Skip to content

Commit 7510672

Browse files
posquit0posquit0
authored
Add terraform modules for ElastiCache Redis RBAC (#4)
1 parent 94664c4 commit 7510672

File tree

15 files changed

+568
-0
lines changed

15 files changed

+568
-0
lines changed

‎examples/elasticache-redis-with-users/main.tf‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
provider "aws" {
2+
region = "us-east-1"
3+
}
4+
5+
6+
###################################################
7+
# ElastiCache Redis Cluster
8+
###################################################
9+
10+
module "cluster" {
11+
source = "../../modules/elasticache-redis-cluster"
12+
# source = "tedilabs/db/aws//modules/elasticache-redis-cluster"
13+
# version = "~> 0.2.0"
14+
15+
name = "example-redis-single"
16+
description = "Managed by Terraform."
17+
18+
redis_version = "6.2"
19+
node_instance_type = "cache.t4g.micro"
20+
node_size = 1
21+
22+
user_groups = [module.user_group.id]
23+
24+
encryption_in_transit = {
25+
enabled = true
26+
}
27+
28+
tags = {
29+
"project" = "terraform-aws-db-examples"
30+
}
31+
}
32+
33+
34+
###################################################
35+
# Redis User Groups on ElastiCache
36+
###################################################
37+
38+
module "user_group" {
39+
source = "../../modules/elasticache-redis-user-group"
40+
# source = "tedilabs/db/aws//modules/elasticache-redis-user-group"
41+
# version = "~> 0.2.0"
42+
43+
name = "example"
44+
default_user = module.user["example-default"].id
45+
users = [module.user["example-admin"].id]
46+
47+
tags = {
48+
"project" = "terraform-aws-db-examples"
49+
}
50+
}
51+
52+
53+
###################################################
54+
# Redis Users on ElastiCache
55+
###################################################
56+
57+
locals {
58+
users = [
59+
{
60+
id = "example-default"
61+
name = "default"
62+
63+
access_string = "on ~* -@all +@read"
64+
password_required = false
65+
},
66+
{
67+
id = "example-admin"
68+
name = "admin"
69+
70+
access_string = "on ~* +@all"
71+
password_required = true
72+
passwords = ["MyPassWord!Q@W#E", "MyPassW0rd!@QW#$ER"]
73+
},
74+
]
75+
}
76+
77+
module "user" {
78+
source = "../../modules/elasticache-redis-user"
79+
# source = "tedilabs/db/aws//modules/elasticache-redis-user"
80+
# version = "~> 0.2.0"
81+
82+
for_each = {
83+
for user in try(local.users, []) :
84+
user.id => user
85+
}
86+
87+
id = each.key
88+
name = each.value.name
89+
90+
access_string = try(each.value.access_string, null)
91+
password_required = try(each.value.password_required, true)
92+
passwords = try(each.value.passwords, [])
93+
94+
tags = {
95+
"project" = "terraform-aws-db-examples"
96+
}
97+
}

‎examples/elasticache-redis-with-users/outputs.tf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
output "cluster" {
2+
value = module.cluster
3+
}
4+
5+
output "user_group" {
6+
value = module.user_group
7+
}
8+
9+
output "users" {
10+
value = module.user
11+
}

‎examples/elasticache-redis-with-users/versions.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
terraform {
2+
required_version = "~> 1.3"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = "~> 4.0"
8+
}
9+
}
10+
}

