module.yml

---
# Copyright 2018 widdix GmbH
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
AWSTemplateFormatVersion: '2010-09-09'
Description: 'cfn-modules: AWS RDS Aurora Serverless PostgreSQL cluster'
# cfn-modules:implements(ExposeName, ExposeDnsName)
Parameters:
  VpcModule:
    Description: 'Stack name of vpc module.'
    Type: String
  ClientSgModule:
    Description: 'Stack name of client-sg module.'
    Type: String
  KmsKeyModule:
    Description: 'Stack name of kms-key module (gnored when DBSnapshotIdentifier is set, value used from snapshot).'
    Type: String
    Default: ''
  BastionModule:
    Description: 'Optional but recommended stack name of module implementing Bastion.'
    Type: String
    Default: ''
  HostedZoneModule:
    Description: 'Optional stack name of module implementing HostedZone.'
    Type: String
    Default: ''
  AlertingModule:
    Description: 'Optional but recommended stack name of alerting module.'
    Type: String
    Default: ''
  SecretModule:
    Description: 'Optional but recommended stack name of secret module.'
    Type: String
    Default: ''
  Engine:
    Description: 'DEPRECATED since v1, removed in v3, value is ignored!'
    Type: String
    AllowedValues: [aurora]
    Default: aurora
  DBSnapshotIdentifier:
    Description: 'Optional identifier for the DB cluster snapshot from which you want to restore (leave blank to create an empty cluster).'
    Type: String
    Default: ''
  DBName:
    Description: 'Name of the database (ignored when DBSnapshotIdentifier is set, value used from snapshot).'
    Type: String
    Default: ''
  DBBackupRetentionPeriod:
    Description: 'The number of days to keep snapshots of the cluster.'
    Type: Number
    MinValue: 1
    MaxValue: 35
    Default: 30
  DBMasterUsername:
    Description: 'The master user name for the DB instance (ignored when DBSnapshotIdentifier is set, value used from snapshot).'
    Type: 'String'
    Default: master
  DBMasterUserPassword:
    Description: 'The master password for the DB instance (ignored when DBSnapshotIdentifier is set, value used from snapshot; also ignored if SecretModule is set).'
    Type: String
    NoEcho: true
    Default: ''
  DBClusterIdentifier:
    Description: 'Optional name used to identify DB Cluster.'
    Type: String
    Default: ''
  DBClusterParameterGroupName:
    Description: 'Optional name of an existing DB parameter group.'
    Type: String
    Default: ''
  SubDomainNameWithDot:
    Description: 'Name that is used to create the DNS entry with trailing dot, e.g. §{SubDomainNameWithDot}§{HostedZoneName}. Leave blank for naked (or apex and bare) domain. Requires HostedZoneModule parameter!'
    Type: String
    Default: 'aurora.'
  PreferredBackupWindow:
    Description: 'IGNORED BECAUSE OF A BUG IN CLOUDFORMATION! VALUE WILL APPLY IN THE FUTURE! The daily time range in UTC during which you want to create automated backups.' # TODO remove uppercase warning
    Type: String
    Default: '09:54-10:24'
  PreferredMaintenanceWindow:
    Description: IGNORED BECAUSE OF A BUG IN CLOUDFORMATION! VALUE WILL APPLY IN THE FUTURE! The weekly time range (in UTC) during which system maintenance can occur. # TODO remove uppercase warning
    Type: String
    Default: 'sat:07:00-sat:07:30'
  AutoPause:
    Description: 'Enable automatic pause for a Serverless Aurora cluster. A cluster can be paused only when it has no connections. If a cluster is paused for more than seven days, the cluster might be backed up with a snapshot. In this case, the cluster is restored when there is a request to connect to it.'
    Type: String
    AllowedValues: ['true', 'false']
    Default: 'true'
  SecondsUntilAutoPause:
    Description: 'The time, in seconds, before a Serverless Aurora cluster is paused.'
    Type: Number
    MinValue: 1
    MaxValue: 86400
    Default: 300
  MaxCapacity:
    Description: 'The maximum capacity units for a Serverless Aurora cluster.'
    Type: String
    AllowedValues: [2, 4, 8, 16, 32, 64, 192, 384]
    Default: 2
  MinCapacity:
    Description: 'The minimum capacity units for a Serverless Aurora cluster.'
    Type: String
    AllowedValues: [2, 4, 8, 16, 32, 64, 192, 384]
    Default: 2
  EngineVersion:
    Description: 'Aurora Serverless PostgreSQL version.'
    Type: String
    Default: '13.12'
    AllowedValues: ['13.12'] # aws rds describe-db-engine-versions --engine aurora-postgresql --query 'DBEngineVersions[?contains(SupportedEngineModes,`serverless`)]'
  EnableDataApi:
    Description: 'Enable the Data API (https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/data-api.html).'
