-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #20 from kunduso/add-rds-db-instance
Add rds db instance
- Loading branch information
Showing
7 changed files
with
214 additions
and
48 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,3 +1,30 @@ | ||
| [](https://choosealicense.com/licenses/unlicense/) [](https://GitHub.com/kunduso/rds-secretsmanager-rotation-lambda-terraform/pull/) [](https://GitHub.com/kunduso/rds-secretsmanager-rotation-lambda-terraform/pull/) | ||
| [](https://github.com/kunduso/rds-secretsmanager-rotation-lambda-terraform/issues?q=is%3Aissue+is%3Aclosed) [](https://GitHub.com/kunduso/rds-secretsmanager-rotation-lambda-terraform/issues/) | ||
| # terraform-rds-secretsmanager-rotation-lambda | ||
| [](https://github.com/kunduso/rds-secretsmanager-rotation-lambda-terraform/issues?q=is%3Aissue+is%3Aclosed) [](https://GitHub.com/kunduso/rds-secretsmanager-rotation-lambda-terraform/issues/) [](https://github.com/kunduso/rds-secretsmanager-rotation-lambda-terraform/actions/workflows/terraform.yml) [](https://github.com/kunduso/rds-secretsmanager-rotation-lambda-terraform/actions/workflows/code-scan.yml) | ||
|  | ||
| ## Introduction | ||
| This repository contains the necessary Terraform configurations to deploy an Amazon RDS for PostgreSQL and all the supporting infrastructure components like Amazon VPC, Subnets, KMS keys, security group and IAM roles. Please refer to [Create Amazon RDS for PostgreSQL DB using Terraform and GitHub Actions](https://skundunotes.com/2024/09/18/create-amazon-rds-for-postgresql-db-using-terraform-and-github-actions/) for details. | ||
|
|
||
| The repository utilizes **Bridgecrew Checkov** to scan the Terraform code for security vulnerabilities. For those interested in adding code scanning capabilities to their GitHub Actions pipeline, a guide is available at [Automate Terraform Configuration Scan with Checkov and GitHub Actions](https://skundunotes.com/2023/04/12/automate-terraform-configuration-scan-with-checkov-and-github-actions/). | ||
|
|
||
| Infracost is employed to generate a cost estimate for building the architecture. To learn more about integrating Infracost estimates into a repository, refer to the note [Estimate AWS Cloud Resource Cost with Infracost, Terraform, and GitHub Actions](https://skundunotes.com/2023/07/17/estimate-aws-cloud-resource-cost-with-infracost-terraform-and-github-actions/). | ||
|
|
||
| The provisioning process of the resources is automated using a GitHub Actions pipeline. Detailed information on this can be found in the note [CI/CD with Terraform and GitHub Actions to Deploy to AWS](https://skundunotes.com/2023/03/07/ci-cd-with-terraform-and-github-actions-to-deploy-to-aws/). | ||
|
|
||
|
|
||
| ## Prerequisites | ||
| To ensure the code functions without errors, an OpenID Connect identity provider must be created in Amazon Identity and Access Management (IAM) with a trust relationship established with the GitHub repository. A detailed explanation with steps can be found [here.](https://skundunotes.com/2023/02/28/securely-integrate-aws-credentials-with-github-actions-using-openid-connect/) | ||
|
|
||
| The `ARN` of the `IAM Role` is stored as a GitHub secret, which is referenced in the [`terraform.yml`](.github/workflows/terraform.yml) file. | ||
|
|
||
| Additionally, since Infracost is used in this repository, the `INFRACOST_API_KEY` is also stored as a repository secret and is referenced in the GitHub Actions workflow file. The cost estimate process is managed using a GitHub Actions variable, `INFRACOST_SCAN_TYPE`, where the value is either `hcl_code` or `tf_plan`, depending on the type of scan desired. | ||
| <br />You can read about that at [Integrate Infracost with GitHub Actions.](http://skundunotes.com/2023/07/17/estimate-aws-cloud-resource-cost-with-infracost-terraform-and-github-actions/) | ||
| ## Usage | ||
| Ensure that the policy attached to the IAM role whose credentials are being used in this configuration has permission to create and manage all the AWS Cloud resources that are included in this repository. | ||
|
|
||
| If you want to check the pipeline logs, click on the **Build Badges** above the image in this ReadMe. | ||
|
|
||
| ## Contributing | ||
| If you find any issues or have suggestions for improvement, feel free to open an issue or submit a pull request. Contributions are always welcome! | ||
