Skip to content

[expired-registration-cleaner] Use dedicated security group for accessing Postgres #1708

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jacobwinch merged 1 commit into from
Mar 4, 2026
Merged

[expired-registration-cleaner] Use dedicated security group for accessing Postgres #1708

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion notificationworkerlambda/expired-registration-cleaner-cfn.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,12 @@ Parameters:
VpcSubnets:
Description: Subnets to use in the VPC
Type: List<AWS::EC2::Subnet::Id>
DbAccessSecurityGroup:
Description: Security group which grants access to Postgres (the stage-specific parameter store name is injected by Riff-Raff)
Type: AWS::SSM::Parameter::Value<AWS::EC2::SecurityGroup::Id>
AllowedValues:
- /CODE/mobile-notifications/registrations-db/postgres-access-security-group
- /PROD/mobile-notifications/registrations-db/postgres-access-security-group
Resources:
ExecutionRole:
Type: AWS::IAM::Role
Expand Down Expand Up @@ -100,7 +106,7 @@ Resources:
Timeout: 60
VpcConfig:
SecurityGroupIds:
- !ImportValue NotificationsDefaultSecurityGroup-NotificationsMainSecurityGroup
- !Ref DbAccessSecurityGroup
SubnetIds: !Ref VpcSubnets

DailyEvent:
Expand Down
5 changes: 5 additions & 0 deletions notificationworkerlambda/riff-raff.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,11 @@ deployments:
prependStackToCloudFormationStackName: false
cloudFormationStackName: expired-registration-cleaner-cfn
templatePath: expired-registration-cleaner-cfn.yaml
templateStageParameters:
CODE:
DbAccessSecurityGroup: /CODE/mobile-notifications/registrations-db/postgres-access-security-group
PROD:
DbAccessSecurityGroup: /PROD/mobile-notifications/registrations-db/postgres-access-security-group
registrations-db-proxy-cfn:
type: cloud-formation
app: registrations-db-proxy
Expand Down