1125 lines
45 KiB
Terraform
1125 lines
45 KiB
Terraform
variable "vpc" {
|
|
type = object({
|
|
name = optional(string, "fleet")
|
|
cidr = optional(string, "10.10.0.0/16")
|
|
azs = optional(list(string), ["us-east-2a", "us-east-2b", "us-east-2c"])
|
|
private_subnets = optional(list(string), ["10.10.1.0/24", "10.10.2.0/24", "10.10.3.0/24"])
|
|
public_subnets = optional(list(string), ["10.10.11.0/24", "10.10.12.0/24", "10.10.13.0/24"])
|
|
database_subnets = optional(list(string), ["10.10.21.0/24", "10.10.22.0/24", "10.10.23.0/24"])
|
|
elasticache_subnets = optional(list(string), ["10.10.31.0/24", "10.10.32.0/24", "10.10.33.0/24"])
|
|
|
|
create_database_subnet_group = optional(bool, false)
|
|
create_database_subnet_route_table = optional(bool, true)
|
|
create_elasticache_subnet_group = optional(bool, true)
|
|
create_elasticache_subnet_route_table = optional(bool, true)
|
|
enable_vpn_gateway = optional(bool, false)
|
|
one_nat_gateway_per_az = optional(bool, false)
|
|
single_nat_gateway = optional(bool, true)
|
|
enable_nat_gateway = optional(bool, true)
|
|
enable_dns_hostnames = optional(bool, false)
|
|
enable_dns_support = optional(bool, true)
|
|
enable_flow_log = optional(bool, false)
|
|
create_flow_log_cloudwatch_log_group = optional(bool, false)
|
|
create_flow_log_cloudwatch_iam_role = optional(bool, false)
|
|
flow_log_max_aggregation_interval = optional(number, 600)
|
|
flow_log_cloudwatch_log_group_name_prefix = optional(string, "/aws/vpc-flow-log/")
|
|
flow_log_cloudwatch_log_group_name_suffix = optional(string, "")
|
|
flow_log_cloudwatch_log_group_retention_in_days = optional(number, null)
|
|
flow_log_cloudwatch_log_group_kms = optional(object({
|
|
cmk_enabled = optional(bool, false)
|
|
kms_key_arn = optional(string, null)
|
|
kms_alias = optional(string, "fleet-vpc-flow-logs")
|
|
extra_kms_policies = optional(list(any), [])
|
|
}), {
|
|
cmk_enabled = false
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-vpc-flow-logs"
|
|
extra_kms_policies = []
|
|
})
|
|
vpc_flow_log_tags = optional(map(string), {})
|
|
|
|
manage_default_network_acl = optional(bool, true)
|
|
default_network_acl_ingress = optional(list(map(string)), [
|
|
{
|
|
rule_no = 100
|
|
action = "allow"
|
|
from_port = 0
|
|
to_port = 0
|
|
protocol = "-1"
|
|
cidr_block = "0.0.0.0/0"
|
|
},
|
|
{
|
|
rule_no = 101
|
|
action = "allow"
|
|
from_port = 0
|
|
to_port = 0
|
|
protocol = "-1"
|
|
ipv6_cidr_block = "::/0"
|
|
}])
|
|
default_network_acl_egress = optional(list(map(string)), [
|
|
{
|
|
rule_no = 100
|
|
action = "allow"
|
|
from_port = 0
|
|
to_port = 0
|
|
protocol = "-1"
|
|
cidr_block = "0.0.0.0/0"
|
|
},
|
|
{
|
|
rule_no = 101
|
|
action = "allow"
|
|
from_port = 0
|
|
to_port = 0
|
|
protocol = "-1"
|
|
ipv6_cidr_block = "::/0"
|
|
}])
|
|
})
|
|
default = {
|
|
name = "fleet"
|
|
cidr = "10.10.0.0/16"
|
|
azs = ["us-east-2a", "us-east-2b", "us-east-2c"]
|
|
private_subnets = ["10.10.1.0/24", "10.10.2.0/24", "10.10.3.0/24"]
|
|
public_subnets = ["10.10.11.0/24", "10.10.12.0/24", "10.10.13.0/24"]
|
|
database_subnets = ["10.10.21.0/24", "10.10.22.0/24", "10.10.23.0/24"]
|
|
elasticache_subnets = ["10.10.31.0/24", "10.10.32.0/24", "10.10.33.0/24"]
|
|
|
|
create_database_subnet_group = false
|
|
create_database_subnet_route_table = true
|
|
create_elasticache_subnet_group = true
|
|
create_elasticache_subnet_route_table = true
|
|
enable_vpn_gateway = false
|
|
one_nat_gateway_per_az = false
|
|
single_nat_gateway = true
|
|
enable_nat_gateway = true
|
|
enable_dns_hostnames = false
|
|
enable_dns_support = true
|
|
enable_flow_log = false
|
|
create_flow_log_cloudwatch_log_group = false
|
|
create_flow_log_cloudwatch_iam_role = false
|
|
flow_log_max_aggregation_interval = 600
|
|
flow_log_cloudwatch_log_group_name_prefix = "/aws/vpc-flow-log/"
|
|
flow_log_cloudwatch_log_group_name_suffix = ""
|
|
flow_log_cloudwatch_log_group_retention_in_days = null
|
|
flow_log_cloudwatch_log_group_kms = {
|
|
cmk_enabled = false
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-vpc-flow-logs"
|
|
extra_kms_policies = []
|
|
}
|
|
vpc_flow_log_tags = {}
|
|
|
|
manage_default_network_acl = true
|
|
default_network_acl_ingress = [
|
|
{
|
|
rule_no = 100
|
|
action = "allow"
|
|
from_port = 0
|
|
to_port = 0
|
|
protocol = "-1"
|
|
cidr_block = "0.0.0.0/0"
|
|
},
|
|
{
|
|
rule_no = 101
|
|
action = "allow"
|
|
from_port = 0
|
|
to_port = 0
|
|
protocol = "-1"
|
|
ipv6_cidr_block = "::/0"
|
|
}]
|
|
default_network_acl_egress = [
|
|
{
|
|
rule_no = 100
|
|
action = "allow"
|
|
from_port = 0
|
|
to_port = 0
|
|
protocol = "-1"
|
|
cidr_block = "0.0.0.0/0"
|
|
},
|
|
{
|
|
rule_no = 101
|
|
action = "allow"
|
|
from_port = 0
|
|
to_port = 0
|
|
protocol = "-1"
|
|
ipv6_cidr_block = "::/0"
|
|
}]
|
|
}
|
|
validation {
|
|
condition = (
|
|
var.vpc.flow_log_cloudwatch_log_group_kms.kms_key_arn == null ||
|
|
(
|
|
var.vpc.enable_flow_log == true &&
|
|
var.vpc.create_flow_log_cloudwatch_log_group == true &&
|
|
var.vpc.flow_log_cloudwatch_log_group_kms.cmk_enabled == true
|
|
)
|
|
)
|
|
error_message = "vpc.flow_log_cloudwatch_log_group_kms.kms_key_arn requires vpc.enable_flow_log = true, vpc.create_flow_log_cloudwatch_log_group = true, and vpc.flow_log_cloudwatch_log_group_kms.cmk_enabled = true."
