Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

allow for import of rds instances and proxies #279

Merged
merged 2 commits into from
Feb 22, 2023
Merged

allow for import of rds instances and proxies #279

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4ef3744
allow for import of rds instances and proxies
jhsinger-klotho Feb 22, 2023
818fd97
move interface to rds class
jhsinger-klotho Feb 22, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
170 changes: 1 addition & 169 deletions pkg/infra/pulumi_aws/deploylib.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ export interface TopologyEdgeData {
target: string
}

export const kloConfig = new pulumi.Config('klo')
export const kloConfig: pulumi.Config = new pulumi.Config('klo')
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm surprised this needs the type hint

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

doesnt need it, i was trying to get some other things working with config and must have just left it


export class CloudCCLib {
secrets = new Map<string, aws.secretsmanager.Secret>()
Expand Down Expand Up @@ -1003,174 +1003,6 @@ export class CloudCCLib {
)
}

public setupRDS(orm: string, args: Partial<aws.rds.InstanceArgs>) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IMO it would have been nice to make the changes and the move separately so it was easier to tell what changed

if (!this.subnetGroup) {
const subnetGroupName = sanitized(AwsSanitizer.RDS.dbSubnetGroup.nameValidation())`${h(
this.name
)}`
this.subnetGroup = new aws.rds.SubnetGroup(subnetGroupName, {
subnetIds: this.privateSubnetIds,
tags: {
Name: 'Klotho DB subnet group',
},
})
}

const dbName = sanitized(
AwsSanitizer.RDS.engine.pg.database.nameValidation()
)`${orm.toLowerCase()}`
const config = new pulumi.Config()
const username = config.require(`${dbName}_username`)
const password = config.requireSecret(`${dbName}_password`)

// create the db resources
validate(dbName, AwsSanitizer.RDS.instance.nameValidation())
const rds = new aws.rds.Instance(
dbName,
{
instanceClass: 'db.t4g.micro',
...args,
engine: 'postgres',
dbName: dbName,
username: username,
password: password,
iamDatabaseAuthenticationEnabled: true,
dbSubnetGroupName: this.subnetGroup.name,
vpcSecurityGroupIds: this.sgs,
},
{ protect: this.protect }
)

// setup secrets for the proxy
const secretName = `${dbName}_secret`
const ssmSecretName = `${this.name}-${secretName}`
validate(ssmSecretName, AwsSanitizer.SecretsManager.secret.nameValidation())
let rdsSecret = new aws.secretsmanager.Secret(`${secretName}`, {
name: ssmSecretName,
recoveryWindowInDays: 0,
})

const rdsSecretValues = {
username: username,
password: password,
engine: 'postgres',
host: rds.address,
port: rds.port,
dbname: dbName,
dbInstanceIdentifier: rds.id,
iamDatabaseAuthenticationEnabled: false,
}

const secret = new aws.secretsmanager.SecretVersion(`${secretName}`, {
secretId: rdsSecret.id,
secretString: pulumi.output(rdsSecretValues).apply((v) => JSON.stringify(v)),
})

this.topology.topologyIconData.forEach((resource) => {
if (resource.kind == Resource.secret) {
this.topology.topologyEdgeData.forEach((edge) => {
if (edge.target == resource.id) {
this.addPolicyStatementForName(
this.resourceIdToResource.get(edge.source).title,
{
Effect: 'Allow',
Action: ['secretsmanager:GetSecretValue'],
Resource: [secret.arn],
}
)
}
})
}
})

// prettier-ignore
const ormRoleName = sanitized(AwsSanitizer.IAM.role.nameValidation())`${h(dbName)}-ormsecretrole`
//setup role for proxy
const role = new aws.iam.Role(ormRoleName, {
assumeRolePolicy: {
Version: '2012-10-17',
Statement: [
{
Effect: 'Allow',
Principal: {
Service: 'rds.amazonaws.com',
},
Action: 'sts:AssumeRole',
},
],
},
})

// prettier-ignore
const ormPolicyName = sanitized(AwsSanitizer.IAM.policy.nameValidation())`${h(dbName)}-ormsecretpolicy`
const policy = new aws.iam.Policy(ormPolicyName, {
description: 'klotho orm secret policy',
policy: {
Version: '2012-10-17',
Statement: [
{
Effect: 'Allow',
Action: 'secretsmanager:GetSecretValue',
Resource: [secret.arn],
},
],
},
})

const attach = new aws.iam.RolePolicyAttachment(`${dbName}-ormattach`, {
role: role.name,
policyArn: policy.arn,
})

// setup the rds proxy
const proxyName = sanitized(AwsSanitizer.RDS.dbProxy.nameValidation())`${h(dbName)}`
const proxy = new aws.rds.Proxy(proxyName, {
debugLogging: false,
engineFamily: 'POSTGRESQL',
idleClientTimeout: 1800,
requireTls: false,
roleArn: role.arn,
vpcSecurityGroupIds: this.sgs,
vpcSubnetIds: this.privateSubnetIds,
auths: [
{
authScheme: 'SECRETS',
description: 'use the secrets generated by klotho',
iamAuth: 'DISABLED',
secretArn: secret.arn,
},
],
})

const proxyDefaultTargetGroup = new aws.rds.ProxyDefaultTargetGroup(`${dbName}`, {
dbProxyName: proxy.name,
connectionPoolConfig: {
connectionBorrowTimeout: 120,
maxConnectionsPercent: 100,
maxIdleConnectionsPercent: 50,
},
})
const proxyTarget = new aws.rds.ProxyTarget(`${dbName}`, {
dbInstanceIdentifier: rds.id,
dbProxyName: proxy.name,
targetGroupName: proxyDefaultTargetGroup.name,
})

const clients = this.addConnectionString(
orm,
pulumi.interpolate`postgresql://${username}:${password}@${proxy.endpoint}:5432/${dbName}`
)

const resource = pulumi.interpolate`arn:aws:rds-db:${this.region}:${this.account.accountId}:dbuser:${rds.resourceId}/${username}`
for (const client of clients) {
this.addPolicyStatementForName(this.resourceIdToResource.get(client).title, {
Effect: 'Allow',
Action: ['rds-db:connect'],
Resource: resource,
})
}
}

public addConnectionString(orm: string, connectionString: pulumi.Output<string>) {
const clients: string[] = []
this.topology.topologyIconData.forEach((resource) => {
Expand Down
Loading