Skip to content

Commit 3550f1b

Browse files
bryantbiggsbryantbiggs
committed
BREAKING CHANGE: add new resource aws_db_proxy_endpoint for generating proxy endpoints from a dynamic map of inputs (#5)
1 parent 2ff2545 commit 3550f1b

File tree

22 files changed

+255
-108
lines changed

22 files changed

+255
-108
lines changed

‎.pre-commit-config.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
repos:
22
- repo: git://github.com/antonbabenko/pre-commit-terraform
3-
rev: v1.48.0
3+
rev: v1.50.0
44
hooks:
55
- id: terraform_fmt
66
- id: terraform_docs

‎README.md‎

Lines changed: 20 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,6 @@
22

33
Terraform module which creates an AWS RDS Proxy and its supporting resources.
44

5-
The following resources are supported:
6-
7-
- [AWS RDS Proxy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_proxy)
8-
- [AWS RDS Proxy Default Target Group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_proxy_default_target_group)
9-
- [AWS RDS Proxy Target](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_proxy_target)
10-
115
## Usage
126

137
See [`examples`](./examples) directory for working examples to reference:
@@ -21,6 +15,20 @@ module "rds_proxy" {
2115
vpc_subnet_ids = ["subnet-30ef7b3c", "subnet-1ecda77b", "subnet-ca09ddbc"]
2216
vpc_security_group_ids = ["sg-f1d03a88"]
2317
18+
db_proxy_endpoints = {
19+
read_write = {
20+
name = "read-write-endpoint"
21+
vpc_subnet_ids = ["subnet-30ef7b3c", "subnet-1ecda77b", "subnet-ca09ddbc"]
22+
vpc_security_group_ids = ["sg-f1d03a88"]
23+
},
24+
read_only = {
25+
name = "read-only-endpoint"
26+
vpc_subnet_ids = ["subnet-30ef7b3c", "subnet-1ecda77b", "subnet-ca09ddbc"]
27+
vpc_security_group_ids = ["sg-f1d03a88"]
28+
target_role = "READ_ONLY"
29+
}
30+
}
31+
2432
secrets = {
2533
"superuser" = {
2634
description = "Aurora PostgreSQL superuser password"
@@ -58,14 +66,14 @@ Examples codified under the [`examples`](./examples) are intended to give users
5866

5967
| Name | Version |
6068
|------|---------|
61-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.26 |
62-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.9 |
69+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.1 |
70+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.38 |
6371

6472
## Providers
6573

6674
| Name | Version |
6775
|------|---------|
68-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.9 |
76+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.38 |
6977

7078
## Modules
7179

@@ -78,6 +86,7 @@ No modules.
7886
| [aws_cloudwatch_log_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
7987
| [aws_db_proxy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_proxy) | resource |
8088
| [aws_db_proxy_default_target_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_proxy_default_target_group) | resource |
89+
| [aws_db_proxy_endpoint.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_proxy_endpoint) | resource |
8190
| [aws_db_proxy_target.db_cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_proxy_target) | resource |
8291
| [aws_db_proxy_target.db_instance](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_proxy_target) | resource |
8392
| [aws_iam_role.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
@@ -100,6 +109,7 @@ No modules.
100109
| <a name="input_db_host"></a> [db\_host](#input\_db\_host) | The identifier to use for the database endpoint | `string` | `""` | no |
101110
| <a name="input_db_instance_identifier"></a> [db\_instance\_identifier](#input\_db\_instance\_identifier) | DB instance identifier | `string` | `""` | no |
102111
| <a name="input_db_name"></a> [db\_name](#input\_db\_name) | The name of the database | `string` | `""` | no |
112+
| <a name="input_db_proxy_endpoints"></a> [db\_proxy\_endpoints](#input\_db\_proxy\_endpoints) | Map of DB proxy endpoints to create and their attributes (see `aws_db_proxy_endpoint`) | `any` | `{}` | no |
103113
| <a name="input_debug_logging"></a> [debug\_logging](#input\_debug\_logging) | Whether the proxy includes detailed information about SQL statements in its logs | `bool` | `false` | no |
104114
| <a name="input_engine_family"></a> [engine\_family](#input\_engine\_family) | The kind of database engine that the proxy will connect to. Valid values are `MYSQL` or `POSTGRESQL` | `string` | `""` | no |
105115
| <a name="input_iam_auth"></a> [iam\_auth](#input\_iam\_auth) | Whether to require or disallow AWS Identity and Access Management (IAM) authentication for connections to the proxy. One of `DISABLED`, `REQUIRED` | `string` | `"REQUIRED"` | no |
@@ -138,6 +148,7 @@ No modules.
138148