|
|
}
|
|
validation {
|
|
condition = (
|
|
length(var.vpc.flow_log_cloudwatch_log_group_kms.extra_kms_policies) == 0 ||
|
|
(
|
|
var.vpc.enable_flow_log == true &&
|
|
var.vpc.create_flow_log_cloudwatch_log_group == true &&
|
|
var.vpc.flow_log_cloudwatch_log_group_kms.cmk_enabled == true &&
|
|
var.vpc.flow_log_cloudwatch_log_group_kms.kms_key_arn == null
|
|
)
|
|
)
|
|
error_message = "vpc.flow_log_cloudwatch_log_group_kms.extra_kms_policies can be set only when the root module is creating the VPC flow log CloudWatch log group CMK."
|
|
}
|
|
}
|
|
|
|
variable "certificate_arn" {
|
|
type = string
|
|
default = null
|
|
description = "ACM certificate ARN for the ALB HTTPS listener. Not required when alb_config.enabled = false."
|
|
}
|
|
|
|
variable "kms_base_policy" {
|
|
type = list(object({
|
|
sid = string
|
|
effect = string
|
|
principals = object({
|
|
type = string
|
|
identifiers = list(string)
|
|
})
|
|
actions = list(string)
|
|
resources = list(string)
|
|
conditions = optional(list(object({
|
|
test = string
|
|
variable = string
|
|
values = list(string)
|
|
})), [])
|
|
}))
|
|
default = null
|
|
description = "Optional base KMS key-policy statements to apply to module-created CMKs before module-required service access statements are merged in. If null, the module defaults to the historical root `kms:*` statement."
|
|
}
|
|
|
|
variable "rds_config" {
|
|
type = object({
|
|
name = optional(string, "fleet")
|
|
engine_version = optional(string, "8.0.mysql_aurora.3.08.2")
|
|
instance_class = optional(string, "db.t4g.large")
|
|
subnets = optional(list(string), [])
|
|
allowed_security_groups = optional(list(string), [])
|
|
allowed_cidr_blocks = optional(list(string), [])
|
|
apply_immediately = optional(bool, true)
|
|
monitoring_interval = optional(number, 60)
|
|
backtrack_window = optional(number, null)
|
|
db_parameter_group_name = optional(string)
|
|
db_parameters = optional(map(string), {})
|
|
db_cluster_parameter_group_name = optional(string)
|
|
db_cluster_parameters = optional(map(string), {})
|
|
enabled_cloudwatch_logs_exports = optional(list(string), [])
|
|
final_snapshot_identifier = optional(string, null)
|
|
password_secret_kms = optional(object({
|
|
cmk_enabled = optional(bool, false)
|
|
kms_key_arn = optional(string, null)
|
|
kms_alias = optional(string, "fleet-rds-password-secret")
|
|
extra_kms_policies = optional(list(any), [])
|
|
}), {
|
|
cmk_enabled = false
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-rds-password-secret"
|
|
extra_kms_policies = []
|
|
})
|
|
storage_kms = optional(object({
|
|
cmk_enabled = optional(bool, false)
|
|
kms_key_arn = optional(string, null)
|
|
kms_alias = optional(string, "fleet-rds-storage")
|
|
extra_kms_policies = optional(list(any), [])
|
|
}), {
|
|
cmk_enabled = false
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-rds-storage"
|
|
extra_kms_policies = []
|
|
})
|
|
observability = optional(object({
|
|
performance_insights_enabled = optional(bool, true)
|
|
retention_period = optional(number, null)
|
|
database_insights_mode = optional(string, null)
|
|
kms = optional(object({
|
|
cmk_enabled = optional(bool, false)
|
|
kms_key_arn = optional(string, null)
|
|
kms_alias = optional(string, "fleet-rds-performance-insights")
|
|
extra_kms_policies = optional(list(any), [])
|
|
}), {
|
|
cmk_enabled = false
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-rds-performance-insights"
|
|
extra_kms_policies = []
|
|
})
|
|
}), {
|
|
performance_insights_enabled = true
|
|
retention_period = null
|
|
database_insights_mode = null
|
|
kms = {
|
|
cmk_enabled = false
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-rds-performance-insights"
|
|
extra_kms_policies = []
|
|
}
|
|
})
|
|
cloudwatch_log_group = optional(object({
|
|
retention_in_days = optional(number, null)
|
|
skip_destroy = optional(bool, false)
|
|
kms = optional(object({
|
|
cmk_enabled = optional(bool, false)
|
|
kms_key_arn = optional(string, null)
|
|
kms_alias = optional(string, "fleet-rds-logs")
|
|
extra_kms_policies = optional(list(any), [])
|
|
}), {
|
|
cmk_enabled = false
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-rds-logs"
|
|
extra_kms_policies = []
|
|
})
|
|
}), {
|
|
retention_in_days = null
|
|
skip_destroy = false
|
|
kms = {
|
|
cmk_enabled = false
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-rds-logs"
|
|
extra_kms_policies = []
|
|
}
|
|
})
|
|