‎modules/elasticache-redis-user-group/README.md‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
# elasticache-redis-user-group
2+
3+
This module creates following resources.
4+
5+
- `aws_elasticache_user_group`
6+
- `aws_elasticache_user_group_association` (optional)
7+
8+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
9+
## Requirements
10+
11+
| Name | Version |
12+
|------|---------|
13+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3 |
14+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.30 |
15+
16+
## Providers
17+
18+
| Name | Version |
19+
|------|---------|
20+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.34.0 |
21+
22+
## Modules
23+
24+
| Name | Source | Version |
25+
|------|--------|---------|
26+
| <a name="module_resource_group"></a> [resource\_group](#module\_resource\_group) | tedilabs/misc/aws//modules/resource-group | ~> 0.10.0 |
27+
28+
## Resources
29+
30+
| Name | Type |
31+
|------|------|
32+
| [aws_elasticache_user_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/elasticache_user_group) | resource |
33+
| [aws_elasticache_user_group_association.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/elasticache_user_group_association) | resource |
34+
35+
## Inputs
36+
37+
| Name | Description | Type | Default | Required |
38+
|------|-------------|------|---------|:--------:|
39+
| <a name="input_default_user"></a> [default\_user](#input\_default\_user) | (Optional) The ID of default user. The user group needs to contain a user with the user name default. | `string` | n/a | yes |
40+
| <a name="input_name"></a> [name](#input\_name) | (Required) The name of the ElastiCache user group. It can have up to 40 characters, and must begin with a letter. It should not end with a hyphen or contain two consecutive hyphens. Valid characters: A-Z, a-z, 0-9, and - (hyphen). | `string` | n/a | yes |
41+
| <a name="input_module_tags_enabled"></a> [module\_tags\_enabled](#input\_module\_tags\_enabled) | (Optional) Whether to create AWS Resource Tags for the module informations. | `bool` | `true` | no |
42+
| <a name="input_resource_group_description"></a> [resource\_group\_description](#input\_resource\_group\_description) | (Optional) The description of Resource Group. | `string` | `"Managed by Terraform."` | no |
43+
| <a name="input_resource_group_enabled"></a> [resource\_group\_enabled](#input\_resource\_group\_enabled) | (Optional) Whether to create Resource Group to find and group AWS resources which are created by this module. | `bool` | `true` | no |
44+
| <a name="input_resource_group_name"></a> [resource\_group\_name](#input\_resource\_group\_name) | (Optional) The name of Resource Group. A Resource Group name can have a maximum of 127 characters, including letters, numbers, hyphens, dots, and underscores. The name cannot start with `AWS` or `aws`. | `string` | `""` | no |
45+
| <a name="input_tags"></a> [tags](#input\_tags) | (Optional) A map of tags to add to all resources. | `map(string)` | `{}` | no |
46+
| <a name="input_users"></a> [users](#input\_users) | (Optional) The list of user IDs that belong to the user group. | `set(string)` | `[]` | no |
47+
48+
## Outputs
49+
50+
| Name | Description |
51+
|------|-------------|
52+
| <a name="output_arn"></a> [arn](#output\_arn) | The ARN of the ElastiCache user group. |
53+
| <a name="output_default_user"></a> [default\_user](#output\_default\_user) | The ID of default user. |
54+
| <a name="output_id"></a> [id](#output\_id) | The ID of the ElastiCache user group. |
55+
| <a name="output_name"></a> [name](#output\_name) | The name of the ElastiCache user group. |
56+
| <a name="output_users"></a> [users](#output\_users) | The list of user IDs that belong to the user group. |
57+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎modules/elasticache-redis-user-group/main.tf‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
locals {
2+
metadata = {
3+
package = "terraform-aws-db"
4+
version = trimspace(file("${path.module}/../../VERSION"))
5+
module = basename(path.module)
6+
name = var.name
7+
}
8+
module_tags = var.module_tags_enabled ? {
9+
"module.terraform.io/package" = local.metadata.package
10+
"module.terraform.io/version" = local.metadata.version
11+
"module.terraform.io/name" = local.metadata.module
12+
"module.terraform.io/full-name" = "${local.metadata.package}/${local.metadata.module}"
13+
"module.terraform.io/instance" = local.metadata.name
14+
} : {}
15+
}
16+
17+
18+
###################################################
19+
# User Group of ElastiCache for Redis
20+
###################################################
21+
22+
resource "aws_elasticache_user_group" "this" {
23+
engine = "REDIS"
24+
user_group_id = var.name
25+
user_ids = [var.default_user]
26+
27+
lifecycle {
28+
ignore_changes = [user_ids]
29+
}
30+
}
31+
32+
resource "aws_elasticache_user_group_association" "this" {
33+
for_each = var.users
34+
35+
user_group_id = aws_elasticache_user_group.this.user_group_id
36+
user_id = each.value
37+
}

