SRE-46: Upgrade Docker Postgres to 18.1-alpine3.23 (#8174)

Co-authored-by: Claude <noreply@anthropic.com>

Author: TimDiekmann

apps/hash-external-services/postgres/Dockerfile

@@ -1,4 +1,4 @@
-FROM postgres:17-alpine3.22
+FROM postgres:18.1-alpine3.23
 
 RUN apk add --no-cache --virtual .build-deps gcc clang19 llvm19 git make musl-dev pkgconf \
     && git clone --branch v0.8.1 https://github.com/pgvector/pgvector.git \

infra/terraform/hash/postgres/postgres.tf

@@ -5,8 +5,8 @@ resource "aws_db_subnet_group" "postgres" {
 }
 
 resource "aws_db_parameter_group" "postgres" {
-  name   = "${var.prefix}-pgparamgrp17"
-  family = "postgres17"
+  name   = "${var.prefix}-pgparamgrp18"
+  family = "postgres18"
 
   parameter {
     name  = "password_encryption"
@@ -67,7 +67,7 @@ resource "aws_db_instance" "postgres" {
   parameter_group_name            = aws_db_parameter_group.postgres.name
   enabled_cloudwatch_logs_exports = ["postgresql", "upgrade"]
   engine                          = "postgres"
-  engine_version                  = "17"
+  engine_version                  = "18"
   allow_major_version_upgrade     = true
   instance_class                  = var.instance_class
   db_name                         = "postgres" # Initial database name

infra/terraform/modules/bastion/bastion.tf

@@ -123,7 +123,7 @@ resource "aws_instance" "bastion" {
   depends_on    = [aws_key_pair.bastion_key]
   tags          = { Name = local.prefix }
   subnet_id     = var.subnet_ids[0]
-  instance_type = "t3a.nano"
+  instance_type = "t4g.nano"
 
   launch_template {
     name    = aws_launch_template.bastion.name

infra/terraform/modules/bastion/main.tf

@@ -18,21 +18,18 @@ data "aws_ami" "amazon_linux" {
   owners      = ["amazon"]
 
   filter {
-    name = "name"
+    name   = "name"
+    values = ["al2023-ami-2023.*-kernel-6.1-arm64"]
+  }
 
-    # list with the following command to update:
-    # `aws ec2 describe-images --owners amazon --filters "Name=name,Values=al2023-ami-ecs-hvm-*-x86_64" | jq '.Images | sort_by(.CreationDate) | reverse'`
-    # We don't wildcard here to not accidentally update to a non-functioning image.
-    values = [
-      "al2023-ami-ecs-hvm-2023.0.20250610-kernel-6.1-x86_64",
-    ]
+  filter {
+    name   = "virtualization-type"
+    values = ["hvm"]
   }
 
   filter {
-    name = "owner-alias"
-    values = [
-      "amazon",
-    ]
+    name   = "architecture"
+    values = ["arm64"]
   }
 }