Skip to content

Commit 89f8cfb

Browse files
simplyalamsimplyalam
committed
init
0 parents  commit 89f8cfb

File tree

7 files changed

+443
-0
lines changed

7 files changed

+443
-0
lines changed

‎.github/workflows/ryvn-aws-rds-postgres-release.yaml‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
name: Build & Release aws-rds-postgres
2+
3+
on:
4+
push:
5+
branches:
6+
- "main"
7+
paths:
8+
- "**"
9+
pull_request:
10+
branches:
11+
- "main"
12+
paths:
13+
- "**"
14+
15+
env:
16+
SERVICE_NAME: aws-rds-postgres
17+
18+
jobs:
19+
generate-tag:
20+
name: Generate Release Tag
21+
if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
22+
runs-on: ubuntu-latest
23+
permissions:
24+
contents: read
25+
id-token: write
26+
27+
outputs:
28+
version: ${{ steps.generate-tag.outputs.version }}
29+
new_tag: ${{ steps.generate-tag.outputs.new_tag }}
30+
31+
steps:
32+
- name: Checkout code
33+
uses: actions/checkout@v4
34+
with:
35+
fetch-depth: 0
36+
37+
- name: Install Ryvn CLI
38+
uses: ryvn-technologies/install-ryvn-cli@v1.0.0
39+
40+
- name: Generate Release Tag
41+
id: generate-tag
42+
env:
43+
RYVN_CLIENT_ID: ${{ secrets.RYVN_CLIENT_ID }}
44+
RYVN_CLIENT_SECRET: ${{ secrets.RYVN_CLIENT_SECRET }}
45+
run: |
46+
# Generate new tag using ryvn CLI
47+
tag_info=$(ryvn generate-release-tag ${{ env.SERVICE_NAME }} --prefix=aws-rds-postgres@ -o json --default-bump-minor)
48+
49+
# Extract version and tag from JSON output
50+
version=$(echo "$tag_info" | jq -r '.version')
51+
new_tag=$(echo "$tag_info" | jq -r '.tag')
52+
53+
echo "version=$version" >> $GITHUB_OUTPUT
54+
echo "new_tag=$new_tag" >> $GITHUB_OUTPUT
55+
56+
57+
release:
58+
name: Create Release
59+
60+
needs: [generate-tag]
61+
62+
if: |
63+
github.ref == format('refs/heads/{0}', github.event.repository.default_branch) &&
64+
!contains(github.event.head_commit.message, '[skip-release]') &&
65+
!contains(github.event.pull_request.title, '[skip-release]')
66+
runs-on: ubuntu-latest
67+
permissions:
68+
contents: write
69+
70+
steps:
71+
- name: Checkout code
72+
uses: actions/checkout@v4
73+
with:
74+
fetch-depth: 0
75+
76+
- name: Install Ryvn CLI
77+
uses: ryvn-technologies/install-ryvn-cli@v1.0.0
78+
79+
- name: Create Ryvn Release
80+
env:
81+
RYVN_CLIENT_ID: ${{ secrets.RYVN_CLIENT_ID }}
82+
RYVN_CLIENT_SECRET: ${{ secrets.RYVN_CLIENT_SECRET }}
83+
run: |
84+
version="${{ needs.generate-tag.outputs.new_tag }}"
85+
version=${version#aws-rds-postgres@}
86+
version=${version#@}
87+
ryvn create release ${{ env.SERVICE_NAME }} $version
88+
89+
- name: Create GitHub Tag
90+
run: |
91+
new_tag="${{ needs.generate-tag.outputs.new_tag }}"
92+
git config --global user.email "github-actions[bot]@users.noreply.github.com"
93+
git config --global user.name "github-actions[bot]"
94+
git tag $new_tag
95+
git push origin $new_tag
96+
97+
- name: Create GitHub Release
98+
uses: softprops/action-gh-release@v1
99+
with:
100+
tag_name: ${{ needs.generate-tag.outputs.new_tag }}
101+
name: ${{ needs.generate-tag.outputs.new_tag }}
102+
generate_release_notes: true
103+
draft: false
104+
prerelease: false