master_username = optional(string, "fleet")
|
|
database_name = optional(string, "fleet")
|
|
snapshot_identifier = optional(string)
|
|
cluster_tags = optional(map(string), {})
|
|
preferred_maintenance_window = optional(string, "thu:23:00-fri:00:00")
|
|
skip_final_snapshot = optional(bool, true)
|
|
backup_retention_period = optional(number, 7)
|
|
replicas = optional(number, 2)
|
|
serverless = optional(bool, false)
|
|
serverless_min_capacity = optional(number, 2)
|
|
serverless_max_capacity = optional(number, 10)
|
|
restore_to_point_in_time = optional(map(string), {})
|
|
})
|
|
default = {
|
|
name = "fleet"
|
|
engine_version = "8.0.mysql_aurora.3.08.2"
|
|
instance_class = "db.t4g.large"
|
|
subnets = []
|
|
allowed_security_groups = []
|
|
allowed_cidr_blocks = []
|
|
apply_immediately = true
|
|
monitoring_interval = 60
|
|
backtrack_window = null
|
|
db_parameter_group_name = null
|
|
db_parameters = {}
|
|
db_cluster_parameter_group_name = null
|
|
db_cluster_parameters = {}
|
|
enabled_cloudwatch_logs_exports = []
|
|
final_snapshot_identifier = null
|
|
password_secret_kms = {
|
|
cmk_enabled = false
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-rds-password-secret"
|
|
extra_kms_policies = []
|
|
}
|
|
storage_kms = {
|
|
cmk_enabled = false
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-rds-storage"
|
|
extra_kms_policies = []
|
|
}
|
|
observability = {
|
|
performance_insights_enabled = true
|
|
retention_period = null
|
|
database_insights_mode = null
|
|
kms = {
|
|
cmk_enabled = false
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-rds-performance-insights"
|
|
extra_kms_policies = []
|
|
}
|
|
}
|
|
cloudwatch_log_group = {
|
|
retention_in_days = null
|
|
skip_destroy = false
|
|
kms = {
|
|
cmk_enabled = false
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-rds-logs"
|
|
extra_kms_policies = []
|
|
}
|
|
}
|
|
master_username = "fleet"
|
|
database_name = "fleet"
|
|
snapshot_identifier = null
|
|
cluster_tags = {}
|
|
preferred_maintenance_window = "thu:23:00-fri:00:00"
|
|
skip_final_snapshot = true
|
|
backup_retention_period = 7
|
|
replicas = 2
|
|
serverless = false
|
|
serverless_min_capacity = 2
|
|
serverless_max_capacity = 10
|
|
restore_to_point_in_time = {}
|
|
}
|
|
description = "The config for the terraform-aws-modules/rds-aurora/aws module. Deprecated: use rds_configs instead."
|
|
nullable = false
|
|
validation {
|
|
condition = var.rds_configs != null || var.rds_config.backtrack_window == null || (var.rds_config.backtrack_window >= 0 && var.rds_config.backtrack_window <= 259200)
|
|
error_message = "rds_config.backtrack_window must be null or between 0 and 259200 seconds."
|
|
}
|
|
validation {
|
|
condition = var.rds_configs != null || var.rds_config.observability.database_insights_mode == null || contains(["standard", "advanced"], var.rds_config.observability.database_insights_mode)
|
|
error_message = "rds_config.observability.database_insights_mode must be null, \"standard\", or \"advanced\"."
|
|
}
|
|
validation {
|
|
condition = var.rds_configs != null || var.rds_config.observability.database_insights_mode != "advanced" || var.rds_config.observability.performance_insights_enabled == true
|
|
error_message = "rds_config.observability.performance_insights_enabled must be true when database_insights_mode is \"advanced\"."
|
|
}
|
|
validation {
|
|
condition = var.rds_configs != null || var.rds_config.observability.database_insights_mode != "advanced" || var.rds_config.monitoring_interval > 0
|
|
error_message = "rds_config.monitoring_interval must be greater than 0 when database_insights_mode is \"advanced\"."
|
|
}
|
|
validation {
|
|
condition = var.rds_configs != null || var.rds_config.observability.database_insights_mode != "advanced" || var.rds_config.observability.retention_period == null || var.rds_config.observability.retention_period >= 465
|
|
error_message = "rds_config.observability.retention_period must be at least 465 when database_insights_mode is \"advanced\"."
|
|
}
|
|
validation {
|
|
condition = var.rds_configs != null || var.rds_config.observability.performance_insights_enabled == true || (var.rds_config.observability.database_insights_mode == null && var.rds_config.observability.kms.cmk_enabled == false && var.rds_config.observability.kms.kms_key_arn == null)
|
|
error_message = "When performance_insights_enabled is false, database_insights_mode must be null and observability KMS must be disabled."
