Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow a Customer_Managed_Key as an option #24

Closed
wants to merge 6 commits into from
Closed

Allow a Customer_Managed_Key as an option #24

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
b59e5ce
Use a Customer_Managed_Key as an option
robg-test Feb 10, 2023
ddd072c
Added KMS to rds_serverless_cluster_secrets_manager
robg-test Feb 13, 2023
cba552b
Resolved formatting issues
robg-test Feb 13, 2023
9b2305b
Use count
robg-test Feb 13, 2023
38e5286
Use the array in the correct place
robg-test Feb 13, 2023
f55b691
terraform-docs: automated action
github-actions[bot] Feb 13, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions Terraform_modules/rds_serverless_cluster/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ These secrets are also set as outputs of the module and can be referenced throug
| Name | Type |
|------|------|
| [aws_db_subnet_group.private_db_subnet_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_subnet_group) | resource |
| [aws_kms_key.secrets](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
| [aws_rds_cluster.rds_cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster) | resource |
| [aws_rds_cluster_instance.rds_cluster_instance](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster_instance) | resource |
| [aws_secretsmanager_secret.aurora_db_secret](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret) | resource |
Expand All @@ -47,6 +48,7 @@ These secrets are also set as outputs of the module and can be referenced throug
| <a name="input_database_serverlessv2_scaling_max_capacity"></a> [database\_serverlessv2\_scaling\_max\_capacity](#input\_database\_serverlessv2\_scaling\_max\_capacity) | This sets the maximum scaling capacity of the severless database in Aurora capacity units (ACU). | `number` | `1` | no |
| <a name="input_database_serverlessv2_scaling_min_capacity"></a> [database\_serverlessv2\_scaling\_min\_capacity](#input\_database\_serverlessv2\_scaling\_min\_capacity) | This sets the minimum scaling capacity of the severless database in Auroracapacity units (ACU). | `number` | `0.5` | no |
| <a name="input_database_subnet_ids"></a> [database\_subnet\_ids](#input\_database\_subnet\_ids) | This is a list of subnet ids that the database cluster will be created across. The minimum number of subnets that can be supplied is 2. | `list(string)` | n/a | yes |
| <a name="input_kms_customer_managed_key"></a> [kms\_customer\_managed\_key](#input\_kms\_customer\_managed\_key) | This allows the usage of a KMS Key managed by you, by default this is managed by Amazon, enable this to control if you wish to use your own Cryptographic key | `bool` | `false` | no |
| <a name="input_owner"></a> [owner](#input\_owner) | This is used to specify the owner of the resources in this module. | `string` | n/a | yes |
| <a name="input_project_name"></a> [project\_name](#input\_project\_name) | This is used to label the resources of the module. | `string` | n/a | yes |

Expand Down
8 changes: 7 additions & 1 deletion Terraform_modules/rds_serverless_cluster/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,14 @@ terraform {
}
}

resource "aws_kms_key" "secrets" {
enable_key_rotation = true
count = var.kms_customer_managed_key == true ? 1 : 0
}

resource "aws_secretsmanager_secret" "aurora_db_secret" {
name = "${var.project_name}-aurora-db-secret-${random_id.secrets_id.hex}"
name = "${var.project_name}-aurora-db-secret-${random_id.secrets_id.hex}"
kms_key_id = var.kms_customer_managed_key == true ? aws_kms_key.secrets[0].arn : "aws/secretsmanager"
}

resource "aws_secretsmanager_secret_version" "aurora_db_secret_version" {
Expand Down
7 changes: 7 additions & 0 deletions Terraform_modules/rds_serverless_cluster/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,13 @@ variable "database_availability_zone" {
/*
OPTIONAL VARIABLES
*/

variable "kms_customer_managed_key" {
type = bool
default = false
description = "This allows the usage of a KMS Key managed by you, by default this is managed by Amazon, enable this to control if you wish to use your own Cryptographic key"
}

variable "database_serverlessv2_scaling_max_capacity" {
type = number
default = 1.0
Expand Down