Merge pull request #62 from ministryofjustice/read-replica

Adding replicate_source_db variable to support read_replica

README.md

@@ -32,17 +32,18 @@ See [this example](example/rds.tf)
 | db_engine | Database engine used | string | `postgres` | no |
 | db_engine_version | The engine version to use | string | `10.4` | no |
 | db_instance_class | The instance type of the RDS instance | string | `db.t2.small` | no |
-| db_backup_retention_period | The days to retain backups. Must be 1 or greater to be a source for a Read Replica | string | `7` | yes
+| db_backup_retention_period | The days to retain backups. Must be 1 or greater to be a source for a Read Replica. Must be 0 for read replica db | string | `7` | yes
 | db_iops | The amount of provisioned IOPS. Setting this implies a storage_type of io1 | string | `0` | ** Required if 'db_storage_type' is set to io1 ** |
 | db_name | The name of the database to be created on the instance (if empty, it will be the generated random identifier) | string |  | no |
 | rds_name | Name of the RDS  | string | if not present a name will be generated | no  |
-| force_ssl | Enforce SSL connections | boolean | `true` | no |
 | performance_insights_enabled | Enable performance insights in RDS | boolean | `false` | no |
 | snapshot_identifier | Specifies whether or not to create this database from a snapshot. This correlates to the snapshot ID you'd find in the RDS console. | string | | no |
 | providers | provider (and region) creating the resources |  arrays of string | default provider | no |
 | rds_family | rds configuration version | string | `postgres10` | no  |
-| apply_method | Indicates when to apply parameter updates | string | `immediate` | no  |
 | ca_cert_identifier | Specifies the identifier of the CA certificate for the DB instance | string | `rds-ca-2019` | no  |
+| db_parameter | Parameter block with name, value and apply_method | list | [ { name = "rds.force_ssl", value = "1", apply_method = "immediate" }]  | yes  |
+| replicate_source_db | Specifies that this resource is a Replicate database, and to use this value as the source database. This correlates to the identifier of another Amazon RDS Database to replicate. | string | <source DB db_identifier> | no  
+| skip_final_snapshot | If false(default) all DB are taken a final snapshot unless the db instance is created from snapshot itself or a read replica." | string | `false` | no  
 
 
 ### Tags

example/rds.tf

@@ -21,7 +21,7 @@ variable "cluster_state_bucket" {
 # Make sure you restart your pods which use this RDS secret to avoid any down time.
 
 module "example_team_rds" {
-  source               = "github.com/ministryofjustice/cloud-platform-terraform-rds-instance?ref=5.4"
+  source               = "github.com/ministryofjustice/cloud-platform-terraform-rds-instance?ref=5.5"
   cluster_name         = var.cluster_name
   cluster_state_bucket = var.cluster_state_bucket
   team_name            = "example-repo"
@@ -55,6 +55,17 @@ module "example_team_rds" {
   #   }
   # ]
 
+  # Set below values if you want to create read replica db instance
+
+  # Set the database_name of the source db
+  # db_name = module.example_team_rds.database_name
+
+  # If specifies, this resource is a Replicate database. Set the db_identifier of the source db 
+  # replicate_source_db         = module.example_team_rds.db_identifier
+
+  # Set to true for replica database. No backups or snapshots are created for read replica
+  # skip_final_snapshot         = "true"
+  # db_backup_retention_period  = 0
 
   # use "allow_major_version_upgrade" when upgrading the major version of an engine
   allow_major_version_upgrade = "true"

main.tf

@@ -32,6 +32,7 @@ resource "random_password" "password" {
 }
 
 resource "aws_kms_key" "kms" {
+  count = var.replicate_source_db != "" ? 0 : 1
   description = local.identifier
 
   tags = {
@@ -45,11 +46,13 @@ resource "aws_kms_key" "kms" {
 }
 
 resource "aws_kms_alias" "alias" {
+  count = var.replicate_source_db != "" ? 0 : 1
   name          = "alias/${local.identifier}"
-  target_key_id = aws_kms_key.kms.key_id
+  target_key_id = aws_kms_key.kms[0].key_id 
 }
 
 resource "aws_db_subnet_group" "db_subnet" {
+  count = var.replicate_source_db != "" ? 0 : 1
   name       = local.identifier
   subnet_ids = data.terraform_remote_state.cluster.outputs.internal_subnets_ids
 