|
|
}
|
|
}
|
|
|
|
variable "rds_configs" {
|
|
description = "Map of named Aurora cluster configurations for blue-green cutovers. When set, rds_config is ignored."
|
|
type = map(object({
|
|
name = optional(string, "fleet")
|
|
engine_version = optional(string, "8.0.mysql_aurora.3.08.2")
|
|
instance_class = optional(string, "db.t4g.large")
|
|
subnets = optional(list(string), [])
|
|
allowed_security_groups = optional(list(string), [])
|
|
allowed_cidr_blocks = optional(list(string), [])
|
|
apply_immediately = optional(bool, true)
|
|
monitoring_interval = optional(number, 10)
|
|
backtrack_window = optional(number, null)
|
|
db_parameter_group_name = optional(string)
|
|
db_parameters = optional(map(string), {})
|
|
db_cluster_parameter_group_name = optional(string)
|
|
db_cluster_parameters = optional(map(string), {})
|
|
enabled_cloudwatch_logs_exports = optional(list(string), [])
|
|
final_snapshot_identifier = optional(string, null)
|
|
password_secret_kms = optional(object({
|
|
cmk_enabled = optional(bool, false)
|
|
kms_key_arn = optional(string, null)
|
|
kms_alias = optional(string, "fleet-rds-password-secret")
|
|
extra_kms_policies = optional(list(any), [])
|
|
}), {
|
|
cmk_enabled = false
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-rds-password-secret"
|
|
extra_kms_policies = []
|
|
})
|
|
storage_kms = optional(object({
|
|
cmk_enabled = optional(bool, false)
|
|
kms_key_arn = optional(string, null)
|
|
kms_alias = optional(string, "fleet-rds-storage")
|
|
extra_kms_policies = optional(list(any), [])
|
|
}), {
|
|
cmk_enabled = false
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-rds-storage"
|
|
extra_kms_policies = []
|
|
})
|
|
observability = optional(object({
|
|
performance_insights_enabled = optional(bool, true)
|
|
retention_period = optional(number, null)
|
|
database_insights_mode = optional(string, null)
|
|
kms = optional(object({
|
|
cmk_enabled = optional(bool, false)
|
|
kms_key_arn = optional(string, null)
|
|
kms_alias = optional(string, "fleet-rds-performance-insights")
|
|
extra_kms_policies = optional(list(any), [])
|
|
}), {
|
|
cmk_enabled = false
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-rds-performance-insights"
|
|
extra_kms_policies = []
|
|
})
|
|
}), {
|
|
performance_insights_enabled = true
|
|
retention_period = null
|
|
database_insights_mode = null
|
|
kms = {
|
|
cmk_enabled = false
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-rds-performance-insights"
|
|
extra_kms_policies = []
|
|
}
|
|
})
|
|
cloudwatch_log_group = optional(object({
|
|
retention_in_days = optional(number, null)
|
|
skip_destroy = optional(bool, false)
|
|
kms = optional(object({
|
|
cmk_enabled = optional(bool, false)
|
|
kms_key_arn = optional(string, null)
|
|
kms_alias = optional(string, "fleet-rds-logs")
|
|
extra_kms_policies = optional(list(any), [])
|
|
}), {
|
|
cmk_enabled = false
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-rds-logs"
|
|
extra_kms_policies = []
|
|
})
|
|
}), {
|
|
retention_in_days = null
|
|
skip_destroy = false
|
|
kms = {
|
|
cmk_enabled = false
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-rds-logs"
|
|
extra_kms_policies = []
|
|
}
|
|
})
|
|
master_username = optional(string, "fleet")
|
|
database_name = optional(string, "fleet")
|
|
snapshot_identifier = optional(string)
|
|
cluster_tags = optional(map(string), {})
|
|
preferred_maintenance_window = optional(string, "thu:23:00-fri:00:00")
|
|
skip_final_snapshot = optional(bool, true)
|
|
backup_retention_period = optional(number, 7)
|
|
replicas = optional(number, 2)
|
|
serverless = optional(bool, false)
|
|
serverless_min_capacity = optional(number, 2)
|
|
serverless_max_capacity = optional(number, 10)
|
|
restore_to_point_in_time = optional(map(string), {})
|
|
}))
|
|
default = null
|
|
|
|
validation {
|
|
condition = var.rds_configs == null || length(var.rds_configs) > 0
|
|
error_message = "rds_configs must contain at least one cluster configuration when set."
|
|
}
|
|
validation {
|
|
condition = var.rds_configs == null || length(distinct([for config in values(var.rds_configs) : config.name])) == length(var.rds_configs)
|
|
error_message = "Each rds_configs entry must use a unique name."
|
|
}
|
|
validation {
|
|
condition = var.rds_configs == null || alltrue([for config in values(var.rds_configs) : config.backtrack_window == null || (config.backtrack_window >= 0 && config.backtrack_window <= 259200)])
|
|
error_message = "Each rds_configs backtrack_window must be null or between 0 and 259200 seconds."
|
|
}
|
|
validation {
|
|
condition = var.rds_configs == null || alltrue([for config in values(var.rds_configs) : config.observability.database_insights_mode == null || contains(["standard", "advanced"], config.observability.database_insights_mode)])
|
|
error_message = "Each rds_configs observability.database_insights_mode must be null, \"standard\", or \"advanced\"."
|
|
}
|
|
validation {
|
|
condition = var.rds_configs == null || alltrue([for config in values(var.rds_configs) : config.observability.database_insights_mode != "advanced" || config.observability.performance_insights_enabled == true])
|
|
error_message = "Each rds_configs observability.performance_insights_enabled must be true when database_insights_mode is \"advanced\"."
