feat: Aurora MySQL Enabling Advanced Auditing logging

aws-aurora-mysql.yml

@@ -112,6 +112,19 @@ provision:
       The daily time range in UTC during which automated backups are created, e.g.: "09:46-10:16".
       Must not overlap with the maintenance window. If not set, uses the default for the region
       (see https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Managing.Backups.html#Aurora.Managing.Backups.BackupWindow)
+  - field_name: db_cluster_parameter_group_name
+    type: string
+    default: ""
+    details: |
+      The DB cluster parameter group contains the set of engine configuration parameters that apply throughout the Aurora DB cluster.
+      The DB cluster parameter group also contains default settings for the DB parameter group for the DB instances that make up the cluster.
+  - field_name: enable_audit_logging
+    type: boolean
+    default: false
+    details: |
+      Requires setting db_cluster_parameter_group_name with a pre-created DB cluster parameter group that fulfills requirements for audit log exports. 
+      See AWS Docs for more info: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Auditing.html
+      If set will enable the `audit` cloud_watch_log_export on the cluster.
   computed_inputs:
   - name: labels
     default: ${json.marshal(request.default_labels)}

integration-tests/aurora_mysql_test.go

@@ -99,23 +99,27 @@ var _ = Describe("Aurora MySQL", Label("aurora-mysql"), func() {
 				HaveKeyWithValue("rds_subnet_group", BeEmpty()),
 				HaveKeyWithValue("labels", HaveKeyWithValue("pcf-instance-id", instanceID)),
 				HaveKeyWithValue("deletion_protection", BeFalse()),
+				HaveKeyWithValue("db_cluster_parameter_group_name", BeEmpty()),
+				HaveKeyWithValue("enable_audit_logging", BeFalse()),
 			))
 		})
 
 		It("should allow properties to be set on provision", func() {
 			_, err := broker.Provision(serviceName, "custom-sample", map[string]any{
-				"instance_name":               "csb-aurora-mysql-fake-name",
-				"cluster_instances":           12,
-				"region":                      "africa-north-4",
-				"db_name":                     "fake-db-name",
-				"serverless_min_capacity":     0.2,
-				"serverless_max_capacity":     100,
-				"engine_version":              "8.0.mysql_aurora.3.02.0",
-				"allow_major_version_upgrade": false,
-				"auto_minor_version_upgrade":  false,
-				"rds_vpc_security_group_ids":  "group1,group2",
-				"rds_subnet_group":            "some-other-subnet",
-				"deletion_protection":         true,
+				"instance_name":                   "csb-aurora-mysql-fake-name",
+				"cluster_instances":               12,
+				"region":                          "africa-north-4",
+				"db_name":                         "fake-db-name",
+				"serverless_min_capacity":         0.2,
+				"serverless_max_capacity":         100,
+				"engine_version":                  "8.0.mysql_aurora.3.02.0",
+				"allow_major_version_upgrade":     false,
+				"auto_minor_version_upgrade":      false,
+				"rds_vpc_security_group_ids":      "group1,group2",
+				"rds_subnet_group":                "some-other-subnet",
+				"deletion_protection":             true,
+				"db_cluster_parameter_group_name": "db-cluster-parameter-group",
+				"enable_audit_logging":            true,
 			})
 			Expect(err).NotTo(HaveOccurred())
 
@@ -133,6 +137,8 @@ var _ = Describe("Aurora MySQL", Label("aurora-mysql"), func() {
 					HaveKeyWithValue("rds_vpc_security_group_ids", "group1,group2"),
 					HaveKeyWithValue("rds_subnet_group", "some-other-subnet"),
 					HaveKeyWithValue("deletion_protection", true),
+					HaveKeyWithValue("db_cluster_parameter_group_name", "db-cluster-parameter-group"),
+					HaveKeyWithValue("enable_audit_logging", true),
 				),
 			)
 		})
@@ -180,6 +186,8 @@ var _ = Describe("Aurora MySQL", Label("aurora-mysql"), func() {
 			Entry("engine_version", "engine_version", "8.0.mysql_aurora.3.02.0"),
 			Entry("allow_major_version_upgrade", "allow_major_version_upgrade", false),
 			Entry("auto_minor_version_upgrade", "auto_minor_version_upgrade", false),
+			Entry("db_cluster_parameter_group_name", "db_cluster_parameter_group_name", "another-db-parameter-group"),
+			Entry("enable_audit_logging", "enable_audit_logging", true),
 		)
 	})
 })

terraform-tests/aurora_mysql_test.go

@@ -18,25 +18,27 @@ var _ = Describe("Aurora mysql", Label("aurora-mysql-terraform"), Ordered, func(
 	)
 