‎modules/elasticache-redis-user-group/outputs.tf‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
output "id" {
2+
description = "The ID of the ElastiCache user group."
3+
value = aws_elasticache_user_group.this.id
4+
}
5+
6+
output "arn" {
7+
description = "The ARN of the ElastiCache user group."
8+
value = aws_elasticache_user_group.this.arn
9+
}
10+
11+
output "name" {
12+
description = "The name of the ElastiCache user group."
13+
value = aws_elasticache_user_group.this.user_group_id
14+
}
15+
16+
output "default_user" {
17+
description = "The ID of default user."
18+
value = var.default_user
19+
}
20+
21+
output "users" {
22+
description = "The list of user IDs that belong to the user group."
23+
value = values(aws_elasticache_user_group_association.this).*.user_id
24+
}

‎modules/elasticache-redis-user-group/resource-group.tf‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
locals {
2+
resource_group_name = (var.resource_group_name != ""
3+
? var.resource_group_name
4+
: join(".", [
5+
local.metadata.package,
6+
local.metadata.module,
7+
replace(local.metadata.name, "/[^a-zA-Z0-9_\\.-]/", "-"),
8+
])
9+
)
10+
}
11+
12+
13+
module "resource_group" {
14+
source = "tedilabs/misc/aws//modules/resource-group"
15+
version = "~> 0.10.0"
16+
17+
count = (var.resource_group_enabled && var.module_tags_enabled) ? 1 : 0
18+
19+
name = local.resource_group_name
20+
description = var.resource_group_description
21+
22+
query = {
23+
resource_tags = local.module_tags
24+
}
25+
26+
module_tags_enabled = false
27+
tags = merge(
28+
local.module_tags,
29+
var.tags,
30+
)
31+
}

‎modules/elasticache-redis-user-group/variables.tf‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
variable "name" {
2+
description = "(Required) The name of the ElastiCache user group. It can have up to 40 characters, and must begin with a letter. It should not end with a hyphen or contain two consecutive hyphens. Valid characters: A-Z, a-z, 0-9, and - (hyphen)."
3+
type = string
4+
nullable = false
5+
}
6+
7+
variable "default_user" {
8+
description = "(Optional) The ID of default user. The user group needs to contain a user with the user name default."
9+
type = string
10+
nullable = false
11+
}
12+
13+
variable "users" {
14+
description = "(Optional) The list of user IDs that belong to the user group."
15+
type = set(string)
16+
default = []
17+
nullable = false
18+
}
19+
20+
variable "tags" {
21+
description = "(Optional) A map of tags to add to all resources."
22+
type = map(string)
23+
default = {}
24+
nullable = false
25+
}
26+
27+
variable "module_tags_enabled" {
28+
description = "(Optional) Whether to create AWS Resource Tags for the module informations."
29+
type = bool
30+
default = true
31+
nullable = false
32+
}
33+
34+
35+
###################################################
36+
# Resource Group
37+
###################################################
38+
39+
variable "resource_group_enabled" {
40+
description = "(Optional) Whether to create Resource Group to find and group AWS resources which are created by this module."
41+
type = bool
42+
default = true
43+
nullable = false
44+
}
45+
46+
variable "resource_group_name" {
47+
description = "(Optional) The name of Resource Group. A Resource Group name can have a maximum of 127 characters, including letters, numbers, hyphens, dots, and underscores. The name cannot start with `AWS` or `aws`."
48+
type = string
49+
default = ""
50+
nullable = false
51+
}
52+
53+
variable "resource_group_description" {
54+
description = "(Optional) The description of Resource Group."
55+
type = string
56+
default = "Managed by Terraform."
57+
nullable = false
58+
}

‎modules/elasticache-redis-user-group/versions.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
terraform {
2+
required_version = ">= 1.3"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">= 4.30"
8+
}
9+
}
10+
}

0 commit comments

Comments
 (0)