139149
| Name | Description |
140150
|------|-------------|
151+
| <a name="output_db_proxy_endpoints"></a> [db\_proxy\_endpoints](#output\_db\_proxy\_endpoints) | Array containing the full resource object and attributes for all DB proxy endpoints created |
141152
| <a name="output_log_group_arn"></a> [log\_group\_arn](#output\_log\_group\_arn) | The Amazon Resource Name (ARN) of the CloudWatch log group |
142153
| <a name="output_proxy_arn"></a> [proxy\_arn](#output\_proxy\_arn) | The Amazon Resource Name (ARN) for the proxy |
143154
| <a name="output_proxy_default_target_group_arn"></a> [proxy\_default\_target\_group\_arn](#output\_proxy\_default\_target\_group\_arn) | The Amazon Resource Name (ARN) for the default target group |

‎examples/mysql_iam_cluster/README.md‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -30,26 +30,26 @@ An EC2 instance configuration has been provided for use in validating the exampl
3030

3131
| Name | Version |
3232
|------|---------|
33-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.26 |
34-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.9 |
33+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.1 |
34+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.38 |
3535

3636
## Providers
3737

3838
| Name | Version |
3939
|------|---------|
40-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.9 |
40+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.38 |
4141
| <a name="provider_random"></a> [random](#provider\_random) | n/a |
4242

4343
## Modules
4444

4545
| Name | Source | Version |
4646
|------|--------|---------|
47-
| <a name="module_ec2_instance"></a> [ec2\_instance](#module\_ec2\_instance) | terraform-aws-modules/ec2-instance/aws | 2.16.0 |
48-
| <a name="module_ec2_sg"></a> [ec2\_sg](#module\_ec2\_sg) | terraform-aws-modules/security-group/aws | 3.17.0 |
49-
| <a name="module_rds"></a> [rds](#module\_rds) | terraform-aws-modules/rds-aurora/aws | 3.0.0 |
47+
| <a name="module_ec2_instance"></a> [ec2\_instance](#module\_ec2\_instance) | terraform-aws-modules/ec2-instance/aws | ~> 2 |
48+
| <a name="module_ec2_sg"></a> [ec2\_sg](#module\_ec2\_sg) | terraform-aws-modules/security-group/aws | ~> 4 |
49+
| <a name="module_rds"></a> [rds](#module\_rds) | terraform-aws-modules/rds-aurora/aws | ~> 4 |
5050
| <a name="module_rds_proxy"></a> [rds\_proxy](#module\_rds\_proxy) | ../../ | |
51-
| <a name="module_rds_proxy_sg"></a> [rds\_proxy\_sg](#module\_rds\_proxy\_sg) | terraform-aws-modules/security-group/aws | 3.17.0 |
52-
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | 2.64.0 |
51+
| <a name="module_rds_proxy_sg"></a> [rds\_proxy\_sg](#module\_rds\_proxy\_sg) | terraform-aws-modules/security-group/aws | ~> 4 |
52+
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 3 |
5353

5454
## Resources
5555

@@ -80,6 +80,7 @@ No inputs.
8080

8181
| Name | Description |
8282
|------|-------------|
83+
| <a name="output_db_proxy_endpoints"></a> [db\_proxy\_endpoints](#output\_db\_proxy\_endpoints) | Array containing the full resource object and attributes for all DB proxy endpoints created |
8384
| <a name="output_log_group_arn"></a> [log\_group\_arn](#output\_log\_group\_arn) | The Amazon Resource Name (ARN) of the CloudWatch log group |
8485
| <a name="output_proxy_arn"></a> [proxy\_arn](#output\_proxy\_arn) | The Amazon Resource Name (ARN) for the proxy |
8586
| <a name="output_proxy_default_target_group_arn"></a> [proxy\_default\_target\_group\_arn](#output\_proxy\_default\_target\_group\_arn) | The Amazon Resource Name (ARN) for the default target group |

‎examples/mysql_iam_cluster/main.tf‎

Lines changed: 27 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ resource "random_password" "password" {
3838

3939
module "vpc" {
4040
source = "terraform-aws-modules/vpc/aws"
41-
version = "2.64.0"
41+
version = "~> 3"
4242

4343
name = local.name
4444
cidr = "10.0.0.0/18"
@@ -57,7 +57,7 @@ module "vpc" {
5757

5858
module "rds" {
5959
source = "terraform-aws-modules/rds-aurora/aws"
60-
version = "3.0.0"
60+
version = "~> 4"
6161

6262
name = local.name
6363
database_name = local.db_name
@@ -77,7 +77,7 @@ module "rds" {
7777