    Type: String
    AllowedValues: ['true', 'false']
    Default: 'true'
Mappings:
  EngineVersionMap:
    '13.12':
      ClusterParameterGroupFamily: 'aurora-postgresql13'
Conditions:
  HasBastionModule: !Not [!Equals [!Ref BastionModule, '']]
  HasHostedZoneModule: !Not [!Equals [!Ref HostedZoneModule, '']]
  HasAlertingModule: !Not [!Equals [!Ref AlertingModule, '']]
  HasSecretModule: !Not [!Equals [!Ref SecretModule, '']]
  HasNotDBSnapshotIdentifier: !Equals [!Ref DBSnapshotIdentifier, '']
  HasDBSnapshotIdentifier: !Not [!Condition HasNotDBSnapshotIdentifier]
  HasDBClusterIdentifier: !Not [!Equals [!Ref DBClusterIdentifier, '']]
  HasDBClusterParameterGroupName: !Not [!Equals [!Ref DBClusterParameterGroupName, '']]
  HasNotDBClusterParameterGroupName: !Not [!Condition HasDBClusterParameterGroupName]
Resources:
  RecordSet:
    Condition: HasHostedZoneModule
    Type: 'AWS::Route53::RecordSet'
    Properties:
      HostedZoneId: {'Fn::ImportValue': !Sub '${HostedZoneModule}-Id'}
      Name: !Sub
      - '${SubDomainNameWithDot}${HostedZoneName}'
      - SubDomainNameWithDot: !Ref SubDomainNameWithDot
        HostedZoneName: {'Fn::ImportValue': !Sub '${HostedZoneModule}-Name'}
      ResourceRecords:
      - !GetAtt 'DBCluster.Endpoint.Address'
      TTL: 60
      Type: CNAME
  SecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: !Ref 'AWS::StackName'
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 5432
        ToPort: 5432
        SourceSecurityGroupId: {'Fn::ImportValue': !Sub '${ClientSgModule}-SecurityGroupId'}
      VpcId: {'Fn::ImportValue': !Sub '${VpcModule}-Id'}
  SecurityGroupInSshFromBastion:
    Condition: HasBastionModule
    Type: 'AWS::EC2::SecurityGroupIngress'
    Properties:
      GroupId: !Ref SecurityGroup
      IpProtocol: tcp
      FromPort: 5432
      ToPort: 5432
      SourceSecurityGroupId: {'Fn::ImportValue': !Sub '${BastionModule}-SecurityGroupId'}
  DBSubnetGroup:
    Type: 'AWS::RDS::DBSubnetGroup'
    Properties:
      DBSubnetGroupDescription: !Ref 'AWS::StackName'
      SubnetIds: !Split [',', {'Fn::ImportValue': !Sub '${VpcModule}-SubnetIdsPrivate'}]
  DBClusterParameterGroup:
    Condition: HasNotDBClusterParameterGroupName
    Type: 'AWS::RDS::DBClusterParameterGroup'
    Properties:
      Description: !Ref 'AWS::StackName'
      Family: !FindInMap [EngineVersionMap, !Ref EngineVersion, ClusterParameterGroupFamily]
      Parameters:
        client_encoding: 'UTF8'
  DBCluster:
    DeletionPolicy: Snapshot # default
    UpdateReplacePolicy: Snapshot
    Type: 'AWS::RDS::DBCluster'
    Properties:
      BackupRetentionPeriod: !Ref DBBackupRetentionPeriod
      DatabaseName: !If [HasDBSnapshotIdentifier, !Ref 'AWS::NoValue', !Ref DBName]
      DBClusterParameterGroupName: !If
      - HasDBClusterParameterGroupName
      - !Ref DBClusterParameterGroupName
      - !Ref DBClusterParameterGroup
      DBSubnetGroupName: !Ref DBSubnetGroup
      EnableHttpEndpoint: !Ref EnableDataApi
      Engine: 'aurora-postgresql'
      EngineVersion: !Ref EngineVersion
      KmsKeyId: !If [HasDBSnapshotIdentifier, !Ref 'AWS::NoValue', {'Fn::ImportValue': !Sub '${KmsKeyModule}-Arn'}]
      MasterUsername: !If [HasDBSnapshotIdentifier, !Ref 'AWS::NoValue', !Ref DBMasterUsername]
      MasterUserPassword: !If [HasDBSnapshotIdentifier, !Ref 'AWS::NoValue', !If [HasSecretModule, !Join ['', ['{{resolve:secretsmanager:', {'Fn::ImportValue': !Sub '${SecretModule}-Arn'}, '}}']], !Ref DBMasterUserPassword]]
      PreferredBackupWindow: !Ref PreferredBackupWindow
      PreferredMaintenanceWindow: !Ref PreferredMaintenanceWindow
      ServerlessV2ScalingConfiguration:
        MaxCapacity: !Ref MaxCapacity
        MinCapacity: !Ref MinCapacity
        # SecondsUntilAutoPause: !Ref SecondsUntilAutoPause TODO Waiting for CloudFormation support
      SnapshotIdentifier: !If [HasDBSnapshotIdentifier, !Ref DBSnapshotIdentifier, !Ref 'AWS::NoValue']
      StorageEncrypted: true
      VpcSecurityGroupIds:
      - !Ref SecurityGroup
  ServerlessDBInstance:
    Type: 'AWS::RDS::DBInstance'
    Properties:
      DBClusterIdentifier: !Ref DBCluster
      DBInstanceClass: 'db.serverless'
      Engine: 'aurora-postgresql'
  DBClusterEventSubscription:
    Condition: HasAlertingModule
    Type: 'AWS::RDS::EventSubscription'
    Properties:
      EventCategories:
      - failover
      - failure
      - maintenance
      SnsTopicArn: {'Fn::ImportValue': !Sub '${AlertingModule}-Arn'}
      SourceIds: [!Ref DBCluster]
      SourceType: 'db-cluster'
Outputs:
  ModuleId:
    Value: 'rds-aurora-serverless-postgres'
  ModuleVersion:
    Value: '1.1.0'
  StackName:
    Value: !Ref 'AWS::StackName'
  Name:
    Value: !Ref DBCluster
    Export:
      Name: !Sub '${AWS::StackName}-Name'
  DnsName:
    Value: !GetAtt 'DBCluster.Endpoint.Address'
    Export:
      Name: !Sub '${AWS::StackName}-DNSName'