SREFTP-4733 - Update code from upstream changes, include fix for parameter group versioning bug

.pre-commit-config.yaml

@@ -1,10 +1,10 @@
 repos:
 - repo: git://github.com/antonbabenko/pre-commit-terraform
-  rev: v1.21.0
+  rev: v1.30.0
   hooks:
     - id: terraform_fmt
     - id: terraform_docs
 - repo: git://github.com/pre-commit/pre-commit-hooks
-  rev: v2.4.0
+  rev: v3.1.0
   hooks:
     - id: check-merge-conflict

README.md

@@ -11,14 +11,13 @@ This module
 
 Terraform 0.12. Pin module version to `~> v2.0`. Submit pull-requests to `master` branch.
 
-Terraform 0.11. Pin module version to `~> v1.0`.
+Terraform 0.11. Pin module version to `~> v1.0`. Submit pull-requests to `terraform011` branch.
 
 ## Usage
 
 ```hcl
 module "redis" {
-  source  = "github.com/terraform-community-modules/tf_aws_elasticache_redis.git"
-  version = "~> 2.0"
+  source  = "github.com/terraform-community-modules/tf_aws_elasticache_redis.git?ref=v2.2.0"
 
   env            = "dev"
   name           = "thtest"
@@ -41,41 +40,59 @@ module "redis" {
 ```
 
 <!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+## Requirements
+
+No requirements.
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| aws | n/a |
+| random | n/a |
+
 ## Inputs
 