|
|
}
|
|
validation {
|
|
condition = var.rds_configs == null || alltrue([for config in values(var.rds_configs) : config.observability.database_insights_mode != "advanced" || config.monitoring_interval > 0])
|
|
error_message = "Each rds_configs monitoring_interval must be greater than 0 when database_insights_mode is \"advanced\"."
|
|
}
|
|
validation {
|
|
condition = var.rds_configs == null || alltrue([for config in values(var.rds_configs) : config.observability.database_insights_mode != "advanced" || config.observability.retention_period == null || config.observability.retention_period >= 465])
|
|
error_message = "Each rds_configs observability.retention_period must be at least 465 when database_insights_mode is \"advanced\"."
|
|
}
|
|
validation {
|
|
condition = var.rds_configs == null || alltrue([for config in values(var.rds_configs) : config.observability.performance_insights_enabled == true || (config.observability.database_insights_mode == null && config.observability.kms.cmk_enabled == false && config.observability.kms.kms_key_arn == null)])
|
|
error_message = "When performance_insights_enabled is false, database_insights_mode must be null and observability KMS must be disabled for that rds_configs entry."
|
|
}
|
|
}
|
|
|
|
variable "active_rds_config_name" {
|
|
description = "Name of the rds_configs entry used by Fleet. Defaults to the synthetic current entry when using legacy rds_config."
|
|
type = string
|
|
default = "current"
|
|
|
|
validation {
|
|
condition = var.rds_configs == null ? var.active_rds_config_name == "current" : contains(keys(var.rds_configs), var.active_rds_config_name)
|
|
error_message = "active_rds_config_name must be current when using rds_config, or a key present in rds_configs."
|
|
}
|
|
}
|
|
|
|
variable "redis_config" {
|
|
type = object({
|
|
# Set enabled = false to skip creating the ElastiCache cluster entirely
|
|
# (cost savings). Fleet then receives an empty FLEET_REDIS_ADDRESS and
|
|
# falls back to in-memory caching, suitable for small deployments.
|
|
enabled = optional(bool, true)
|
|
name = optional(string, "fleet")
|
|
replication_group_id = optional(string)
|
|
elasticache_subnet_group_name = optional(string)
|
|
allowed_security_group_ids = optional(list(string), [])
|
|
subnets = optional(list(string))
|
|
availability_zones = optional(list(string))
|
|
cluster_size = optional(number, 2)
|
|
instance_type = optional(string, "cache.t4g.small")
|
|
apply_immediately = optional(bool, true)
|
|
automatic_failover_enabled = optional(bool, false)
|
|
engine = optional(string, "redis")
|
|
engine_version = optional(string, "7.1")
|
|
family = optional(string, "redis7")
|
|
at_rest_encryption_enabled = optional(bool, true)
|
|
at_rest_kms = optional(object({
|
|
cmk_enabled = optional(bool, false)
|
|
kms_key_arn = optional(string, null)
|
|
kms_alias = optional(string, "fleet-redis-at-rest")
|
|
extra_kms_policies = optional(list(any), [])
|
|
}), {
|
|
cmk_enabled = false
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-redis-at-rest"
|
|
extra_kms_policies = []
|
|
})
|
|
transit_encryption_enabled = optional(bool, true)
|
|
parameter = optional(list(object({
|
|
name = string
|
|
value = string
|
|
})), [])
|
|
cloudwatch_log_group = optional(object({
|
|
retention_in_days = optional(number, null)
|
|
skip_destroy = optional(bool, false)
|
|
kms = optional(object({
|
|
cmk_enabled = optional(bool, false)
|
|
kms_key_arn = optional(string, null)
|
|
kms_alias = optional(string, "fleet-redis-logs")
|
|
extra_kms_policies = optional(list(any), [])
|
|
}), {
|
|
cmk_enabled = false
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-redis-logs"
|
|
extra_kms_policies = []
|
|
})
|
|
}), {
|
|
retention_in_days = null
|
|
skip_destroy = false
|
|
kms = {
|
|
cmk_enabled = false
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-redis-logs"
|
|
}
|
|
})
|
|
log_delivery_configuration = optional(list(map(any)), [])
|
|
tags = optional(map(string), {})
|
|
})
|
|
default = {
|
|
name = "fleet"
|
|
replication_group_id = null
|
|
elasticache_subnet_group_name = null
|
|
allowed_security_group_ids = []
|
|
subnets = null
|
|
availability_zones = null
|
|
cluster_size = 2
|
|
instance_type = "cache.t4g.small"
|
|
apply_immediately = true
|
|
automatic_failover_enabled = false
|
|
engine = "redis"
|
|
engine_version = "7.1"
|
|
family = "redis7"
|
|
at_rest_encryption_enabled = true
|
|
at_rest_kms = {
|
|
cmk_enabled = false
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-redis-at-rest"
|
|
extra_kms_policies = []
|
|
}
|
|
transit_encryption_enabled = true
|
|
parameter = []
|
|
cloudwatch_log_group = {
|
|
retention_in_days = null
|
|
skip_destroy = false
|
|
kms = {
|
|
cmk_enabled = false
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-redis-logs"
|
|
