[harvester] Use dedicated security group for accessing Postgres

Author: jacobwinch

notificationworkerlambda/harvester-cfn.yaml

@@ -32,6 +32,12 @@ Parameters:
   VpcSubnets:
     Description: Subnets to use in the VPC
     Type: List<AWS::EC2::Subnet::Id>
+  DbAccessSecurityGroup:
+    Description: Security group which grants access to Postgres (the stage-specific parameter store name is injected by Riff-Raff)
+    Type: AWS::SSM::Parameter::Value<AWS::EC2::SecurityGroup::Id>
+    AllowedValues:
+      - /CODE/mobile-notifications/registrations-db/postgres-access-security-group
+      - /PROD/mobile-notifications/registrations-db/postgres-access-security-group
   AlarmTopic:
     Type: String
     Description: The ARN of the SNS topic to send all the cloudwatch alarms to
@@ -166,7 +172,7 @@ Resources:
       ReservedConcurrentExecutions: 200
       VpcConfig:
         SecurityGroupIds:
-          - !ImportValue NotificationsDefaultSecurityGroup-NotificationsMainSecurityGroup
+          !Ref DbAccessSecurityGroup
         SubnetIds: !Ref VpcSubnets
       Tags:
         - Key: Stage

notificationworkerlambda/riff-raff.yaml

@@ -10,6 +10,11 @@ deployments:
       - mobile-notifications-workers-cfn
     parameters:
       templatePath: harvester-cfn.yaml
+      templateStageParameters:
+        CODE:
+          DbAccessSecurityGroup: /CODE/mobile-notifications/registrations-db/postgres-access-security-group
+        PROD:
+          DbAccessSecurityGroup: /PROD/mobile-notifications/registrations-db/postgres-access-security-group
   mobile-notifications-workers-cfn:
     type: cloud-formation
     app: n10n-workers