Skip to content

[harvester] Use dedicated security group for accessing Postgres #1709

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jacobwinch merged 2 commits into from
Mar 4, 2026
Merged

[harvester] Use dedicated security group for accessing Postgres #1709

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6883fe7
[harvester] Use dedicated security group for accessing Postgres
jacobwinch Feb 26, 2026
1f0d766
Merge branch 'main' into jw-harvester-sg
jacobwinch Mar 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion notificationworkerlambda/harvester-cfn.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,12 @@ Parameters:
VpcSubnets:
Description: Subnets to use in the VPC
Type: List<AWS::EC2::Subnet::Id>
DbAccessSecurityGroup:
Description: Security group which grants access to Postgres (the stage-specific parameter store name is injected by Riff-Raff)
Type: AWS::SSM::Parameter::Value<AWS::EC2::SecurityGroup::Id>
AllowedValues:
- /CODE/mobile-notifications/registrations-db/postgres-access-security-group
- /PROD/mobile-notifications/registrations-db/postgres-access-security-group
AlarmTopic:
Type: String
Description: The ARN of the SNS topic to send all the cloudwatch alarms to
Expand Down Expand Up @@ -166,7 +172,7 @@ Resources:
ReservedConcurrentExecutions: 200
VpcConfig:
SecurityGroupIds:
- !ImportValue NotificationsDefaultSecurityGroup-NotificationsMainSecurityGroup
- !Ref DbAccessSecurityGroup
SubnetIds: !Ref VpcSubnets
Tags:
- Key: Stage
Expand Down
5 changes: 5 additions & 0 deletions notificationworkerlambda/riff-raff.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,11 @@ deployments:
- mobile-notifications-workers-cfn
parameters:
templatePath: harvester-cfn.yaml
templateStageParameters:
CODE:
DbAccessSecurityGroup: /CODE/mobile-notifications/registrations-db/postgres-access-security-group
PROD:
DbAccessSecurityGroup: /PROD/mobile-notifications/registrations-db/postgres-access-security-group
mobile-notifications-workers-cfn:
type: cloud-formation
app: n10n-workers
Expand Down