Pull RDS module into this one since it is not reused elsewhere

alb_target_group.tf

@@ -5,7 +5,6 @@ resource "aws_lb_target_group" "this" {
   protocol             = "HTTP"
   target_type          = "ip"
   vpc_id               = var.vpc_id
-  #  tags                 = var.tags # TODO
 
   lifecycle {
     create_before_destroy = true

db.tf

@@ -1,11 +1,11 @@
 module "database" {
-  count                           = var.use_database_cluster ? 1 : 0
-  source                          = "git::https://github.com/synapsestudios/terraform-aws-rds-aurora-cluster.git?ref=v1.0.0"
-  availability_zones              = var.azs
-  database_subnets                = var.subnets
-  db_cluster_parameter_group_name = "default.aurora-postgresql14"
-  instance_class                  = "db.t4g.medium"
-  name                            = "backend"
-  vpc_id                          = var.vpc_id
-  database_name                   = "backend"
+  count              = var.use_database_cluster ? 1 : 0
+  source             = "./rds_cluster"
+  availability_zones = var.azs
+  database_subnets   = var.subnets
+  instance_class     = var.db_instance_class
+  instance_count     = var.db_instance_count
+  name               = var.service_name
+  vpc_id             = var.vpc_id
+  database_name      = var.db_name
 }

ecs_task_definitions.tf

@@ -8,20 +8,18 @@ resource "aws_ecs_task_definition" "service" {
   memory                   = 2048
   cpu                      = 1024
   requires_compatibilities = ["FARGATE"]
-  #  tags                     = var.tags # TODO
 }
 
 resource "aws_cloudwatch_log_group" "service" {
   name_prefix = var.service_name
-  #  tags = var.tags # TODO
 }
 
 module "service_container_definition" {
   source  = "cloudposse/ecs-container-definition/aws"
   version = "0.58.1"
 
   container_name   = var.service_name
-  container_image  = "${var.ecr_host}/${var.service_name}:latest"
+  container_image  = var.container_image
   container_memory = 2048
   essential        = true
   environment      = var.environment_variables

ecs_task_execution_role.tf

@@ -18,6 +18,28 @@ resource "aws_iam_role" "ecs_task_execution_role" {
 EOF
 }
 
+resource "aws_iam_policy" "kms_decryption" {
+  name_prefix = "${var.service_name}-kms-decrypt"
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = [
+          "kms:Decrypt",
+        ]
+        Effect   = "Allow"
+        Resource = aws_kms_key.kms.arn
+      },
+    ]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "kms_decryption" {
+  role       = aws_iam_role.ecs_task_execution_role.name
+  policy_arn = aws_iam_policy.kms_decryption.arn
+}
+
 resource "aws_iam_role_policy_attachment" "ecs_task_execution_role" {
   role       = aws_iam_role.ecs_task_execution_role.name
   policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"

ecs_task_security_group.tf

@@ -2,7 +2,6 @@ resource "aws_security_group" "ecs_task" {
   description = "ECS Tasks traffic rules"
   vpc_id      = var.vpc_id
   name_prefix = "${var.service_name}-ecs-task-default"
-  #  tags        = merge(var.tags, { Name = "ECSTasks" }) # TODO
 
   egress {
     from_port   = 0

kms.tf

@@ -0,0 +1,4 @@
+resource "aws_kms_key" "kms" {
+  description         = "${var.service_name} Aurora KMS key"
+  enable_key_rotation = true
+}

outputs.tf

@@ -0,0 +1,4 @@
+output "kms_key_id" {
+  value       = aws_kms_key.kms.arn
+  description = "ARN of the KMS key created for this service's database and secrets"
+}