7878
vpc_id = module.vpc.vpc_id
7979
subnets = module.vpc.database_subnets
80-
allowed_security_groups = [module.rds_proxy_sg.this_security_group_id]
80+
allowed_security_groups = [module.rds_proxy_sg.security_group_id]
8181

8282
db_subnet_group_name = local.name # Created by VPC module
8383
db_parameter_group_name = aws_db_parameter_group.aurora_db_mysql57_parameter_group.id
@@ -158,7 +158,7 @@ data "aws_ami" "ubuntu" {
158158

159159
module "ec2_sg" {
160160
source = "terraform-aws-modules/security-group/aws"
161-
version = "3.17.0"
161+
version = "~> 4"
162162

163163
name = "ec2"
164164
description = "EC2 RDS Proxy example security group"
@@ -171,7 +171,7 @@ module "ec2_sg" {
171171

172172
module "ec2_instance" {
173173
source = "terraform-aws-modules/ec2-instance/aws"
174-
version = "2.16.0"
174+
version = "~> 2"
175175

176176
name = local.name
177177
instance_count = 1
@@ -190,7 +190,7 @@ module "ec2_instance" {
190190

191191
ami = data.aws_ami.ubuntu.id
192192
instance_type = "t3.micro"
193-
vpc_security_group_ids = [module.ec2_sg.this_security_group_id]
193+
vpc_security_group_ids = [module.ec2_sg.security_group_id]
194194
subnet_ids = module.vpc.private_subnets
195195

196196
tags = local.tags
@@ -226,7 +226,7 @@ resource "aws_secretsmanager_secret_version" "superuser" {
226226

227227
module "rds_proxy_sg" {
228228
source = "terraform-aws-modules/security-group/aws"
229-
version = "3.17.0"
229+
version = "~> 4"
230230

231231
name = "rds_proxy"
232232
description = "PostgreSQL RDS Proxy example security group"
@@ -261,7 +261,23 @@ module "rds_proxy" {
261261
name = local.name
262262
iam_role_name = local.name
263263
vpc_subnet_ids = module.vpc.private_subnets
264-
vpc_security_group_ids = [module.rds_proxy_sg.this_security_group_id]
264+
vpc_security_group_ids = [module.rds_proxy_sg.security_group_id]
265+
266+
db_proxy_endpoints = {
267+
read_write = {
268+
name = "read-write-endpoint"
269+
vpc_subnet_ids = module.vpc.private_subnets
270+
vpc_security_group_ids = [module.rds_proxy_sg.security_group_id]
271+
tags = local.tags
272+
},
273+
read_only = {
274+
name = "read-only-endpoint"
275+
vpc_subnet_ids = module.vpc.private_subnets
276+
vpc_security_group_ids = [module.rds_proxy_sg.security_group_id]
277+
target_role = "READ_ONLY"
278+
tags = local.tags
279+
}
280+
}
265281

266282
secrets = {
267283
"${local.db_username}" = {
@@ -272,13 +288,13 @@ module "rds_proxy" {
272288
}
273289

274290
engine_family = "MYSQL"
275-
db_host = module.rds.this_rds_cluster_endpoint
276-
db_name = module.rds.this_rds_cluster_database_name
291+
db_host = module.rds.rds_cluster_endpoint
292+
db_name = module.rds.rds_cluster_database_name
277293
debug_logging = true
278294

279295
# Target Aurora cluster
280296
target_db_cluster = true
281-
db_cluster_identifier = module.rds.this_rds_cluster_id
297+
db_cluster_identifier = module.rds.rds_cluster_id
282298

283299
tags = local.tags
284300
}

‎examples/mysql_iam_cluster/outputs.tf‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,12 @@ output "proxy_target_type" {
6666
value = module.rds_proxy.proxy_target_type
6767
}
6868

69+
# DB proxy endponts
70+
output "db_proxy_endpoints" {
71+
description = "Array containing the full resource object and attributes for all DB proxy endpoints created"
72+
value = module.rds_proxy.db_proxy_endpoints
73+
}
74+
6975
# CloudWatch logs
7076
output "log_group_arn" {
7177
description = "The Amazon Resource Name (ARN) of the CloudWatch log group"
@@ -75,7 +81,8 @@ output "log_group_arn" {
7581
# For aiding in testing & verification
7682
output "superuser_db_password_connect" {
7783
description = "Connect to database using superuser with username/password directly to database"
78-
value = "mysql --host=${module.rds.this_rds_cluster_endpoint} --user=${local.db_username} --password=${local.db_password} ${module.rds.this_rds_cluster_database_name}"
84+
value = "mysql --host=${module.rds.rds_cluster_endpoint} --user=${local.db_username} --password=${local.db_password} ${module.rds.rds_cluster_database_name}"
85+
sensitive = true
7986
}
8087