‎README.md‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
# AWS RDS PostgreSQL Terraform Module
2+
3+
This Terraform module provisions a PostgreSQL database instance on Amazon RDS with configurable settings and security groups.
4+
5+
## Features
6+
7+
- Creates a PostgreSQL RDS instance with customizable configuration
8+
- Sets up a dedicated VPC security group with configurable access rules
9+
- Configures subnet groups for the RDS instance
10+
- Supports encryption, backups, and maintenance windows
11+
- Generates random pet names for resource identification
12+
13+
## Usage
14+
15+
```hcl
16+
module "postgres" {
17+
source = "github.com/ryvn-technologies/aws-rds-postgres"
18+
19+
# Required variables
20+
vpc_id = "vpc-xxxxxxxx"
21+
subnet_ids = ["subnet-xxxxxxxx", "subnet-yyyyyyyy"]
22+
database_name = "myapp"
23+
username = "dbadmin"
24+
password = "your-secure-password"
25+
26+
# Optional variables
27+
instance_class = "db.t3.micro"
28+
allocated_storage = 20
29+
30+
# Configure access rules
31+
ingress_cidr_blocks = ["10.0.0.0/8"] # Restrict access to internal network
32+
33+
tags = {
34+
Environment = "production"
35+
Project = "myapp"
36+
}
37+
}
38+
```
39+
40+
## Requirements
41+
42+
- Terraform >= 1.0.0
43+
- AWS Provider >= 4.0.0
44+
- Random Provider >= 3.0.0
45+
46+
## Providers
47+
48+
| Name | Version |
49+
|--------|---------|
50+
| aws | >= 4.0.0 |
51+
| random | >= 3.0.0 |
52+
53+
## Inputs
54+
55+
### Required Variables
56+
57+
| Name | Description | Type | Default |
58+
|------|-------------|------|---------|
59+
| vpc_id | VPC ID where RDS will be deployed | `string` | - |
60+
| subnet_ids | A list of VPC subnet IDs | `list(string)` | - |
61+
| database_name | The name of the database to create | `string` | - |
62+
| username | Username for the master DB user | `string` | - |
63+
| password | Password for the master DB user | `string` | - |
64+
65+
### Optional Variables
66+
67+
| Name | Description | Type | Default |
68+
|------|-------------|------|---------|
69+
| region | AWS region for the provider configuration | `string` | - |
70+
| engine_version | PostgreSQL engine version | `string` | `"17.4"` |
71+
| instance_class | The instance type of the RDS instance | `string` | `"db.t3.micro"` |
72+
| allocated_storage | The allocated storage in gigabytes | `number` | `20` |
73+
| storage_type | Storage type (standard, gp2, or io1) | `string` | `"gp2"` |
74+
| storage_encrypted | Specifies whether the DB instance is encrypted | `bool` | `true` |
75+
| multi_az | Specifies if the RDS instance is multi-AZ | `bool` | `false` |
76+
| backup_retention_period | The days to retain backups for | `number` | `7` |
77+
| backup_window | The daily time range for automated backups | `string` | `"03:00-04:00"` |
78+
| maintenance_window | The window to perform maintenance in | `string` | `"Mon:04:00-Mon:05:00"` |
79+
| skip_final_snapshot | Skip final snapshot before deletion | `bool` | `false` |
80+
| ingress_cidr_blocks | List of CIDR blocks to allow access to the database | `list(string)` | `["0.0.0.0/0"]` |
81+
| egress_cidr_blocks | List of CIDR blocks to allow egress traffic from the database | `list(string)` | `["0.0.0.0/0"]` |
82+
| tags | A mapping of tags to assign to all resources | `map(string)` | `{}` |
83+
84+
## Outputs
85+
86+
| Name | Description |
87+
|------|-------------|
88+
| db_instance_id | The RDS instance ID |
89+
| db_instance_address | The address of the RDS instance |
90+
| db_instance_endpoint | The connection endpoint |
91+
| db_instance_port | The database port |
92+
| db_subnet_group_id | The db subnet group name |
93+
| db_security_group_id | The security group ID |
94+
95+
## Security Considerations
96+
97+
- By default, the security group allows inbound access on port 5432 from all IP addresses (0.0.0.0/0). It's strongly recommended to restrict this using the `ingress_cidr_blocks` variable in production environments.
98+
- Database encryption is enabled by default using AWS KMS.
99+
- Final snapshots are created by default when destroying the database (skip_final_snapshot = false).
100+
- The module uses Kubernetes backend configuration. Ensure your Terraform environment is properly configured for this.
101+
102+
## License
103+
104+
This module is maintained by Ryvn Technologies.

