@studion/infra-code-blocks/dist/components/database.js

Studion common infra components

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.Database = void 0;
const aws = require("@pulumi/aws");
const pulumi = require("@pulumi/pulumi");
const password_1 = require("./password");
const constants_1 = require("../constants");
const defaults = {
    multiAz: false,
    applyImmediately: false,
    skipFinalSnapshot: false,
    allocatedStorage: 20,
    maxAllocatedStorage: 100,
    instanceClass: 'db.t4g.micro',
    enableMonitoring: false,
    allowMajorVersionUpgrade: false,
    engineVersion: '17.2',
};
class Database extends pulumi.ComponentResource {
    constructor(name, args, opts = {}) {
        super('studion:Database', name, {}, opts);
        this.name = name;
        const argsWithDefaults = Object.assign({}, defaults, args);
        const { vpcId, isolatedSubnetIds, vpcCidrBlock, enableMonitoring, snapshotIdentifier, } = argsWithDefaults;
        this.dbSubnetGroup = this.createSubnetGroup({ isolatedSubnetIds });
        this.dbSecurityGroup = this.createSecurityGroup({ vpcId, vpcCidrBlock });
        this.kms = this.createEncryptionKey();
        this.password = new password_1.Password(`${this.name}-database-password`, { value: args.password }, { parent: this });
        if (enableMonitoring) {
            this.monitoringRole = this.createMonitoringRole();
        }
        if (snapshotIdentifier) {
            this.encryptedSnapshotCopy =
                this.createEncryptedSnapshotCopy(snapshotIdentifier);
        }
        this.instance = this.createDatabaseInstance(args);
        this.registerOutputs();
    }
    createSubnetGroup({ isolatedSubnetIds, }) {
        const dbSubnetGroup = new aws.rds.SubnetGroup(`${this.name}-subnet-group`, {
            subnetIds: isolatedSubnetIds,
            tags: constants_1.commonTags,
        }, { parent: this });
        return dbSubnetGroup;
    }
    createSecurityGroup({ vpcId, vpcCidrBlock, }) {
        const dbSecurityGroup = new aws.ec2.SecurityGroup(`${this.name}-security-group`, {
            vpcId,
            ingress: [
                {
                    protocol: 'tcp',
                    fromPort: 5432,
                    toPort: 5432,
                    cidrBlocks: [vpcCidrBlock],
                },
            ],
            tags: constants_1.commonTags,
        }, { parent: this });
        return dbSecurityGroup;
    }
    createEncryptionKey() {
        const kms = new aws.kms.Key(`${this.name}-rds-key`, {
            description: `${this.name} RDS encryption key`,
            customerMasterKeySpec: 'SYMMETRIC_DEFAULT',
            isEnabled: true,
            keyUsage: 'ENCRYPT_DECRYPT',
            multiRegion: false,
            enableKeyRotation: true,
            tags: constants_1.commonTags,
        }, { parent: this });
        return kms;
    }
    createMonitoringRole() {
        const monitoringRole = new aws.iam.Role(`${this.name}-rds-monitoring`, {
            assumeRolePolicy: {
                Version: '2012-10-17',
                Statement: [
                    {
                        Action: 'sts:AssumeRole',
                        Effect: 'Allow',
                        Principal: {
                            Service: 'monitoring.rds.amazonaws.com',
                        },
                    },
                ],
            },
        });
        new aws.iam.RolePolicyAttachment(`${this.name}-rds-monitoring-role-attachment`, {
            role: monitoringRole.name,
            policyArn: 'arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole',
        });
        return monitoringRole;
    }
    createEncryptedSnapshotCopy(snapshotIdentifier) {
        const encryptedSnapshotCopy = new aws.rds.SnapshotCopy(`${this.name}-encrypted-snapshot-copy`, {
            sourceDbSnapshotIdentifier: snapshotIdentifier,
            targetDbSnapshotIdentifier: `${snapshotIdentifier}-encrypted-copy`,
            kmsKeyId: this.kms.arn,
        }, { parent: this });
        return encryptedSnapshotCopy;
    }
    createDatabaseInstance(args) {
        var _a;
        const argsWithDefaults = Object.assign({}, defaults, args);
        const stack = pulumi.getStack();
        const monitoringOptions = argsWithDefaults.enableMonitoring && this.monitoringRole
            ? {
                monitoringInterval: 60,
                monitoringRoleArn: this.monitoringRole.arn,
                performanceInsightsEnabled: true,
                performanceInsightsRetentionPeriod: 7,
            }
            : {};
        const instance = new aws.rds.Instance(`${this.name}-rds`, Object.assign(Object.assign({ identifierPrefix: `${this.name}-`, engine: 'postgres', engineVersion: argsWithDefaults.engineVersion, allocatedStorage: argsWithDefaults.allocatedStorage, maxAllocatedStorage: argsWithDefaults.maxAllocatedStorage, instanceClass: argsWithDefaults.instanceClass, dbName: argsWithDefaults.dbName, username: argsWithDefaults.username, password: this.password.value, dbSubnetGroupName: this.dbSubnetGroup.name, vpcSecurityGroupIds: [this.dbSecurityGroup.id], storageEncrypted: true, kmsKeyId: this.kms.arn, multiAz: argsWithDefaults.multiAz, publiclyAccessible: false, skipFinalSnapshot: argsWithDefaults.skipFinalSnapshot, applyImmediately: argsWithDefaults.applyImmediately, autoMinorVersionUpgrade: true, maintenanceWindow: 'Mon:07:00-Mon:07:30', finalSnapshotIdentifier: `${this.name}-final-snapshot-${stack}`, backupWindow: '06:00-06:30', backupRetentionPeriod: 14, caCertIdentifier: 'rds-ca-rsa2048-g1', parameterGroupName: argsWithDefaults.parameterGroupName, allowMajorVersionUpgrade: argsWithDefaults.allowMajorVersionUpgrade, snapshotIdentifier: (_a = this.encryptedSnapshotCopy) === null || _a === void 0 ? void 0 : _a.targetDbSnapshotIdentifier }, monitoringOptions), { tags: Object.assign(Object.assign({}, constants_1.commonTags), argsWithDefaults.tags) }), { parent: this, dependsOn: [this.password] });
        return instance;
    }
}
exports.Database = Database;