Skip to content

Commit be2192f

Browse files
GuslingtonGuslington
authored
Merge pull request #5 from Guslington/develop
refactor mappings, subnets, tags and add tests
2 parents 6b821e7 + 03683d3 commit be2192f

9 files changed

+115
-71
lines changed

‎.travis.yml‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
11
language: ruby
22
rvm:
3-
- 2.3
3+
- 2.5
4+
install:
5+
- gem install cfhighlander cfn-nag
6+
before_script:
7+
- cfndsl -u
48
script:
5-
- gem install cfhighlander --prerelease
6-
- if [ "${TRAVIS_PULL_REQUEST}" != "false" ]; then cfhighlander cfcompile ; else cfhighlander cfcompile --validate; fi
9+
- if [ "${TRAVIS_PULL_REQUEST}" != "false" ]; then cfhighlander cftest --no-validate; else cfhighlander cftest; fi
10+
- cfn_nag_scan -i out/tests

‎aurora-postgres.cfhighlander.rb‎

Lines changed: 7 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,18 @@
11
CfhighlanderTemplate do
22

33
Name 'aurora-postgres'
4-
Description "Highlander Aurora Postgres component #{component_version}"
5-
DependsOn '[email protected]'
64

75
Parameters do
86
ComponentParam 'EnvironmentName', 'dev', isGlobal: true
97
ComponentParam 'EnvironmentType', 'development', isGlobal: true, allowedValues: ['development', 'production']
10-
ComponentParam 'StackOctet', isGlobal: true
11-
12-
MappingParam('WriterInstanceType') do
13-
map 'EnvironmentType'
14-
attribute 'WriterInstanceType'
15-
end
16-
MappingParam('ReaderInstanceType') do
17-
map 'EnvironmentType'
18-
attribute 'ReaderInstanceType'
19-
end
20-
MappingParam('DnsDomain') do
21-
map 'AccountId'
22-
attribute 'DnsDomain'
23-
end
24-
maximum_availability_zones.times do |az|
25-
ComponentParam "SubnetPersistence#{az}"
26-
end
27-
8+
ComponentParam 'WriterInstanceType'
9+
ComponentParam 'ReaderInstanceType'
10+
ComponentParam 'DnsDomain'
2811
ComponentParam 'SnapshotID'
29-
ComponentParam 'EnableReader', 'false'
12+
ComponentParam 'EnableReader', 'false', allowedValues: ['true', 'false']
3013
ComponentParam 'VPCId', type: 'AWS::EC2::VPC::Id'
14+
ComponentParam 'SubnetIds', type: 'CommaDelimitedList'
15+
ComponentParam 'KmsKeyId' if (defined? kms) && (kms)
3116
end
17+
3218
end

‎aurora-postgres.cfndsl.rb‎

Lines changed: 58 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,67 +1,92 @@
11
CloudFormation do
22

3-
Description "#{component_name} - #{component_version}"
4-
53
Condition("EnableReader", FnEquals(Ref("EnableReader"), 'true'))
64
Condition("UseUsernameAndPassword", FnEquals(Ref(:SnapshotID), ''))
75
Condition("UseSnapshotID", FnNot(FnEquals(Ref(:SnapshotID), '')))
86

9-
az_conditions_resources('SubnetPersistence', maximum_availability_zones)
10-
11-
tags = []
12-
tags << { Key: 'Environment', Value: Ref(:EnvironmentName) }
13-
tags << { Key: 'EnvironmentType', Value: Ref(:EnvironmentType) }
7+
aurora_tags = []
8+
aurora_tags << { Key: 'Name', Value: FnSub("${EnvironmentName}-#{component_name}") }
9+
aurora_tags << { Key: 'Environment', Value: Ref(:EnvironmentName) }
10+
aurora_tags << { Key: 'EnvironmentType', Value: Ref(:EnvironmentType) }
11+
aurora_tags.push(*tags.map {|k,v| {Key: k, Value: FnSub(v)}}).uniq { |h| h[:Key] } if defined? tags
1412

15-
extra_tags.each { |key,value| tags << { Key: key, Value: value } } if defined? extra_tags
13+
ingress = []
14+
security_group_rules.each do |rule|
15+
sg_rule = {
16+
FromPort: cluster_port,
17+
IpProtocol: 'TCP',
18+
ToPort: cluster_port,
19+
}
20+
if rule['security_group_id']
21+
sg_rule['SourceSecurityGroupId'] = FnSub(rule['security_group_id'])
22+
else
23+
sg_rule['CidrIp'] = FnSub(rule['ip'])
24+
end
25+
if rule['desc']
26+
sg_rule['Description'] = FnSub(rule['desc'])
27+
end
28+
ingress << sg_rule
29+
end if defined?(security_group_rules)
1630