 | Name | Description | Type | Default | Required |
-|------|-------------|:----:|:-----:|:-----:|
-| alarm\_actions |  | list | n/a | yes |
-| alarm\_cpu\_threshold | These vars would be used by cloudwatch.tf and should be uncommented if we decide to use them. | string | `"75"` | no |
-| alarm\_memory\_threshold |  | string | `"10000000"` | no |
-| allowed\_cidr | A list of Security Group ID's to allow access to. | list(string) | `[ "127.0.0.1/32" ]` | no |
-| allowed\_security\_groups | A list of Security Group ID's to allow access to. | list(string) | `[]` | no |
-| apply\_immediately | Specifies whether any modifications are applied immediately, or during the next maintenance window. Default is false. | bool | `"false"` | no |
-| env | env to deploy into, should typically dev/staging/prod | string | n/a | yes |
-| name | Name for the Redis replication group i.e. UserObject | string | n/a | yes |
-| redis\_clusters | Number of Redis cache clusters (nodes) to create | string | n/a | yes |
-| redis\_failover |  | bool | `"false"` | no |
-| redis\_maintenance\_window | Specifies the weekly time range for when maintenance on the cache cluster is performed. The format is ddd:hh24:mi-ddd:hh24:mi (24H Clock UTC). The minimum maintenance window is a 60 minute period | string | `"fri:08:00-fri:09:00"` | no |
-| redis\_node\_type | Instance type to use for creating the Redis cache clusters | string | `"cache.m3.medium"` | no |
-| redis\_parameters | additional parameters modifyed in parameter group | list(map(any)) | `[]` | no |
-| redis\_port |  | number | `"6379"` | no |
-| redis\_snapshot\_retention\_limit | The number of days for which ElastiCache will retain automatic cache cluster snapshots before deleting them. For example, if you set SnapshotRetentionLimit to 5, then a snapshot that was taken today will be retained for 5 days before being deleted. If the value of SnapshotRetentionLimit is set to zero (0), backups are turned off. Please note that setting a snapshot_retention_limit is not supported on cache.t1.micro or cache.t2.* cache nodes | number | `"0"` | no |
-| redis\_snapshot\_window | The daily time range (in UTC) during which ElastiCache will begin taking a daily snapshot of your cache cluster. The minimum snapshot window is a 60 minute period | string | `"06:30-07:30"` | no |
-| redis\_version | Redis version to use, defaults to 3.2.10 | string | `"3.2.10"` | no |
-| subnets | List of VPC Subnet IDs for the cache subnet group | list(string) | n/a | yes |
-| tags | Tags for redis nodes | map(string) | `{}` | no |
-| vpc\_id | VPC ID | string | n/a | yes |
+|------|-------------|------|---------|:--------:|
+| allowed\_cidr | A list CIDRs to allow access to. | `list(string)` | <pre>[<br>  "127.0.0.1/32"<br>]</pre> | no |
+| allowed\_security\_groups | A list of Security Group ID's to allow access to. | `list(string)` | `[]` | no |
+| apply\_immediately | Specifies whether any modifications are applied immediately, or during the next maintenance window. Default is false. | `bool` | `false` | no |
+| at\_rest\_encryption\_enabled | Whether to enable encryption at rest | `bool` | `false` | no |
+| auth\_token | The password used to access a password protected server. Can be specified only if transit\_encryption\_enabled = true. If specified must contain from 16 to 128 alphanumeric characters or symbols | `string` | `null` | no |
+| auto\_minor\_version\_upgrade | Specifies whether a minor engine upgrades will be applied automatically to the underlying Cache Cluster instances during the maintenance window | `bool` | `true` | no |
+| availability\_zones | A list of EC2 availability zones in which the replication group's cache clusters will be created. The order of the availability zones in the list is not important | `list(string)` | `[]` | no |
+| env | env to deploy into, should typically dev/staging/prod | `string` | n/a | yes |
+| kms\_key\_id | The ARN of the key that you wish to use if encrypting at rest. If not supplied, uses service managed encryption. Can be specified only if at\_rest\_encryption\_enabled = true | `string` | `""` | no |
+| name | Name for the Redis replication group i.e. UserObject | `string` | n/a | yes |
+| notification\_topic\_arn | An Amazon Resource Name (ARN) of an SNS topic to send ElastiCache notifications to. Example: arn:aws:sns:us-east-1:012345678999:my\_sns\_topic | `string` | `""` | no |
+| redis\_clusters | Number of Redis cache clusters (nodes) to create | `string` | n/a | yes |
+| redis\_failover | n/a | `bool` | `false` | no |
+| redis\_maintenance\_window | Specifies the weekly time range for when maintenance on the cache cluster is performed. The format is ddd:hh24:mi-ddd:hh24:mi (24H Clock UTC). The minimum maintenance window is a 60 minute period | `string` | `"fri:08:00-fri:09:00"` | no |
+| redis\_node\_type | Instance type to use for creating the Redis cache clusters | `string` | `"cache.m3.medium"` | no |
+| redis\_parameters | additional parameters modifyed in parameter group | `list(map(any))` | `[]` | no |
+| redis\_port | n/a | `number` | `6379` | no |
+| redis\_snapshot\_retention\_limit | The number of days for which ElastiCache will retain automatic cache cluster snapshots before deleting them. For example, if you set SnapshotRetentionLimit to 5, then a snapshot that was taken today will be retained for 5 days before being deleted. If the value of SnapshotRetentionLimit is set to zero (0), backups are turned off. Please note that setting a snapshot\_retention\_limit is not supported on cache.t1.micro or cache.t2.\* cache nodes | `number` | `0` | no |
+| redis\_snapshot\_window | The daily time range (in UTC) during which ElastiCache will begin taking a daily snapshot of your cache cluster. The minimum snapshot window is a 60 minute period | `string` | `"06:30-07:30"` | no |
+| redis\_version | Redis version to use, defaults to 3.2.10 | `string` | `"3.2.10"` | no |
+| security\_group\_names | A list of cache security group names to associate with this replication group | `list(string)` | `[]` | no |
+| snapshot\_arns | A single-element string list containing an Amazon Resource Name (ARN) of a Redis RDB snapshot file stored in Amazon S3. Example: arn:aws:s3:::my\_bucket/snapshot1.rdb | `list(string)` | `[]` | no |
+| snapshot\_name | The name of a snapshot from which to restore data into the new node group. Changing the snapshot\_name forces a new resource | `string` | `""` | no |
+| subnets | List of VPC Subnet IDs for the cache subnet group | `list(string)` | n/a | yes |
+| tags | Tags for redis nodes | `map(string)` | `{}` | no |
+| transit\_encryption\_enabled | Whether to enable encryption in transit. Requires 3.2.6 or >=4.0 redis\_version | `bool` | `false` | no |
+| vpc\_id | VPC ID | `string` | n/a | yes |
 
 ## Outputs
 
 | Name | Description |
 |------|-------------|
-| endpoint |  |
-| id |  |
-| parameter\_group |  |
-| port |  |
-| redis\_security\_group\_id |  |
-| redis\_subnet\_group\_name |  |
+| endpoint | n/a |
+| id | n/a |
+| parameter\_group | n/a |
+| port | n/a |
+| redis\_security\_group\_id | n/a |
+| redis\_subnet\_group\_name | n/a |
 
 <!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
 

cloudwatch.tf

@@ -6,7 +6,7 @@
 resource "aws_cloudwatch_metric_alarm" "cache_cpu" {
   count = "${var.redis_clusters}"
 
-  alarm_name          = "alarm-${var.name}-${data.aws_vpc.vpc.tags["Name"]}-CacheCluster00${count.index + 1}CPUUtilization"
+  alarm_name          = "alarm-${var.name}-${local.vpc_name}-CacheCluster00${count.index + 1}CPUUtilization"
   alarm_description   = "Redis cluster CPU utilization"
   comparison_operator = "GreaterThanThreshold"
   evaluation_periods  = "1"
@@ -27,7 +27,7 @@ resource "aws_cloudwatch_metric_alarm" "cache_cpu" {
 resource "aws_cloudwatch_metric_alarm" "cache_memory" {
   count = "${var.redis_clusters}"
 
