Add RDS Postgresql

[kunduso]

This PR closes #5

[github-actions]

💰 Infracost report

Monthly estimate increased by $235 📈

Changed project	Baseline cost	Usage cost*	Total change	New monthly cost
kunduso/rds-secretsmanager-rotation-lambda-terraform/TFplan.JSON	+$235	-	+$235 (+23,470%)	$236

*Usage costs can be estimated by updating Infracost Cloud settings, see docs for other options.

Estimate details

Key: * usage cost, ~ changed, + added, - removed

──────────────────────────────────
Project: kunduso/rds-secretsmanager-rotation-lambda-terraform/TFplan.JSON

+ aws_db_instance.postgresql
  +$235

    + Database instance (on-demand, Multi-AZ, db.t3.large)
      +$212

    + Storage (general purpose SSD, gp3)
      +$23

    + Performance Insights API
      Monthly cost depends on usage
        +$0.01 per 1000 requests

Monthly cost change for kunduso/rds-secretsmanager-rotation-lambda-terraform/TFplan.JSON
Amount:  +$235 ($1 → $236)
Percent: +23,470%

──────────────────────────────────
Key: * usage cost, ~ changed, + added, - removed

*Usage costs can be estimated by updating Infracost Cloud settings, see docs for other options.

17 cloud resources were detected:
∙ 2 were estimated
∙ 15 were free

Infracost estimate: Monthly estimate increased by $235 ↑
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━┓
┃ Changed project                                                  ┃ Baseline cost ┃ Usage cost* ┃ Total change     ┃
┣━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╋━━━━━━━━━━━━━━━╋━━━━━━━━━━━━━╋━━━━━━━━━━━━━━━━━━┫
┃ kunduso/rds-secretsmanager-rotation-lambda-terraform/TFplan.JSON ┃         +$235 ┃           - ┃ +$235 (+23,470%) ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┻━━━━━━━━━━━━━━━┻━━━━━━━━━━━━━┻━━━━━━━━━━━━━━━━━━┛

_{This comment will be updated when code changes.}

[github-actions]

Terraform Format and Style 🖌success

Terraform Initialization ⚙️success

Terraform Plan 📖success

Terraform Validation 🤖success

Show Plan

terraform
aws_vpc.this: Refreshing state... [id=vpc-09ed669ef718ad103]
aws_kms_key.encryption_secret: Refreshing state... [id=11cf9e0b-5db8-40f5-bbc9-13bc6503efcc]
data.aws_availability_zones.available: Reading...
data.aws_caller_identity.current: Reading...
data.aws_caller_identity.current: Read complete after 0s [id=743794601996]
data.aws_availability_zones.available: Read complete after 0s [id=us-east-2]
aws_kms_alias.encryption_secret: Refreshing state... [id=alias/app-12]
aws_default_security_group.default: Refreshing state... [id=sg-058c5be6f3e934d9f]
aws_subnet.db[1]: Refreshing state... [id=subnet-03a6a070cf81b9dc0]
aws_subnet.db[0]: Refreshing state... [id=subnet-0b753ec44bb2a903a]
aws_route_table.this_rt: Refreshing state... [id=rtb-03ae0461faf7cfd7b]
aws_security_group.rds: Refreshing state... [id=sg-063f4be9c59e84a5f]
aws_route_table_association.db[1]: Refreshing state... [id=rtbassoc-0aca4a56dbb648bc4]
aws_route_table_association.db[0]: Refreshing state... [id=rtbassoc-087a87c2bd71d0aa6]
aws_security_group_rule.egress_rds_sg: Refreshing state... [id=sgrule-183414140]
aws_security_group_rule.ingress_rds_sg: Refreshing state... [id=sgrule-1771080517]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # aws_db_instance.postgresql will be created
  + resource "aws_db_instance" "postgresql" {
      + address                               = (known after apply)
      + allocated_storage                     = 100
      + apply_immediately                     = true
      + arn                                   = (known after apply)
      + auto_minor_version_upgrade            = true
      + availability_zone                     = (known after apply)
      + backup_retention_period               = (known after apply)
      + backup_target                         = (known after apply)
      + backup_window                         = (known after apply)
      + ca_cert_identifier                    = "rds-ca-rsa2048-g1"
      + character_set_name                    = (known after apply)
      + copy_tags_to_snapshot                 = true
      + db_name                               = (known after apply)
      + db_subnet_group_name                  = (known after apply)
      + dedicated_log_volume                  = false
      + delete_automated_backups              = true
      + deletion_protection                   = false
      + domain_fqdn                           = (known after apply)
      + enabled_cloudwatch_logs_exports       = [
          + "postgresql",
          + "upgrade",
        ]
      + endpoint                              = (known after apply)
      + engine                                = "postgres"
      + engine_lifecycle_support              = (known after apply)
      + engine_version                        = "16.3"
      + engine_version_actual                 = (known after apply)
      + hosted_zone_id                        = (known after apply)
      + id                                    = (known after apply)
      + identifier                            = "app-12"
      + identifier_prefix                     = (known after apply)
      + instance_class                        = "db.t3.large"
      + iops                                  = (known after apply)
      + kms_key_id                            = (known after apply)
      + latest_restorable_time                = (known after apply)
      + license_model                         = (known after apply)
      + listener_endpoint                     = (known after apply)
      + maintenance_window                    = (known after apply)
      + manage_master_user_password           = true
      + master_user_secret                    = (known after apply)
      + master_user_secret_kms_key_id         = "arn:aws:kms:us-east-2:743794601996:key/11cf9e0b-5db8-40f5-bbc9-13bc6503efcc"
      + monitoring_interval                   = 0
      + monitoring_role_arn                   = (known after apply)
      + multi_az                              = true
      + nchar_character_set_name              = (known after apply)
      + network_type                          = (known after apply)
      + option_group_name                     = (known after apply)
      + parameter_group_name                  = "app-12"
      + performance_insights_enabled          = true
      + performance_insights_kms_key_id       = (known after apply)
      + performance_insights_retention_period = (known after apply)
      + port                                  = (known after apply)
      + publicly_accessible                   = false
      + replica_mode                          = (known after apply)
      + replicas                              = (known after apply)
      + resource_id                           = (known after apply)
      + skip_final_snapshot                   = true
      + snapshot_identifier                   = (known after apply)
      + status                                = (known after apply)
      + storage_encrypted                     = true
      + storage_throughput                    = (known after apply)
      + storage_type                          = "gp3"
      + tags_all                              = {
          + "Source" = "https://github.com/kunduso/rds-secretsmanager-rotation-lambda-terraform"
        }
      + timezone                              = (known after apply)
      + username                              = "postgres"
      + vpc_security_group_ids                = [
          + "sg-063f4be9c59e84a5f",
        ]
    }