‎main.tf‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
resource "random_pet" "this" {
2+
length = 2
3+
separator = "-"
4+
prefix = "postgres"
5+
}
6+
7+
8+
resource "aws_db_subnet_group" "this" {
9+
name = random_pet.this.id
10+
subnet_ids = var.subnet_ids
11+
12+
tags = var.tags
13+
}
14+
15+
resource "aws_security_group" "this" {
16+
name = "${random_pet.this.id}-rds-sg"
17+
description = "Security group for ${random_pet.this.id} RDS instance"
18+
vpc_id = var.vpc_id
19+
20+
ingress {
21+
from_port = 5432
22+
to_port = 5432
23+
protocol = "tcp"
24+
cidr_blocks = var.ingress_cidr_blocks
25+
}
26+
27+
egress {
28+
from_port = 0
29+
to_port = 0
30+
protocol = "-1"
31+
cidr_blocks = var.egress_cidr_blocks
32+
}
33+
34+
tags = var.tags
35+
}
36+
37+
data "aws_rds_orderable_db_instance" "postgres" {
38+
engine = "postgres"
39+
license_model = "postgresql-license"
40+
engine_version = var.engine_version
41+
42+
preferred_instance_classes = [var.instance_class]
43+
}
44+
45+
resource "aws_db_instance" "this" {
46+
identifier = random_pet.this.id
47+
48+
engine = "postgres"
49+
engine_version = var.engine_version
50+
instance_class = var.instance_class
51+
52+
allocated_storage = var.allocated_storage
53+
storage_type = var.storage_type
54+
storage_encrypted = var.storage_encrypted
55+
56+
db_name = var.database_name
57+
username = var.username
58+
password = var.password
59+
port = 5432
60+
61+
multi_az = var.multi_az
62+
db_subnet_group_name = aws_db_subnet_group.this.name
63+
vpc_security_group_ids = [aws_security_group.this.id]
64+
65+
backup_retention_period = var.backup_retention_period
66+
backup_window = var.backup_window
67+
maintenance_window = var.maintenance_window
68+
69+
skip_final_snapshot = var.skip_final_snapshot
70+
71+
tags = var.tags
72+
}

‎outputs.tf‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
output "db_instance_id" {
2+
description = "The RDS instance ID"
3+
value = aws_db_instance.this.id
4+
}
5+
6+
output "db_instance_address" {
7+
description = "The address of the RDS instance"
8+
value = aws_db_instance.this.address
9+
}
10+
11+
output "db_instance_endpoint" {
12+
description = "The connection endpoint"
13+
value = aws_db_instance.this.endpoint
14+
}
15+
16+
output "db_instance_port" {
17+
description = "The database port"
18+
value = aws_db_instance.this.port
19+
}
20+
21+
output "db_subnet_group_id" {
22+
description = "The db subnet group name"
23+
value = aws_db_subnet_group.this.id
24+
}
25+
26+
output "db_security_group_id" {
27+
description = "The security group ID"
28+
value = aws_security_group.this.id
29+
}

‎providers.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
provider "aws" {
2+
region = var.region
3+
# Use AWS credentials from environment variables or shared credentials file
4+
# AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables
5+
# or ~/.aws/credentials file will be used automatically
6+
}

0 commit comments

Comments
 (0)