extra_kms_policies = []
|
|
}
|
|
}
|
|
log_delivery_configuration = []
|
|
tags = {}
|
|
}
|
|
}
|
|
|
|
variable "ecs_cluster" {
|
|
type = object({
|
|
autoscaling_capacity_providers = optional(any, {})
|
|
cluster_configuration = optional(any, {
|
|
execute_command_configuration = {
|
|
logging = "OVERRIDE"
|
|
log_configuration = {
|
|
cloud_watch_log_group_name = "/aws/ecs/aws-ec2"
|
|
}
|
|
}
|
|
})
|
|
cluster_name = optional(string, "fleet")
|
|
cloudwatch_log_group = optional(object({
|
|
create = optional(bool, true)
|
|
retention_in_days = optional(number, 30)
|
|
kms = optional(object({
|
|
cmk_enabled = optional(bool, null)
|
|
enabled = optional(bool, null)
|
|
kms_key_arn = optional(string, null)
|
|
kms_alias = optional(string, "fleet-ecs-cluster-logs")
|
|
extra_kms_policies = optional(list(any), [])
|
|
}), {
|
|
cmk_enabled = null
|
|
enabled = null
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-ecs-cluster-logs"
|
|
extra_kms_policies = []
|
|
})
|
|
}), {
|
|
create = true
|
|
retention_in_days = 30
|
|
kms = {
|
|
cmk_enabled = null
|
|
enabled = null
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-ecs-cluster-logs"
|
|
}
|
|
})
|
|
cluster_settings = optional(any, {
|
|
"name" : "containerInsights",
|
|
"value" : "disabled",
|
|
})
|
|
create = optional(bool, true)
|
|
default_capacity_provider_use_fargate = optional(bool, true)
|
|
fargate_capacity_providers = optional(any, {
|
|
FARGATE = {
|
|
default_capacity_provider_strategy = {
|
|
weight = 50
|
|
}
|
|
}
|
|
FARGATE_SPOT = {
|
|
default_capacity_provider_strategy = {
|
|
weight = 50
|
|
}
|
|
}
|
|
})
|
|
tags = optional(map(string))
|
|
})
|
|
default = {
|
|
autoscaling_capacity_providers = {}
|
|
cluster_configuration = {
|
|
execute_command_configuration = {
|
|
logging = "OVERRIDE"
|
|
log_configuration = {
|
|
cloud_watch_log_group_name = "/aws/ecs/aws-ec2"
|
|
}
|
|
}
|
|
}
|
|
cluster_name = "fleet"
|
|
cloudwatch_log_group = {
|
|
create = true
|
|
retention_in_days = 30
|
|
kms = {
|
|
cmk_enabled = null
|
|
enabled = null
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-ecs-cluster-logs"
|
|
extra_kms_policies = []
|
|
}
|
|
}
|
|
cluster_settings = {
|
|
"name" : "containerInsights",
|
|
"value" : "disabled",
|
|
}
|
|
create = true
|
|
default_capacity_provider_use_fargate = true
|
|
fargate_capacity_providers = {
|
|
FARGATE = {
|
|
default_capacity_provider_strategy = {
|
|
weight = 50
|
|
}
|
|
}
|
|
FARGATE_SPOT = {
|
|
default_capacity_provider_strategy = {
|
|
weight = 50
|
|
}
|
|
}
|
|
}
|
|
tags = {}
|
|
}
|
|
description = "The config for the terraform-aws-modules/ecs/aws module. For published KMS blocks, legacy `enabled` is deprecated and still accepted; prefer `cmk_enabled`."
|
|
nullable = false
|
|
}
|
|
|
|
variable "fleet_config" {
|
|
type = object({
|
|
task_mem = optional(number, null)
|
|
task_cpu = optional(number, null)
|
|
ephemeral_storage = optional(object({
|
|
size_in_gib = number
|
|
}), null)
|
|
mem = optional(number, 4096)
|
|
cpu = optional(number, 512)
|
|
pid_mode = optional(string, null)
|
|
command = optional(list(string), null)
|
|
private_key_delivery_method = optional(string, "ecs")
|
|
image = optional(string, "fleetdm/fleet:v4.90.0")
|
|
family = optional(string, "fleet")
|
|
sidecars = optional(list(any), [])
|
|
depends_on = optional(list(any), [])
|
|
mount_points = optional(list(any), [])
|
|
volumes = optional(list(any), [])
|
|
extra_environment_variables = optional(map(string), {})
|
|
extra_iam_policies = optional(list(string), [])
|
|
extra_execution_iam_policies = optional(list(string), [])
|
|
extra_secrets = optional(map(string), {})
|
|
security_group_name = optional(string, "fleet")
|
|
iam_role_arn = optional(string, null)
|
|
repository_credentials = optional(string, "")
|
|
private_key_secret_arn = optional(string, null)
|
|
private_key_secret_name = optional(string, "fleet-server-private-key")
|
|
private_key_secret_kms = optional(object({
|
|
cmk_enabled = optional(bool, null)
|
|
enabled = optional(bool, null)
|
|
kms_key_arn = optional(string, null)
|
|
kms_alias = optional(string, "fleet-server-private-key")
|
|
extra_kms_policies = optional(list(any), [])
|
|
}), {
|
|
cmk_enabled = null
|
|
enabled = null
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-server-private-key"
|
|
extra_kms_policies = []
|
|
})
|
|
fargate_ephemeral_storage_kms = optional(object({
|
|
cmk_enabled = optional(bool, null)
|
|
enabled = optional(bool, null)
|
|
kms_key_arn = optional(string, null)
|
|
kms_alias = optional(string, "fleet-fargate-ephemeral-storage")
|
|
extra_kms_policies = optional(list(any), [])
|
|
}), {
|
|
cmk_enabled = null
|
|
enabled = null
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-fargate-ephemeral-storage"
|
|
extra_kms_policies = []
|
|
})
|
|
server_tls_enabled = optional(bool, false)
|
|
service = optional(object({
|
|
name = optional(string, "fleet")
|
|
}), {
|
|
name = "fleet"
|
|
})
|
|
database = optional(object({
|
|
password_secret_arn = optional(string, null)
|
|
password_secret_kms_key_arn = optional(string, null)
|
|
user = optional(string, null)
|
|
database = optional(string, null)
|
|
address = optional(string, null)
|
|
rr_address = optional(string, null)
|
|
}), {
|
|
password_secret_arn = null
|
|
password_secret_kms_key_arn = null
|
|
user = null
|
|
database = null
|
|
address = null
|
|
rr_address = null
|
|
})
|
|
redis = optional(object({
|
|
address = string
|
|
use_tls = optional(bool, true)
|
|
}), {
|
|
address = null
|
|
use_tls = true
|
|
})
|
|
awslogs = optional(object({
|
|
name = optional(string, null)
|
|
region = optional(string, null)
|
|
create = optional(bool, true)
|
|
prefix = optional(string, "fleet")
|
|
retention = optional(number, 5)
|
|
kms = optional(object({
|
|
cmk_enabled = optional(bool, null)
|
|
enabled = optional(bool, null)
|
|
kms_key_arn = optional(string, null)
|
|
kms_alias = optional(string, "fleet-application-logs")
|
|
extra_kms_policies = optional(list(any), [])
|
|
}), {
|
|
cmk_enabled = null
|
|
enabled = null
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-application-logs"
|
|
extra_kms_policies = []
|
|
})
|
|
}), {
|
|
name = null
|
|
region = null
|
|
create = true
|
|
prefix = "fleet"
|
|
retention = 5
|
|
kms = {
|
|
cmk_enabled = null
|
|
enabled = null
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-application-logs"
|
|
extra_kms_policies = []
|
|
}
|
|
})
|
|
loadbalancer = optional(object({
|
|
arn = string
|
|
}), {
|
|
arn = null
|
|
})
|
|
extra_load_balancers = optional(list(any), [])
|
|
networking = optional(object({
|
|
subnets = optional(list(string), null)
|
|
security_groups = optional(list(string), null)
|
|
ingress_sources = optional(object({
|
|
cidr_blocks = optional(list(string), [])
|
|
ipv6_cidr_blocks = optional(list(string), [])
|
|
security_groups = optional(list(string), [])
|
|
prefix_list_ids = optional(list(string), [])
|
|
}), {
|
|
cidr_blocks = []
|
|
ipv6_cidr_blocks = []
|
|
security_groups = []
|
|
prefix_list_ids = []
|
|
})
|
|
assign_public_ip = optional(bool, false)
|
|
}), {
|
|
subnets = null
|
|
security_groups = null
|
|
ingress_sources = {
|
|
cidr_blocks = []
|
|
ipv6_cidr_blocks = []
|
|
security_groups = []
|
|
prefix_list_ids = []
|
|
}
|
|
assign_public_ip = false
|
|
})
|
|
autoscaling = optional(object({
|
|
max_capacity = optional(number, 5)
|
|
min_capacity = optional(number, 1)
|
|
memory_tracking_target_value = optional(number, 80)
|
|
cpu_tracking_target_value = optional(number, 80)
|
|
}), {
|
|
max_capacity = 5
|
|
min_capacity = 1
|
|
memory_tracking_target_value = 80
|
|
cpu_tracking_target_value = 80
|
|
})
|
|
iam = optional(object({
|
|
role = optional(object({
|
|
name = optional(string, "fleet-role")
|
|
policy_name = optional(string, "fleet-iam-policy")
|
|
}), {
|
|
name = "fleet-role"
|
|
policy_name = "fleet-iam-policy"
|
|
})
|
|
execution = optional(object({
|
|
name = optional(string, "fleet-execution-role")
|
|
policy_name = optional(string, "fleet-execution-role")
|
|
}), {
|
|
name = "fleet-execution-role"
|
|
policy_name = "fleet-iam-policy-execution"
|
|
})
|
|
}), {
|
|
name = "fleetdm-execution-role"
|
|
})
|
|
software_installers = optional(object({
|
|
create_bucket = optional(bool, true)
|
|
bucket_name = optional(string, null)
|
|
bucket_prefix = optional(string, "fleet-software-installers-")
|
|
s3_object_prefix = optional(string, "")
|
|
cloudfront_distribution_arn = optional(string, null)
|
|
enable_bucket_versioning = optional(bool, false)
|
|
expire_noncurrent_versions = optional(bool, true)
|
|
noncurrent_version_expiration_days = optional(number, 30)
|
|
create_kms_key = optional(bool, false)
|
|
kms_key_arn = optional(string, null)
|
|
kms_alias = optional(string, "fleet-software-installers")
|
|
extra_kms_policies = optional(list(any), [])
|
|
tags = optional(map(string), {})
|
|
}), {
|
|
create_bucket = true
|
|
bucket_name = null
|
|
bucket_prefix = "fleet-software-installers-"
|
|
s3_object_prefix = ""
|
|
cloudfront_distribution_arn = null
|
|
enable_bucket_versioning = false
|
|
expire_noncurrent_versions = true
|
|
noncurrent_version_expiration_days = 30
|
|
create_kms_key = false
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-software-installers"
|
|
extra_kms_policies = []
|
|
tags = {}
|
|
})
|
|
})
|
|
default = {
|
|
task_mem = null
|
|
task_cpu = null
|
|
ephemeral_storage = null
|
|
mem = 4096
|
|
cpu = 512
|
|
pid_mode = null
|
|
command = null
|
|
private_key_delivery_method = "ecs"
|
|
image = "fleetdm/fleet:v4.90.0"
|
|
family = "fleet"
|
|
sidecars = []
|
|
depends_on = []