rds_cluster/main.tf

@@ -0,0 +1,116 @@
+resource "random_id" "final_snapshot_suffix" {
+  byte_length = 8
+}
+
+resource "aws_rds_cluster" "this" {
+  cluster_identifier_prefix       = var.name
+  engine                          = "aurora-postgresql"
+  engine_version                  = "14.6"
+  database_name                   = var.database_name
+  skip_final_snapshot             = false
+  final_snapshot_identifier       = "${var.name}-final-${random_id.final_snapshot_suffix.hex}"
+  master_username                 = "root"
+  master_password                 = aws_secretsmanager_secret_version.root_password.secret_string
+  db_subnet_group_name            = aws_db_subnet_group.this.name
+  storage_encrypted               = true
+  kms_key_id                      = var.kms_key_id
+  availability_zones              = var.availability_zones
+  preferred_backup_window         = "07:00-09:00"
+  backup_retention_period         = 30
+  vpc_security_group_ids          = concat([aws_security_group.this.id], var.additional_security_groups)
+  tags                            = var.tags
+  db_cluster_parameter_group_name = "default.aurora-postgresql14"
+  deletion_protection             = true
+}
+
+resource "random_password" "password" {
+  length           = 32
+  special          = true
+  min_special      = 1
+  override_special = "-._~" # URL-safe characters prevent parsing errors when using this password in a connection string
+}
+
+resource "aws_secretsmanager_secret" "root_password" {
+  name_prefix = "${var.name}-aurora-root-password"
+  kms_key_id  = var.kms_key_id
+  description = "Root password for the ${var.name} aurora cluster database"
+  tags        = var.tags
+}
+
+resource "aws_secretsmanager_secret_version" "root_password" {
+  secret_id     = aws_secretsmanager_secret.root_password.id
+  secret_string = random_password.password.result
+}
+
+resource "aws_secretsmanager_secret" "connection_string" {
+  name_prefix = "${var.name}-aurora-connection-string"
+  kms_key_id  = var.kms_key_id
+  description = "Connection String for the ${var.name} aurora cluster database"
+  tags        = var.tags
+}
+
+resource "aws_secretsmanager_secret_version" "connection_string" {
+  secret_id     = aws_secretsmanager_secret.connection_string.id
+  secret_string = "postgresql://${aws_rds_cluster.this.master_username}:${aws_secretsmanager_secret_version.root_password.secret_string}@${aws_rds_cluster.this.endpoint}:${aws_rds_cluster.this.port}/${aws_rds_cluster.this.database_name}"
+}
+
+resource "aws_rds_cluster_instance" "this" {
+  count                           = var.instance_count
+  engine                          = "aurora-postgresql"
+  engine_version                  = "14.6"
+  identifier_prefix               = "${var.name}-${count.index + 1}"
+  performance_insights_enabled    = true
+  performance_insights_kms_key_id = var.kms_key_id
+  cluster_identifier              = aws_rds_cluster.this.id
+  instance_class                  = var.instance_class
+  db_subnet_group_name            = aws_db_subnet_group.this.name
+  tags                            = var.tags
+}
+
+resource "aws_db_subnet_group" "this" {
+  name_prefix = var.name
+  description = "${var.name} RDS Subnet Group"
+  subnet_ids  = var.database_subnets
+  tags        = var.tags
+}
+
+resource "aws_security_group" "this" {
+  name_prefix = "${var.name}-database-access"
+  description = "Database traffic rules"
+  vpc_id      = var.vpc_id
+  tags        = merge(var.tags, { name = "database" })
+  ingress {
+    from_port   = 5432
+    to_port     = 5432
+    protocol    = "tcp"
+    cidr_blocks = [data.aws_vpc.database_vpc.cidr_block]
+    description = "Database ingress"
+  }
+  egress {
+    from_port   = 5432
+    to_port     = 5432
+    protocol    = "tcp"
+    cidr_blocks = [data.aws_vpc.database_vpc.cidr_block]
+    description = "Database egress"
+  }
+}
+
+data "aws_vpc" "database_vpc" {
+  id = var.vpc_id
+}
+
+output "db_cluster_id" {
+  value = aws_rds_cluster.this.cluster_identifier
+}
+
+output "security_group_id" {
+  value = aws_security_group.this.id
+}
+
+output "root_password_secret_id" {
+  value = aws_secretsmanager_secret.root_password.id
+}
+
+output "connection_string_arn" {
+  value = aws_secretsmanager_secret.connection_string.arn
+}

rds_cluster/variables.tf

@@ -0,0 +1,51 @@
+variable "name" {
+  type        = string
+  description = "Determines naming convention of assets. Generally follows DNS naming convention."
+}
+
+variable "database_name" {
+  type        = string
+  description = "Name of the default database to create"
+}
+
+variable "vpc_id" {
+  type        = string
+  description = "The ID of the vpc the database belongs to"
+}
+
+variable "availability_zones" {
+  type        = list(string)
+  description = "Availability zones for the database"
+}
+
+variable "database_subnets" {
+  type        = list(string)
+  description = "Subnets for the database"
+}
+
+variable "additional_security_groups" {
+  type        = list(string)
+  default     = []
+  description = "Any additional security groups the cluster should be added to"
+}
+
+variable "tags" {
+  type        = map(string)
+  description = "A mapping of tags to assign to the AWS resources."
+  default     = {}
+}
+
+variable "instance_count" {
+  type        = number
+  description = "How many RDS instances to create"
+}
+
+variable "instance_class" {
+  type        = string
+  description = "Instance class"
+}
+
+variable "kms_key_id" {
+  type        = string
+  description = "ARN of the KMS key to use for encrypting the database, secrets, and performance insights"
+}

variables.tf

@@ -13,9 +13,9 @@ variable "subnets" {
   description = "List of subnet names the service will reside on."
 }
 
-variable "ecr_host" {
+variable "container_image" {
   type        = string
-  description = "Hostname of the ECR repository with no trailing slash"
+  description = "Image tag of the Docker container to use for this service"
 }
 
 variable "azs" {
@@ -97,3 +97,21 @@ variable "ecs_desired_count" {
   default     = 1
   description = "How many tasks to launch in ECS service"
 }
+
+variable "db_name" {
+  type        = string
+  default     = "main"
+  description = "Name of the postgres database to create, if creating an RDS cluster"
+}
+
+variable "db_instance_class" {
+  type        = string
+  default     = "db.t4g.medium"
+  description = "Size of instances within the RDS cluster"
+}
+
+variable "db_instance_count" {
+  type        = number
+  default     = 1
+  description = "How many RDS instances to create"
+}