  # aws_db_parameter_group.postgres will be created
  + resource "aws_db_parameter_group" "postgres" {
      + arn          = (known after apply)
      + description  = "Managed by Terraform"
      + family       = "postgres16"
      + id           = (known after apply)
      + name         = "app-12"
      + name_prefix  = (known after apply)
      + skip_destroy = false
      + tags_all     = {
          + "Source" = "https://github.com/kunduso/rds-secretsmanager-rotation-lambda-terraform"
        }
    }

  # aws_db_subnet_group.rds will be created
  + resource "aws_db_subnet_group" "rds" {
      + arn                     = (known after apply)
      + description             = "Managed by Terraform"
      + id                      = (known after apply)
      + name                    = "app-12-subnet-group"
      + name_prefix             = (known after apply)
      + subnet_ids              = [
          + "subnet-03a6a070cf81b9dc0",
          + "subnet-0b753ec44bb2a903a",
        ]
      + supported_network_types = (known after apply)
      + tags_all                = {
          + "Source" = "https://github.com/kunduso/rds-secretsmanager-rotation-lambda-terraform"
        }
      + vpc_id                  = (known after apply)
    }

  # aws_iam_policy.ssm_parameter_policy will be created
  + resource "aws_iam_policy" "ssm_parameter_policy" {
      + arn              = (known after apply)
      + attachment_count = (known after apply)
      + description      = "Policy to read the RDS Password ARN stored in the SSM Parameter Store."
      + id               = (known after apply)
      + name             = "app-12-ssm-parameter-read-policy"
      + name_prefix      = (known after apply)
      + path             = "/"
      + policy           = (known after apply)
      + policy_id        = (known after apply)
      + tags_all         = {
          + "Source" = "https://github.com/kunduso/rds-secretsmanager-rotation-lambda-terraform"
        }
    }

  # aws_ssm_parameter.rds_secret_arn will be created
  + resource "aws_ssm_parameter" "rds_secret_arn" {
      + arn            = (known after apply)
      + data_type      = (known after apply)
      + id             = (known after apply)
      + insecure_value = (known after apply)
      + key_id         = (known after apply)
      + name           = "/app-12/rds-password-arn"
      + tags_all       = {
          + "Source" = "https://github.com/kunduso/rds-secretsmanager-rotation-lambda-terraform"
        }
      + tier           = (known after apply)
      + type           = "SecureString"
      + value          = (sensitive value)
      + version        = (known after apply)
    }

Plan: 5 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: TFplan.JSON

To perform exactly these actions, run the following command to apply:
    terraform apply "TFplan.JSON"

Pushed by: @kunduso, Action: pull_request