8188
output "superuser_proxy_iam_token" {
@@ -85,5 +92,5 @@ output "superuser_proxy_iam_token" {
8592

8693
output "superuser_proxy_iam_connect" {
8794
description = "Connect to RDS Proxy using IAM auth via token generated"
88-
value = "mysql --host=${module.rds_proxy.proxy_endpoint} --user=${local.db_username} --password=$TOKEN ${module.rds.this_rds_cluster_database_name} --ssl-ca=/home/ssm-user/AmazonRootCA1.pem --enable-cleartext-plugin"
95+
value = "mysql --host=${module.rds_proxy.proxy_endpoint} --user=${local.db_username} --password=$TOKEN ${module.rds.rds_cluster_database_name} --ssl-ca=/home/ssm-user/AmazonRootCA1.pem --enable-cleartext-plugin"
8996
}

‎examples/mysql_iam_cluster/versions.tf‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,10 @@
11
terraform {
2-
required_version = ">= 0.12.26"
2+
required_version = ">= 0.13.1"
33

44
required_providers {
5-
aws = ">= 3.9"
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">= 3.38"
8+
}
69
}
710
}

‎examples/mysql_iam_instance/README.md‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -30,27 +30,27 @@ An EC2 instance configuration has been provided for use in validating the exampl
3030

3131
| Name | Version |
3232
|------|---------|
33-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.12.26 |
34-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.9 |
33+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.1 |
34+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.38 |
3535

3636
## Providers
3737

3838
| Name | Version |
3939
|------|---------|
40-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.9 |
40+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.38 |
4141
| <a name="provider_random"></a> [random](#provider\_random) | n/a |
4242

4343
## Modules
4444

4545
| Name | Source | Version |
4646
|------|--------|---------|
47-
| <a name="module_ec2_instance"></a> [ec2\_instance](#module\_ec2\_instance) | terraform-aws-modules/ec2-instance/aws | 2.16.0 |
48-
| <a name="module_ec2_sg"></a> [ec2\_sg](#module\_ec2\_sg) | terraform-aws-modules/security-group/aws | 3.17.0 |
49-
| <a name="module_rds"></a> [rds](#module\_rds) | terraform-aws-modules/rds/aws | 2.20.0 |
47+
| <a name="module_ec2_instance"></a> [ec2\_instance](#module\_ec2\_instance) | terraform-aws-modules/ec2-instance/aws | ~> 2 |
48+
| <a name="module_ec2_sg"></a> [ec2\_sg](#module\_ec2\_sg) | terraform-aws-modules/security-group/aws | ~> 4 |
49+
| <a name="module_rds"></a> [rds](#module\_rds) | terraform-aws-modules/rds/aws | ~> 3 |
5050
| <a name="module_rds_proxy"></a> [rds\_proxy](#module\_rds\_proxy) | ../../ | |
51-
| <a name="module_rds_proxy_sg"></a> [rds\_proxy\_sg](#module\_rds\_proxy\_sg) | terraform-aws-modules/security-group/aws | 3.17.0 |
52-
| <a name="module_rds_sg"></a> [rds\_sg](#module\_rds\_sg) | terraform-aws-modules/security-group/aws | 3.17.0 |
53-
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | 2.64.0 |
51+
| <a name="module_rds_proxy_sg"></a> [rds\_proxy\_sg](#module\_rds\_proxy\_sg) | terraform-aws-modules/security-group/aws | ~> 4 |
52+
| <a name="module_rds_sg"></a> [rds\_sg](#module\_rds\_sg) | terraform-aws-modules/security-group/aws | ~> 4 |
53+
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 3 |
5454

5555
## Resources
5656

@@ -79,6 +79,7 @@ No inputs.
7979

8080
| Name | Description |
8181
|------|-------------|
82+
| <a name="output_db_proxy_endpoints"></a> [db\_proxy\_endpoints](#output\_db\_proxy\_endpoints) | Array containing the full resource object and attributes for all DB proxy endpoints created |
8283
| <a name="output_log_group_arn"></a> [log\_group\_arn](#output\_log\_group\_arn) | The Amazon Resource Name (ARN) of the CloudWatch log group |
8384
| <a name="output_proxy_arn"></a> [proxy\_arn](#output\_proxy\_arn) | The Amazon Resource Name (ARN) for the proxy |
8485
| <a name="output_proxy_default_target_group_arn"></a> [proxy\_default\_target\_group\_arn](#output\_proxy\_default\_target\_group\_arn) | The Amazon Resource Name (ARN) for the default target group |

0 commit comments

Comments
 (0)