1731
EC2_SecurityGroup(:SecurityGroup) do
1832
VpcId Ref('VPCId')
19-
GroupDescription FnJoin(' ', [ Ref(:EnvironmentName), component_name, 'security group' ])
20-
SecurityGroupIngress sg_create_rules(security_group, ip_blocks)
21-
Tags tags + [{ Key: 'Name', Value: FnJoin('-', [ Ref(:EnvironmentName), component_name, 'security-group' ])}]
33+
GroupDescription FnSub("Aurora postgres #{component_name} access for the ${EnvironmentName} environment")
34+
SecurityGroupIngress ingress if ingress.any?
35+
SecurityGroupEgress ([
36+
{
37+
CidrIp: "0.0.0.0/0",
38+
Description: "outbound all for ports",
39+
IpProtocol: -1,
40+
}
41+
])
42+
Tags aurora_tags
2243
end
2344

2445
RDS_DBSubnetGroup(:DBClusterSubnetGroup) {
25-
SubnetIds az_conditional_resources('SubnetPersistence', maximum_availability_zones)
26-
DBSubnetGroupDescription FnJoin(' ', [ Ref(:EnvironmentName), component_name, 'subnet group' ])
27-
Tags tags + [{ Key: 'Name', Value: FnJoin('-', [ Ref(:EnvironmentName), component_name, 'subnet-group' ])}]
46+
SubnetIds Ref('SubnetIds')
47+
DBSubnetGroupDescription FnSub("Aurora postgres #{component_name} subnets for the ${EnvironmentName} environment")
48+
Tags aurora_tags
2849
}
2950

3051
RDS_DBClusterParameterGroup(:DBClusterParameterGroup) {
31-
Description FnJoin(' ', [ Ref(:EnvironmentName), component_name, 'cluster parameter group' ])
32-
Family 'aurora-postgresql9.6'
52+
Description FnSub("Aurora postgres #{component_name} cluster parameters for the ${EnvironmentName} environment")
53+
Family family
3354
Parameters cluster_parameters if defined? cluster_parameters
34-
Tags tags + [{ Key: 'Name', Value: FnJoin('-', [ Ref(:EnvironmentName), component_name, 'cluster-parameter-group' ])}]
55+
Tags aurora_tags
3556
}
3657

3758
RDS_DBCluster(:DBCluster) {
3859
Engine 'aurora-postgresql'
60+
EngineVersion engine_version if defined? engine_version
3961
DBClusterParameterGroupName Ref(:DBClusterParameterGroup)
4062
SnapshotIdentifier Ref(:SnapshotID)
4163
SnapshotIdentifier FnIf('UseSnapshotID',Ref(:SnapshotID), Ref('AWS::NoValue'))
4264
MasterUsername FnIf('UseUsernameAndPassword', FnJoin('', [ '{{resolve:ssm:', FnSub(master_login['username_ssm_param']), ':1}}' ]), Ref('AWS::NoValue'))
4365
MasterUserPassword FnIf('UseUsernameAndPassword', FnJoin('', [ '{{resolve:ssm-secure:', FnSub(master_login['password_ssm_param']), ':1}}' ]), Ref('AWS::NoValue'))
4466
DBSubnetGroupName Ref(:DBClusterSubnetGroup)
4567
VpcSecurityGroupIds [ Ref(:SecurityGroup) ]
68+
StorageEncrypted storage_encrypted if defined? storage_encrypted
69+
KmsKeyId Ref('KmsKeyId') if (defined? kms) && (kms)
4670
Port cluster_port
47-
Tags tags + [{ Key: 'Name', Value: FnJoin('-', [ Ref(:EnvironmentName), component_name, 'cluster' ])}]
71+
Tags aurora_tags
4872
}
4973

5074
RDS_DBParameterGroup(:DBInstanceParameterGroup) {
51-
Description FnJoin(' ', [ Ref(:EnvironmentName), component_name, 'instance parameter group' ])
52-
Family 'aurora-postgresql9.6'
75+
Description FnSub("Aurora postgres #{component_name} instance parameters for the ${EnvironmentName} environment")
76+
Family family
5377
Parameters instance_parameters if defined? instance_parameters
54-
Tags tags + [{ Key: 'Name', Value: FnJoin('-', [ Ref(:EnvironmentName), component_name, 'instance-parameter-group' ])}]
78+
Tags aurora_tags
5579
}
5680

