Skip to content

Adjust admin-login module to handle replica #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 7 commits into
base: main
Choose a base branch
from
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions rds-postgres/admin-login/main.tf
Original file line number Diff line number Diff line change
@@ -8,6 +8,7 @@ module "secret" {
resource_tags = var.tags
trust_tags = var.trust_tags

# initial_value = jsonencode(local.initial_secret_value)
initial_value = jsonencode({
dbname = var.database_name
engine = data.aws_db_instance.this.engine
@@ -40,6 +41,7 @@ module "rotation" {
variables = {
ALTERNATE_USERNAME = coalesce(var.alternate_username, "${var.username}_alt")
PRIMARY_USERNAME = var.username
REPLICA_HOST = can(var.replica_host) ? var.replica_host : ""
}
}

@@ -79,4 +81,15 @@ data "aws_db_instance" "this" {

locals {
full_name = join("-", ["rds-postgres", var.identifier])

# base_value = {
# dbname = var.database_name
# engine = data.aws_db_instance.this.engine
# host = data.aws_db_instance.this.address
# password = var.initial_password
# port = tostring(data.aws_db_instance.this.port)
# username = var.username
# }

# initial_secret_value = can(var.replica_host) ? merge(local.base_value, { replica_host = var.replica_host }) : local.base_value
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removed so that we're passing the replica DB host address in only one way; as an environment variable rather than also as part of the secrets.

}
17 changes: 13 additions & 4 deletions rds-postgres/admin-login/rotation/lambda_function.py
Original file line number Diff line number Diff line change
@@ -13,6 +13,7 @@

ALTERNATE_USERNAME = os.environ['ALTERNATE_USERNAME']
PRIMARY_USERNAME = os.environ['PRIMARY_USERNAME']
REPLICA_HOST = os.environ['REPLICA_HOST']


def lambda_handler(event, context):
@@ -31,7 +32,7 @@ def lambda_handler(event, context):
'username': <required: username>,
'password': <required: password>,
'dbname': <optional: database name, default to 'postgres'>,
'port': <optional: if not specified, default port 5432 will be used>
'port': <optional: if not specified, default port 5432 will be used>,
}

Args:
@@ -126,7 +127,11 @@ def create_secret(service_client, arn, token):
current_dict['password'] = passwd['RandomPassword']

# Add DATABASE_URL to secret
current_dict['DATABASE_URL'] = dict_to_url(current_dict)
current_dict['DATABASE_URL'] = dict_to_url(current_dict, False)

if REPLICA_HOST:
# Add DATABASE_REPLICA_URL to secret
current_dict['DATABASE_REPLICA_URL'] = dict_to_url(current_dict, True)

# Put the secret
service_client.put_secret_value(SecretId=arn, ClientRequestToken=token, SecretString=json.dumps(current_dict), VersionStages=['AWSPENDING'])
@@ -278,7 +283,7 @@ def finish_secret(service_client, arn, token):
service_client.update_secret_version_stage(SecretId=arn, VersionStage="AWSCURRENT", MoveToVersionId=token, RemoveFromVersionId=current_version)
logger.info("finishSecret: Successfully set AWSCURRENT stage to version %s for secret %s." % (token, arn))

def dict_to_url(secret):
def dict_to_url(secret, replica):
"""Reformats connection details as a URL string

Generate a Heroku-style DATABASE_URL with connection details
@@ -289,9 +294,13 @@ def dict_to_url(secret):
Returns:
url: DATABASE_URL-style string
"""
if replica:
host = REPLICA_HOST
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated this rotation script to use the env var REPLICA_HOST, rather than passing the host address of the replica DB in two ways, in response to @jferris's comment here.

else:
host = secret['host']

return "postgres://%s:%s@%s:%s/%s" % (secret['username'],
secret['password'], secret['host'], secret['port'],
secret['password'], host, secret['port'],
secret['dbname'])

def get_connection(secret_dict):
6 changes: 6 additions & 0 deletions rds-postgres/admin-login/variables.tf
Original file line number Diff line number Diff line change
@@ -31,6 +31,12 @@ variable "read_principals" {
default = null
}

variable "replica_host" {
description = "Hostname to use when connecting to the database replica"
type = string
default = null
}

variable "secret_name" {
description = "Override the name for this secret"
type = string