|
|
||
| ## License | ||
| This code is released under the Unlicense License. See [LICENSE](LICENSE). |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,12 +1,106 @@ | ||
| #https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key | ||
| resource "aws_kms_key" "encryption_secret" { | ||
| resource "aws_kms_key" "encryption_rds" { | ||
| enable_key_rotation = true | ||
| description = "Key to encrypt secret" | ||
| description = "Key to encrypt the ${var.name} resources." | ||
| deletion_window_in_days = 7 | ||
| #checkov:skip=CKV2_AWS_64: Not including a KMS Key policy | ||
| } | ||
| #https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_alias | ||
| resource "aws_kms_alias" "encryption_secret" { | ||
| name = "alias/${var.name}" | ||
| target_key_id = aws_kms_key.encryption_secret.key_id | ||
| resource "aws_kms_alias" "encryption_rds" { | ||
| name = "alias/${var.name}-kms" | ||
| target_key_id = aws_kms_key.encryption_rds.key_id | ||
| } | ||
| data "aws_iam_policy_document" "encryption_rds_policy" { | ||
| statement { | ||
| sid = "Enable IAM User Permissions" | ||
| effect = "Allow" | ||
| principals { | ||
| type = "AWS" | ||
| identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"] | ||
| } | ||
| actions = [ | ||
| "kms:Encrypt", | ||
| "kms:Decrypt", | ||
| "kms:ReEncrypt*", | ||
| "kms:GenerateDataKey*", | ||
| "kms:DescribeKey", | ||
| "kms:Create*", | ||
| "kms:Enable*", | ||
| "kms:List*", | ||
| "kms:Put*", | ||
| "kms:Update*", | ||
| "kms:Revoke*", | ||
| "kms:Disable*", | ||
| "kms:Get*", | ||
| "kms:Delete*", | ||
| "kms:ScheduleKeyDeletion", | ||
| "kms:CancelKeyDeletion", | ||
| "kms:TagResource", | ||
| "kms:UntagResource" | ||
| ] | ||
| resources = [aws_kms_key.encryption_rds.arn] | ||
| } | ||
| statement { | ||
| sid = "Allow RDS to use the key" | ||
| effect = "Allow" | ||
| principals { | ||
| type = "Service" | ||
| identifiers = ["rds.amazonaws.com"] | ||
| } | ||
| actions = [ | ||
| "kms:Encrypt", | ||
| "kms:Decrypt", | ||
| "kms:ReEncrypt*", | ||
| "kms:GenerateDataKey*", | ||
| "kms:DescribeKey", | ||
| "kms:CreateGrant" | ||
| ] | ||
| resources = [aws_kms_key.encryption_rds.arn] | ||
| } | ||
| statement { | ||
| sid = "Allow Secrets Manager to use the key" | ||
| effect = "Allow" | ||
| principals { | ||
| type = "Service" | ||
| identifiers = ["secretsmanager.amazonaws.com"] | ||
| } | ||
| actions = [ | ||
| "kms:Encrypt", | ||
| "kms:Decrypt", | ||
| "kms:ReEncrypt*", | ||
| "kms:GenerateDataKey*", | ||
| "kms:DescribeKey", | ||
| "kms:CreateGrant" | ||
| ] | ||
| resources = [aws_kms_key.encryption_rds.arn] | ||
| } | ||
| statement { | ||
| sid = "Allow SSM to use the key" | ||
| effect = "Allow" | ||
| principals { | ||
| type = "Service" | ||
| identifiers = ["ssm.amazonaws.com"] | ||
| } | ||
| actions = [ | ||
| "kms:Encrypt", | ||
| "kms:Decrypt", | ||
| "kms:ReEncrypt*", | ||
| "kms:GenerateDataKey*", | ||
| "kms:DescribeKey" | ||
| ] | ||
| resources = [aws_kms_key.encryption_rds.arn] | ||
| condition { | ||
| test = "StringEquals" | ||
| variable = "kms:CallerAccount" | ||
| values = [data.aws_caller_identity.current.account_id] | ||
| } | ||
| condition { | ||
| test = "StringEquals" | ||
| variable = "kms:ViaService" | ||
| values = ["ssm.${var.region}.amazonaws.com"] | ||
| } | ||
| } | ||
| } | ||
| resource "aws_kms_key_policy" "encryption_rds" { | ||
| key_id = aws_kms_key.encryption_rds.id | ||
| policy = data.aws_iam_policy_document.encryption_rds_policy.json | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| ##https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role | ||
| resource "aws_iam_role" "rds_monitoring_role" { | ||
| name = "${var.name}-rds-monitoring-role" | ||
|
|
||
| assume_role_policy = jsonencode({ | ||
| Version = "2012-10-17", | ||
| Statement = [ | ||
| { | ||
| Action = "sts:AssumeRole", | ||
| Effect = "Allow", | ||
| Principal = { | ||
| Service = "monitoring.rds.amazonaws.com" | ||
| } | ||
| } | ||
| ] | ||
| }) | ||
| } | ||
| #https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment | ||
| resource "aws_iam_role_policy_attachment" "managed_rds_monitoring_policy_attachement" { | ||
| role = aws_iam_role.rds_monitoring_role.name | ||
| policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole" | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters