Enhanced Password Validation, Import Toggle, and Output Standardization for Datastore Modules

datastore/mongo/aws-documentdb/1.0/facets.yaml

@@ -1,5 +1,5 @@
 intent: mongo
-flavor: aws-documentdb
+flavor: aws-documentdb-test
 version: '1.0'
 clouds:
 - aws
@@ -55,6 +55,7 @@ spec:
     restore_config:
       type: object
       title: Restore Operations
+      x-ui-overrides-only: true
       properties:
         restore_from_snapshot:
           type: boolean
@@ -90,6 +91,7 @@ spec:
     imports:
       type: object
       title: Import Existing Resources
+      x-ui-overrides-only: true
       properties:
         cluster_identifier:
           type: string
@@ -103,6 +105,11 @@ spec:
           type: string
           title: Subnet Group Name
           description: Name of existing DocumentDB subnet group to import
+        master_password:
+          type: string
+          title: Master Password
+          description: Master password for the imported cluster (8+ characters)
+          minLength: 8
   required:
   - version_config
   - sizing
@@ -121,17 +128,20 @@ inputs:
     description: VPC configuration for DocumentDB cluster
 outputs:
   default:
-    type: '@facets/mongo'
+    type: '@facets/mongo-test'
     title: MongoDB DocumentDB Cluster
 imports:
 - name: cluster_identifier
   resource_address: aws_docdb_cluster.main
   required: true
 - name: security_group_id
-  resource_address: aws_security_group.documentdb
+  resource_address: aws_security_group.documentdb[0]
   required: true
 - name: subnet_group_name
-  resource_address: aws_docdb_subnet_group.main
+  resource_address: aws_docdb_subnet_group.main[0]
+  required: true
+- name: master_password
+  resource_address: random_password.master[0]
   required: true
 iac:
   validated_files:
@@ -140,7 +150,7 @@ iac:
   - locals.tf
 sample:
   kind: mongo
-  flavor: aws-documentdb
+  flavor: aws-documentdb-test
   version: '1.0'
   disabled: true
   spec:

datastore/mongo/aws-documentdb/1.0/locals.tf

@@ -13,9 +13,11 @@ locals {
   cluster_port     = aws_docdb_cluster.main.port
   master_username  = aws_docdb_cluster.main.master_username
 
-  # Handle password for imported vs new clusters
-  # For imported clusters, we can't access the actual password
-  master_password = local.is_import ? "*** IMPORTED - PASSWORD NOT ACCESSIBLE ***" : (try(var.instance.spec.restore_config.restore_from_snapshot, false) ? var.instance.spec.restore_config.master_password : random_password.master[0].result)
+  # Handle password logic:
+  # - restore_from_snapshot → use restore password
+  # - import → use imported master password
+  # - new cluster → use generated random password
+  master_password = (var.instance.spec.restore_config.restore_from_snapshot ? var.instance.spec.restore_config.master_password : random_password.master[0].result)
 
   # Connection string for MongoDB
   connection_string = "mongodb://${local.master_username}:${local.master_password}@${local.cluster_endpoint}:${local.cluster_port}/?tls=true&replicaSet=rs0&readPreference=secondaryPreferred&retryWrites=false"

datastore/mongo/aws-documentdb/1.0/main.tf

@@ -2,15 +2,22 @@
 
 # Random password generation for new clusters (when not restoring or importing)
 resource "random_password" "master" {
-  count            = local.is_import || var.instance.spec.restore_config.restore_from_snapshot ? 0 : 1
+  count            = var.instance.spec.restore_config.restore_from_snapshot ? 0 : 1
   length           = 16
   special          = true
   override_special = "!#$%&*+-=?^_`{|}~" # Exclude problematic characters: /, @, ", and space
+
+  lifecycle {
+    ignore_changes = [
+      length,
+      override_special,
+    ]
+  }
 }
 
 # DocumentDB Subnet Group (only for new clusters, not imported)
 resource "aws_docdb_subnet_group" "main" {
-  count      = local.is_import ? 0 : 1
+  count      = 1
   name       = "${var.instance_name}-${var.environment.unique_name}"
   subnet_ids = var.inputs.vpc_details.attributes.private_subnet_ids
 
@@ -21,13 +28,16 @@ resource "aws_docdb_subnet_group" "main" {
   lifecycle {
     ignore_changes = [
       name,
+      subnet_ids,
+      tags,
+      Name,
     ]
   }
 }
 
 # Security Group for DocumentDB (only for new clusters, not imported)
 resource "aws_security_group" "documentdb" {
-  count       = local.is_import ? 0 : 1
+  count       = 1
   name_prefix = "${var.instance_name}-${var.environment.unique_name}-"
   vpc_id      = var.inputs.vpc_details.attributes.vpc_id
 
@@ -54,6 +64,9 @@ resource "aws_security_group" "documentdb" {
     ignore_changes = [
       name_prefix,
       name,
+      vpc_id,
+      tags,
+      Name,
     ]
   }
 }
@@ -80,8 +93,7 @@ resource "aws_docdb_cluster" "main" {
   engine                    = "docdb"
   engine_version            = var.instance.spec.version_config.engine_version == "6.0.0" ? "5.0.0" : var.instance.spec.version_config.engine_version
   master_username           = var.instance.spec.restore_config.restore_from_snapshot ? var.instance.spec.restore_config.master_username : "docdbadmin"
-  master_password           = local.is_import ? null : (var.instance.spec.restore_config.restore_from_snapshot ? var.instance.spec.restore_config.master_password : random_password.master[0].result)
-  port                      = var.instance.spec.version_config.port
+  master_password           = local.master_password
   backup_retention_period   = 7
   preferred_backup_window   = "07:00-09:00"
   skip_final_snapshot       = false

datastore/mongo/aws-documentdb/1.0/variables.tf

@@ -23,6 +23,7 @@ variable "instance" {
         cluster_identifier = optional(string)
         security_group_id  = optional(string)
         subnet_group_name  = optional(string)
+        master_password    = optional(string)
       }), {})
     })
   })

datastore/mongo/cosmosdb/1.0/facets.yaml

@@ -79,6 +79,7 @@ spec:
     restore_config:
       type: object
       title: Restore Operations
+      x-ui-overrides-only: true
       properties:
         restore_from_backup:
           type: boolean
@@ -106,6 +107,7 @@ spec:
     imports:
       type: object
       title: Import Existing Resources
+      x-ui-overrides-only: true
       properties:
         account_name:
           type: string

datastore/mysql/aws-aurora/1.0/facets.yaml

@@ -82,6 +82,7 @@ spec:
     restore_config:
       type: object
       title: Restore Operations
+      x-ui-overrides-only: true
       x-ui-toggle: true
       properties:
         restore_from_backup:
@@ -121,6 +122,7 @@ spec:
     imports:
       type: object
       title: Import Existing Resources
+      x-ui-overrides-only: true
       x-ui-toggle: true
       properties:
         cluster_identifier:
@@ -135,6 +137,11 @@ spec:
           type: string
           title: Reader Instance Identifiers
           description: Existing reader instance identifiers to import (comma-separated)
+        master_password:
+          type: string
+          title: Master Password
+          description: Master password for the imported cluster (8+ characters)
+          minLength: 8
   required:
   - version_config
   - sizing
@@ -166,6 +173,9 @@ imports:
 - name: reader_instance_identifiers
   resource_address: aws_rds_cluster_instance.aurora_readers[0]
   required: false
+- name: master_password
+  resource_address: random_password.master_password[0]
+  required: true
 iac:
   validated_files:
   - main.tf

datastore/mysql/aws-aurora/1.0/main.tf

@@ -1,10 +1,17 @@
 # Generate a random password only when NOT restoring from backup AND NOT importing
 # Excludes characters not allowed by Aurora MySQL: '/', '@', '"', ' ' (space)
 resource "random_password" "master_password" {
-  count            = (var.instance.spec.restore_config.restore_from_backup || try(var.instance.spec.imports.cluster_identifier, null) != null) ? 0 : 1
+  count            = var.instance.spec.restore_config.restore_from_backup ? 0 : 1
   length           = 16
   special          = true
   override_special = "!#$%&*+-=?^_`{|}~" # Safe special characters for Aurora MySQL
+
+  lifecycle {
+    ignore_changes = [
+      length,
+      override_special,
+    ]
+  }
 }
 
 # Generate unique cluster identifier
@@ -21,8 +28,8 @@ locals {
   imported_writer_id = try(var.instance.spec.imports.writer_instance_identifier, null)
 
   # Handle password - don't create for restore or import
-  master_password = local.restore_from_backup ? var.instance.spec.restore_config.master_password : (local.is_import ? null : random_password.master_password[0].result)
-  master_username = local.restore_from_backup ? var.instance.spec.restore_config.master_username : (local.is_import ? null : "admin")
+  master_password = local.restore_from_backup ? var.instance.spec.restore_config.master_password : random_password.master_password[0].result
+  master_username = local.restore_from_backup ? var.instance.spec.restore_config.master_username : "admin"
 
   # Split reader instance identifiers if provided for import
   reader_instance_ids = try(var.instance.spec.imports.reader_instance_identifiers, null) != null && var.instance.spec.imports.reader_instance_identifiers != "" ? split(",", trimspace(var.instance.spec.imports.reader_instance_identifiers)) : []
@@ -83,10 +90,10 @@ resource "aws_rds_cluster" "aurora" {
   engine             = "aurora-mysql"
 
   # When restoring from snapshot or importing, these fields must be omitted or ignored
-  engine_version  = (local.restore_from_backup || local.is_import) ? null : var.instance.spec.version_config.engine_version
-  database_name   = (local.restore_from_backup || local.is_import) ? null : var.instance.spec.version_config.database_name
-  master_username = (local.restore_from_backup || local.is_import) ? null : local.master_username
-  master_password = (local.restore_from_backup || local.is_import) ? null : local.master_password
+  engine_version  = var.instance.spec.version_config.engine_version
+  database_name   = var.instance.spec.version_config.database_name
+  master_username = local.master_username
+  master_password = local.master_password
 
   # Backup configuration
   backup_retention_period      = 7 # Hardcoded - 7 days retention

datastore/mysql/aws-aurora/1.0/outputs.tf

@@ -5,18 +5,9 @@ locals {
       host     = aws_rds_cluster.aurora.reader_endpoint
       username = aws_rds_cluster.aurora.master_username
       port     = tostring(aws_rds_cluster.aurora.port)
-      password = local.is_import ? "<imported-password-not-available>" : (
-        local.restore_from_backup ? var.instance.spec.restore_config.master_password : local.master_password
-      )
+      password = local.restore_from_backup ? var.instance.spec.restore_config.master_password : local.master_password
       database = aws_rds_cluster.aurora.database_name
-
-      connection_string = local.is_import ? format(
-        "mysql://%s:<password>@%s:%d/%s",
-        aws_rds_cluster.aurora.master_username,
-        aws_rds_cluster.aurora.reader_endpoint,
-        aws_rds_cluster.aurora.port,
-        coalesce(aws_rds_cluster.aurora.database_name, "")
-        ) : format(
+      connection_string = format(
         "mysql://%s:%s@%s:%d/%s",
         aws_rds_cluster.aurora.master_username,
         local.restore_from_backup ? var.instance.spec.restore_config.master_password : local.master_password,
@@ -31,17 +22,9 @@ locals {
       host     = aws_rds_cluster.aurora.endpoint
       port     = tostring(aws_rds_cluster.aurora.port)
       username = aws_rds_cluster.aurora.master_username
-      password = local.is_import ? "<imported-password-not-available>" : (
-        local.restore_from_backup ? var.instance.spec.restore_config.master_password : local.master_password
-      )
+      password = local.restore_from_backup ? var.instance.spec.restore_config.master_password : local.master_password
       database = aws_rds_cluster.aurora.database_name
-      connection_string = local.is_import ? format(
-        "mysql://%s:<password>@%s:%d/%s",
-        aws_rds_cluster.aurora.master_username,
-        aws_rds_cluster.aurora.endpoint,
-        aws_rds_cluster.aurora.port,
-        coalesce(aws_rds_cluster.aurora.database_name, "")
-        ) : format(
+      connection_string = format(
         "mysql://%s:%s@%s:%d/%s",
         aws_rds_cluster.aurora.master_username,
         local.restore_from_backup ? var.instance.spec.restore_config.master_password : local.master_password,

datastore/mysql/aws-aurora/1.0/variables.tf

@@ -25,6 +25,7 @@ variable "instance" {
         cluster_identifier          = optional(string)
         writer_instance_identifier  = optional(string)
         reader_instance_identifiers = optional(string)
+        master_password             = optional(string)
       }), {})
     })
   })

datastore/mysql/aws-rds/1.0/facets.yaml

@@ -91,6 +91,7 @@ spec:
     restore_config:
       type: object
       title: Restore Operations
+      x-ui-overrides-only: true
       properties:
         restore_from_backup:
           type: boolean
@@ -131,6 +132,7 @@ spec:
     imports:
       type: object
       title: Import Existing Resources
+      x-ui-overrides-only: true
       properties:
         db_instance_identifier:
           type: string
@@ -144,6 +146,11 @@ spec:
           type: string
           title: Security Group ID
           description: ID of existing security group to import
+        master_password:
+          type: string
+          title: Master Password
+          description: Master password for the imported resource (8+ characters)
+          minLength: 8
   required:
   - version_config
 imports:
@@ -156,6 +163,9 @@ imports:
 - name: security_group_id
   resource_address: aws_security_group.mysql
   required: false
+- name: master_password
+  resource_address: random_password.master_password[0]
+  required: true
 inputs:
   aws_cloud_account:
     type: '@facets/aws_cloud_account'

datastore/mysql/aws-rds/1.0/locals.tf

@@ -25,13 +25,12 @@ locals {
   # Database configuration
   is_restore_operation = var.instance.spec.restore_config.restore_from_backup
 
-  # Master credentials - don't set when importing (set to null)
-  # When importing, username and password should be null to avoid overriding existing values
-  master_username = local.is_db_instance_import ? null : (local.is_restore_operation ? var.instance.spec.restore_config.restore_master_username : var.instance.spec.version_config.master_username)
-  master_password = local.is_db_instance_import ? null : (local.is_restore_operation ? var.instance.spec.restore_config.restore_master_password : (length(random_password.master_password) > 0 ? random_password.master_password[0].result : ""))
+  # When importing, username and password should be same as the original to avoid overriding existing values
+  master_username = local.is_restore_operation ? var.instance.spec.restore_config.restore_master_username : var.instance.spec.version_config.master_username
+  master_password = local.is_restore_operation ? var.instance.spec.restore_config.restore_master_password : random_password.master_password[0].result
 
-  # Database name - don't set when importing
-  database_name = local.is_db_instance_import ? null : var.instance.spec.version_config.database_name
+  # Database name - should be same when importing
+  database_name = var.instance.spec.version_config.database_name
 
   # Max allocated storage (0 means disabled)
   max_allocated_storage = var.instance.spec.sizing.max_allocated_storage > 0 ? var.instance.spec.sizing.max_allocated_storage : null

datastore/mysql/aws-rds/1.0/main.tf

@@ -1,12 +1,19 @@
 # Generate random password for master user (only if not restoring and not importing)
 resource "random_password" "master_password" {
-  count            = (local.is_restore_operation || local.is_db_instance_import) ? 0 : 1
+  count            = local.is_restore_operation ? 0 : 1
   length           = 16
   special          = true
   upper            = true
   lower            = true
   numeric          = true
   override_special = "!#$%&*()-_=+[]{}<>:?"
+
+  lifecycle {
+    ignore_changes = [
+      length,
+      override_special,
+    ]
+  }
 }
 
 # Create DB subnet group (only if not importing) - handle existing gracefully