length(var.master_password) == 0 ? 1 : 0
20+
count = var.enable && length(var.master_password) == 0 ? 1 : 0
4021
length = 15
4122
special = false
4223
}
24+
25+
##-----------------------------------------------------------------------------
26+
## AWS Document DB Cluster.
27+
##-----------------------------------------------------------------------------
28+
4329
resource "aws_docdb_cluster" "this" {
30+
count = var.enable ? 1 : 0
4431
cluster_identifier = var.database_name
4532
master_username = var.master_username
4633
master_password = length(var.master_password) == 0 ? random_password.master[0].result : var.master_password
@@ -51,35 +38,50 @@ resource "aws_docdb_cluster" "this" {
5138
apply_immediately = var.apply_immediately
5239
deletion_protection = var.deletion_protection
5340
storage_encrypted = var.storage_encrypted
54-
kms_key_id = var.kms_key_id
41+
kms_key_id = var.kms_key_id #tfsec:ignore:aws-documentdb-encryption-customer-key
5542
snapshot_identifier = var.snapshot_identifier
56-
vpc_security_group_ids = [aws_security_group.this.id]
57-
db_subnet_group_name = aws_docdb_subnet_group.this.name
58-
db_cluster_parameter_group_name = aws_docdb_cluster_parameter_group.this.name
43+
vpc_security_group_ids = var.vpc_security_group_ids
44+
db_subnet_group_name = aws_docdb_subnet_group.this[0].name
45+
db_cluster_parameter_group_name = aws_docdb_cluster_parameter_group.this[0].name
5946
engine = var.engine
6047
engine_version = var.engine_version
6148
enabled_cloudwatch_logs_exports = var.enabled_cloudwatch_logs_exports
6249
tags = module.labels.tags
6350
}
6451

52+
##-----------------------------------------------------------------------------
53+
## AWS Document DB instance.
54+
##-----------------------------------------------------------------------------
55+
6556
resource "aws_docdb_cluster_instance" "this" {
66-
count = var.cluster_size
57+
count = var.enable ? var.cluster_size : 0
6758
identifier = "${var.database_name}-${count.index + 1}"
68-
cluster_identifier = join("", aws_docdb_cluster.this.*.id)
59+
cluster_identifier = aws_docdb_cluster.this[0].id
6960
apply_immediately = var.apply_immediately
7061
instance_class = var.instance_class
7162
tags = module.labels.tags
7263
engine = var.engine
64+
ca_cert_identifier = var.ca_cert_identifier
7365
}
7466

67+
##-----------------------------------------------------------------------------
68+
## AWS Document DB Subnet Group.
69+
##-----------------------------------------------------------------------------
70+
7571
resource "aws_docdb_subnet_group" "this" {
72+
count = var.enable ? 1 : 0
7673
name = "subnet-group-${var.database_name}"
7774
description = "Allowed subnets for DB cluster instances."
7875
subnet_ids = var.subnet_list
7976
tags = module.labels.tags
8077
}
8178

79+
##-----------------------------------------------------------------------------
80+
## AWS Document DB cluster parameter Group.
81+
##-----------------------------------------------------------------------------
82+
8283
resource "aws_docdb_cluster_parameter_group" "this" {
84+
count = var.enable ? 1 : 0
8385
name = "parameter-group-${var.database_name}"
8486
description = "DB cluster parameter group."
8587
family = var.cluster_family

0 commit comments

Comments
 (0)