 	defaultVars := map[string]any{
-		"instance_name":               "csb-auroramysql-test",
-		"db_name":                     "csbdb",
-		"labels":                      map[string]any{"key1": "some-mysql-value"},
-		"region":                      "us-west-2",
-		"aws_access_key_id":           awsAccessKeyID,
-		"aws_secret_access_key":       awsSecretAccessKey,
-		"aws_vpc_id":                  awsVPCID,
-		"cluster_instances":           3,
-		"serverless_min_capacity":     nil,
-		"serverless_max_capacity":     nil,
-		"engine_version":              nil,
-		"rds_subnet_group":            "",
-		"rds_vpc_security_group_ids":  "",
-		"allow_major_version_upgrade": true,
-		"auto_minor_version_upgrade":  true,
-		"backup_retention_period":     1,
-		"preferred_backup_window":     "23:26-23:56",
-		"copy_tags_to_snapshot":       true,
-		"deletion_protection":         false,
+		"instance_name":                   "csb-auroramysql-test",
+		"db_name":                         "csbdb",
+		"labels":                          map[string]any{"key1": "some-mysql-value"},
+		"region":                          "us-west-2",
+		"aws_access_key_id":               awsAccessKeyID,
+		"aws_secret_access_key":           awsSecretAccessKey,
+		"aws_vpc_id":                      awsVPCID,
+		"cluster_instances":               3,
+		"serverless_min_capacity":         nil,
+		"serverless_max_capacity":         nil,
+		"engine_version":                  nil,
+		"rds_subnet_group":                "",
+		"rds_vpc_security_group_ids":      "",
+		"allow_major_version_upgrade":     true,
+		"auto_minor_version_upgrade":      true,
+		"backup_retention_period":         1,
+		"preferred_backup_window":         "23:26-23:56",
+		"copy_tags_to_snapshot":           true,
+		"deletion_protection":             false,
+		"db_cluster_parameter_group_name": "",
+		"enable_audit_logging":            false,
 	}
 
 	BeforeAll(func() {
@@ -165,6 +167,23 @@ var _ = Describe("Aurora mysql", Label("aurora-mysql-terraform"), Ordered, func(
 		})
 	})
 
+	When("db_cluster_parameter_group_name is passed and enable_audit_logging is enabled", func() {
+		BeforeAll(func() {
+			plan = ShowPlan(terraformProvisionDir, buildVars(defaultVars, map[string]any{
+				"db_cluster_parameter_group_name": "db-cluster-parameter-group",
+				"enable_audit_logging":            true,
+			}))
+		})
+
+		It("should use the ids passed and not create new security groups", func() {
+			Expect(AfterValuesForType(plan, "aws_rds_cluster")).To(
+				MatchKeys(IgnoreExtras, Keys{
+					"db_cluster_parameter_group_name": Equal("db-cluster-parameter-group"),
+					"enabled_cloudwatch_logs_exports": ConsistOf("audit"),
+				}))
+		})
+	})
+
 	Context("serverless", func() {
 		BeforeAll(func() {
 			plan = ShowPlan(terraformProvisionDir, buildVars(defaultVars, map[string]any{

terraform/aurora-mysql/provision/main.tf

@@ -34,22 +34,24 @@ resource "random_password" "password" {
 }
 
 resource "aws_rds_cluster" "cluster" {
-  cluster_identifier          = var.instance_name
-  engine                      = "aurora-mysql"
-  engine_version              = var.engine_version
-  database_name               = var.db_name
-  tags                        = var.labels
-  master_username             = random_string.username.result
-  master_password             = random_password.password.result
-  port                        = local.port
-  db_subnet_group_name        = local.subnet_group
-  vpc_security_group_ids      = local.rds_vpc_security_group_ids
-  skip_final_snapshot         = true
-  allow_major_version_upgrade = var.allow_major_version_upgrade
-  backup_retention_period     = var.backup_retention_period
-  preferred_backup_window     = var.preferred_backup_window
-  copy_tags_to_snapshot       = var.copy_tags_to_snapshot
-  deletion_protection         = var.deletion_protection
+  cluster_identifier              = var.instance_name
+  engine                          = "aurora-mysql"
+  engine_version                  = var.engine_version
+  database_name                   = var.db_name
+  tags                            = var.labels
+  master_username                 = random_string.username.result
+  master_password                 = random_password.password.result
+  port                            = local.port
+  db_subnet_group_name            = local.subnet_group
+  vpc_security_group_ids          = local.rds_vpc_security_group_ids
+  skip_final_snapshot             = true
+  allow_major_version_upgrade     = var.allow_major_version_upgrade
+  backup_retention_period         = var.backup_retention_period
+  preferred_backup_window         = var.preferred_backup_window
+  copy_tags_to_snapshot           = var.copy_tags_to_snapshot
+  deletion_protection             = var.deletion_protection
+  db_cluster_parameter_group_name = var.db_cluster_parameter_group_name
+  enabled_cloudwatch_logs_exports = var.enable_audit_logging ? ["audit"] : []
 
   dynamic "serverlessv2_scaling_configuration" {
     for_each = local.serverless ? [null] : []
@@ -78,4 +80,4 @@ resource "aws_rds_cluster_instance" "cluster_instances" {
   lifecycle {
     prevent_destroy = true
   }
-}
+}

terraform/aurora-mysql/provision/variables.tf

@@ -16,4 +16,6 @@ variable "auto_minor_version_upgrade" { type = bool }
 variable "backup_retention_period" { type = number }
 variable "preferred_backup_window" { type = string }
 variable "copy_tags_to_snapshot" { type = bool }
-variable "deletion_protection" { type = bool }
+variable "deletion_protection" { type = bool }
+variable "enable_audit_logging" { type = bool }
+variable "db_cluster_parameter_group_name" { type = string }