5781
RDS_DBInstance(:DBClusterInstanceWriter) {
5882
DBSubnetGroupName Ref(:DBClusterSubnetGroup)
5983
DBParameterGroupName Ref(:DBInstanceParameterGroup)
6084
DBClusterIdentifier Ref(:DBCluster)
6185
Engine 'aurora-postgresql'
86+
EngineVersion engine_version if defined? engine_version
6287
PubliclyAccessible 'false'
6388
DBInstanceClass Ref(:WriterInstanceType)
64-
Tags tags + [{ Key: 'Name', Value: FnJoin('-', [ Ref(:EnvironmentName), component_name, 'writer-instance' ])}]
89+
Tags aurora_tags
6590
}
6691

6792
RDS_DBInstance(:DBClusterInstanceReader) {
@@ -70,9 +95,19 @@
7095
DBParameterGroupName Ref(:DBInstanceParameterGroup)
7196
DBClusterIdentifier Ref(:DBCluster)
7297
Engine 'aurora-postgresql'
98+
EngineVersion engine_version if defined? engine_version
7399
PubliclyAccessible 'false'
74100
DBInstanceClass Ref(:ReaderInstanceType)
75-
Tags tags + [{ Key: 'Name', Value: FnJoin('-', [ Ref(:EnvironmentName), component_name, 'reader-instance' ])}]
101+
Tags aurora_tags
102+
}
103+
104+
Route53_RecordSet(:DBClusterReaderRecord) {
105+
Condition(:EnableReader)
106+
HostedZoneName FnJoin('', [ Ref('EnvironmentName'), '.', Ref('DnsDomain'), '.'])
107+
Name FnJoin('', [ hostname_read_endpoint, '.', Ref('EnvironmentName'), '.', Ref('DnsDomain'), '.' ])
108+
Type 'CNAME'
109+
TTL '60'
110+
ResourceRecords [ FnGetAtt('DBCluster','ReadEndpoint.Address') ]
76111
}
77112

78113
Route53_RecordSet(:DBHostRecord) {

‎aurora-postgres.config.yaml‎

Lines changed: 1 addition & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
maximum_availability_zones: 5
21
hostname: aurora2pg
2+
hostname_read_endpoint: aurora2pg-read
33

44
cluster_port: 5432
55

@@ -10,19 +10,3 @@ master_login:
1010
cluster_parameters:
1111
timezone: "UTC"
1212
# instance_parameters:
13-
14-
# Set `ip_blocks` here or export from vpc component
15-
ip_blocks:
16-
local:
17-
- 127.0.0.1/32
18-
19-
20-
security_group:
21-
-
22-
rules:
23-
-
24-
IpProtocol: tcp
25-
FromPort: 5432
26-
ToPort: 5432
27-
ips:
28-
- stack

‎aurora-postgres.mappings.yaml‎

Lines changed: 0 additions & 7 deletions
This file was deleted.

‎tests/default.test.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
test_metadata:
2+
type: config
3+
name: default
4+
description: set the description for your test
5+
6+
family: aurora-postgresql9.6
7+
engine: 9.6.12
8+
storage_encrypted: true

‎tests/kms.test.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
test_metadata:
2+
type: config
3+
name: kms
4+
description: set the description for your test
5+
6+
family: aurora-postgresql9.6
7+
storage_encrypted: true
8+
kms: true

‎tests/security_group.test.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
test_metadata:
2+
type: config
3+
name: security_group
4+
description: set the description for your test
5+
6+
family: aurora-postgresql9.6
7+
storage_encrypted: true
8+
9+
security_group_rules:
10+
-
11+
security_group_id: sg-328h4242u3h
12+
desc: access from my app
13+
-
14+
ip: 10.0.0.0/16
15+
desc: access from peered vpc

‎tests/tags.test.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
test_metadata:
2+
type: config
3+
name: tags
4+
description: set the description for your test
5+
6+
family: aurora-postgresql9.6
7+
storage_encrypted: true
8+
9+
tags:
10+
Name: ${EnvironmentName}-tag-test
11+
CostCenter: test

0 commit comments

Comments
 (0)