@@ -89,29 +92,31 @@ resource "aws_security_group" "rds-sg" {
 
 resource "aws_db_instance" "rds" {
   identifier                   = var.rds_name != "" ? var.rds_name : local.identifier
-  final_snapshot_identifier    = "${local.identifier}-finalsnapshot"
+  final_snapshot_identifier    = var.replicate_source_db != "" ? null : "${local.identifier}-finalsnapshot"
   allocated_storage            = var.db_allocated_storage
   apply_immediately            = true
   engine                       = var.db_engine
   engine_version               = var.db_engine_version
   instance_class               = var.db_instance_class
   name                         = local.db_name
-  username                     = "cp${random_string.username.result}"
-  password                     = random_password.password.result
+  username                     = var.replicate_source_db != "" ? null : "cp${random_string.username.result}"
+  password                     = var.replicate_source_db != "" ? null : random_password.password.result
   backup_retention_period      = var.db_backup_retention_period
   storage_type                 = var.db_iops == 0 ? "gp2" : "io1"
   iops                         = var.db_iops
   storage_encrypted            = true
-  db_subnet_group_name         = aws_db_subnet_group.db_subnet.name
+  db_subnet_group_name         = var.replicate_source_db != "" ? null : aws_db_subnet_group.db_subnet[0].name
   vpc_security_group_ids       = [aws_security_group.rds-sg.id]
-  kms_key_id                   = aws_kms_key.kms.arn
+  kms_key_id                   = var.replicate_source_db != "" ? null : aws_kms_key.kms[0].arn
   multi_az                     = true
   copy_tags_to_snapshot        = true
   snapshot_identifier          = var.snapshot_identifier
+  replicate_source_db          = var.replicate_source_db
   allow_major_version_upgrade  = var.allow_major_version_upgrade
   parameter_group_name         = aws_db_parameter_group.custom_parameters.name
-  ca_cert_identifier           = var.ca_cert_identifier
+  ca_cert_identifier           = var.replicate_source_db != "" ? null : var.ca_cert_identifier
   performance_insights_enabled = var.performance_insights_enabled
+  skip_final_snapshot          = var.skip_final_snapshot
 
   tags = {
     business-unit          = var.business-unit
@@ -135,16 +140,18 @@ resource "aws_db_parameter_group" "custom_parameters" {
       value        = parameter.value.value
     }
   }
-  
+
 }
 
 resource "aws_iam_user" "user" {
+  count = var.replicate_source_db != "" ? 0 : 1
   name = "rds-snapshots-user-${random_id.id.hex}"
   path = "/system/rds-snapshots-user/"
 }
 
 resource "aws_iam_access_key" "user" {
-  user = aws_iam_user.user.name
+  count = var.replicate_source_db != "" ? 0 : 1
+  user = aws_iam_user.user[0].name
 }
 
 data "aws_iam_policy_document" "policy" {
@@ -168,7 +175,8 @@ data "aws_iam_policy_document" "policy" {
 }
 
 resource "aws_iam_user_policy" "policy" {
+  count = var.replicate_source_db != "" ? 0 : 1
   name   = "rds-snapshots-read-write"
   policy = data.aws_iam_policy_document.policy.json
-  user   = aws_iam_user.user.name
+  user   = aws_iam_user.user[0].name
 }

output.tf

@@ -30,10 +30,16 @@ output "database_password" {
 
 output "access_key_id" {
   description = "Access key id for RDS IAM user"
-  value       = aws_iam_access_key.user.id
+  value       = join("", aws_iam_access_key.user.*.id)
+
 }
 
 output "secret_access_key" {
   description = "Secret key for RDS IAM user"
-  value       = aws_iam_access_key.user.secret
-}
+  value       = join("", aws_iam_access_key.user.*.secret)
+}
+
+output "db_identifier" {
+  description = "The RDS DB Indentifer"
+  value       = aws_db_instance.rds.identifier
+}

variables.tf

@@ -25,9 +25,9 @@ variable "infrastructure-support" {
   description = "The team responsible for managing the infrastructure. Should be of the form <team-name> (<team-email>)"
 }
 
-variable "rds_name"{
+variable "rds_name" {
   description = "Optional name of the RDS cluster. Changing the name will re-create the RDS"
-  default = ""
+  default     = ""
 }
 
 variable "snapshot_identifier" {
@@ -47,7 +47,7 @@ variable "db_engine" {
 
 variable "db_engine_version" {
   description = "The engine version to use e.g. 10"
-  default     = "10"
+  default     = "10.11"
 }
 
 variable "db_instance_class" {
@@ -106,4 +106,16 @@ variable "db_parameter" {
     }
   ]
   description = "A list of DB parameters to apply. Note that parameters may differ from a DB family to another"
-}
+}
+
+variable "replicate_source_db" {
+  description = "Specifies that this resource is a Replicate database, and to use this value as the source database. This correlates to the identifier of another Amazon RDS Database to replicate."
+  type        = string
+  default     = ""
+}
+
+variable "skip_final_snapshot" {
+  type        = string
+  description = "if false(default), a DB snapshot is created before the DB instance is deleted, using the value from final_snapshot_identifier. If true no DBSnapshot is created"
+  default     = "false"
+}