|
|
volumes = []
|
|
mount_points = []
|
|
extra_environment_variables = {}
|
|
extra_iam_policies = []
|
|
extra_execution_iam_policies = []
|
|
extra_secrets = {}
|
|
security_groups = null
|
|
security_group_name = "fleet"
|
|
iam_role_arn = null
|
|
repository_credentials = ""
|
|
private_key_secret_arn = null
|
|
private_key_secret_name = "fleet-server-private-key"
|
|
private_key_secret_kms = {
|
|
cmk_enabled = null
|
|
enabled = null
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-server-private-key"
|
|
extra_kms_policies = []
|
|
}
|
|
fargate_ephemeral_storage_kms = {
|
|
cmk_enabled = null
|
|
enabled = null
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-fargate-ephemeral-storage"
|
|
extra_kms_policies = []
|
|
}
|
|
server_tls_enabled = false
|
|
service = {
|
|
name = "fleet"
|
|
}
|
|
database = {
|
|
password_secret_arn = null
|
|
user = null
|
|
database = null
|
|
address = null
|
|
rr_address = null
|
|
}
|
|
redis = {
|
|
address = null
|
|
use_tls = true
|
|
}
|
|
awslogs = {
|
|
name = null
|
|
region = null
|
|
create = true
|
|
prefix = "fleet"
|
|
retention = 5
|
|
kms = {
|
|
cmk_enabled = null
|
|
enabled = null
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-application-logs"
|
|
extra_kms_policies = []
|
|
}
|
|
}
|
|
loadbalancer = {
|
|
arn = null
|
|
}
|
|
extra_load_balancers = []
|
|
networking = {
|
|
subnets = null
|
|
security_groups = null
|
|
ingress_sources = {
|
|
cidr_blocks = []
|
|
ipv6_cidr_blocks = []
|
|
security_groups = []
|
|
prefix_list_ids = []
|
|
}
|
|
assign_public_ip = false
|
|
}
|
|
autoscaling = {
|
|
max_capacity = 5
|
|
min_capacity = 1
|
|
memory_tracking_target_value = 80
|
|
cpu_tracking_target_value = 80
|
|
}
|
|
iam = {
|
|
role = {
|
|
name = "fleet-role"
|
|
policy_name = "fleet-iam-policy"
|
|
}
|
|
execution = {
|
|
name = "fleet-execution-role"
|
|
policy_name = "fleet-iam-policy-execution"
|
|
}
|
|
}
|
|
software_installers = {
|
|
create_bucket = true
|
|
bucket_name = null
|
|
bucket_prefix = "fleet-software-installers-"
|
|
s3_object_prefix = ""
|
|
cloudfront_distribution_arn = null
|
|
enable_bucket_versioning = false
|
|
expire_noncurrent_versions = true
|
|
noncurrent_version_expiration_days = 30
|
|
create_kms_key = false
|
|
kms_key_arn = null
|
|
kms_alias = "fleet-software-installers"
|
|
extra_kms_policies = []
|
|
tags = {}
|
|
}
|
|
}
|
|
validation {
|
|
condition = contains(["ecs", "iam"], var.fleet_config.private_key_delivery_method)
|
|
error_message = "fleet_config.private_key_delivery_method must be either \"ecs\" or \"iam\"."
|
|
}
|
|
description = "The configuration object for Fleet itself. Fields that default to null will have their respective resources created if not specified. For published KMS blocks, legacy `enabled` is deprecated and still accepted; prefer `cmk_enabled`."
|
|
nullable = false
|
|
}
|
|
|
|
variable "migration_config" {
|
|
type = object({
|
|
mem = number
|
|
cpu = number
|
|
})
|
|
description = "The configuration object for Fleet's migration task."
|
|
nullable = false
|
|
default = {
|
|
mem = 2048
|
|
cpu = 1024
|
|
}
|
|
}
|
|
|
|
variable "alb_config" {
|
|
type = object({
|
|
# Set enabled = false to skip creating the ALB entirely (cost savings).
|
|
# In that case the Fleet ECS service is exposed directly via its task
|
|
# public IP (fleet_config.networking.assign_public_ip must be true and
|
|
# the VPC should have no private subnets so tasks land in public ones).
|
|
enabled = optional(bool, true)
|
|
name = optional(string, "fleet")
|
|
security_groups = optional(list(string), [])
|
|
access_logs = optional(map(string), {})
|
|
allowed_cidrs = optional(list(string), ["0.0.0.0/0"])
|
|
allowed_ipv6_cidrs = optional(list(string), ["::/0"])
|
|
egress_cidrs = optional(list(string), ["0.0.0.0/0"])
|
|
egress_ipv6_cidrs = optional(list(string), ["::/0"])
|
|
fleet_target_group = optional(object({
|
|
protocol = optional(string, "HTTP")
|
|
port = optional(number, 80)
|
|
target_type = optional(string, "ip")
|
|
create_attachment = optional(bool, false)
|
|
health_check = optional(object({
|
|
path = optional(string, "/healthz")
|
|
matcher = optional(string, "200")
|
|
port = optional(string)
|
|
timeout = optional(number, 10)
|
|
interval = optional(number, 15)
|
|
healthy_threshold = optional(number, 5)
|
|
unhealthy_threshold = optional(number, 5)
|
|
}), {})
|
|
}), {})
|
|
extra_target_groups = optional(any, [])
|
|
https_listener_rules = optional(any, [])
|
|
https_overrides = optional(any, {})
|
|
xff_header_processing_mode = optional(string, null)
|
|
tls_policy = optional(string, "ELBSecurityPolicy-TLS13-1-2-2021-06")
|
|
idle_timeout = optional(number, 905)
|
|
internal = optional(bool, false)
|
|
enable_deletion_protection = optional(bool, false)
|
|
})
|
|
default = {}
|
|
}
|