-  alarm_name          = "alarm-${var.name}-${data.aws_vpc.vpc.tags["Name"]}-CacheCluster00${count.index + 1}FreeableMemory"
+  alarm_name          = "alarm-${var.name}-${local.vpc_name}-CacheCluster00${count.index + 1}FreeableMemory"
   alarm_description   = "Redis cluster freeable memory"
   comparison_operator = "LessThanThreshold"
   evaluation_periods  = "1"

main.tf

@@ -2,6 +2,12 @@ data "aws_vpc" "vpc" {
   id = var.vpc_id
 }
 
+locals {
+  vpc_name = lookup(data.aws_vpc.vpc.tags, "Name", var.vpc_id)
+  major_redis_version = parseint(substr(var.redis_version, 0,1),10)
+  parameter_group_family = local.major_redis_version < 6 ?  "redis${replace(var.redis_version, "/\\.[\\d]+$/", "")}" : local.major_redis_version == 6 ? "redis${replace(var.redis_version, "/\\.[\\d|x]+$/", "")}.x" : "redis${local.major_redis_version}"
+  }
+
 resource "random_id" "salt" {
   keepers = {
     redis_version = "${var.redis_version}"
@@ -11,30 +17,41 @@ resource "random_id" "salt" {
 
 resource "aws_elasticache_replication_group" "redis" {
   replication_group_id          = format("%.20s", "${var.name}-${var.env}")
-  replication_group_description = "Terraform-managed ElastiCache replication group for ${var.name}-${var.env}-${data.aws_vpc.vpc.tags["Name"]}"
+  replication_group_description = "Terraform-managed ElastiCache replication group for ${var.name}-${var.env}-${local.vpc_name}"
   number_cache_clusters         = var.redis_clusters
   node_type                     = var.redis_node_type
   automatic_failover_enabled    = var.redis_failover
+  auto_minor_version_upgrade    = var.auto_minor_version_upgrade
+  availability_zones            = var.availability_zones
   multi_az_enabled              = var.multi_az_enabled
+  engine                        = "redis"
+  at_rest_encryption_enabled    = var.at_rest_encryption_enabled
+  kms_key_id                    = var.kms_key_id
+  transit_encryption_enabled    = var.transit_encryption_enabled
+  auth_token                    = var.transit_encryption_enabled ? var.auth_token : null
   engine_version                = var.redis_version
   port                          = var.redis_port
   parameter_group_name          = aws_elasticache_parameter_group.redis_parameter_group.id
   subnet_group_name             = aws_elasticache_subnet_group.redis_subnet_group.id
+  security_group_names          = var.security_group_names
   security_group_ids            = [aws_security_group.redis_security_group.id]
+  snapshot_arns                 = var.snapshot_arns
+  snapshot_name                 = var.snapshot_name
   apply_immediately             = var.apply_immediately
   maintenance_window            = var.redis_maintenance_window
+  notification_topic_arn        = var.notification_topic_arn
   snapshot_window               = var.redis_snapshot_window
   snapshot_retention_limit      = var.redis_snapshot_retention_limit
-  tags                          = merge(map("Name", format("tf-elasticache-%s-%s", var.name, lookup(data.aws_vpc.vpc.tags, "Name", ""))), var.tags)
+  tags                          = merge(tomap({"Name" = format("tf-elasticache-%s-%s", var.name, local.vpc_name)}), var.tags)
 }
 
 resource "aws_elasticache_parameter_group" "redis_parameter_group" {
-  name = replace(format("%.255s", lower(replace("tf-redis-${var.name}-${var.env}-${data.aws_vpc.vpc.tags["Name"]}-${random_id.salt.hex}", "_", "-"))), "/\\s/", "-")
+  name = replace(format("%.255s", lower(replace("tf-redis-${var.name}-${var.env}-${local.vpc_name}-${random_id.salt.hex}", "_", "-"))), "/\\s/", "-")
 
-  description = "Terraform-managed ElastiCache parameter group for ${var.name}-${var.env}-${data.aws_vpc.vpc.tags["Name"]}"
+  description = "Terraform-managed ElastiCache parameter group for ${var.name}-${var.env}-${local.vpc_name}"
 
   # Strip the patch version from redis_version var
-  family = "redis${replace(var.redis_version, "/\\.[\\d]+$/", "")}"
+  family = local.parameter_group_family
   dynamic "parameter" {
     for_each = var.redis_parameters
     content {
@@ -49,6 +66,6 @@ resource "aws_elasticache_parameter_group" "redis_parameter_group" {
 }
 
 resource "aws_elasticache_subnet_group" "redis_subnet_group" {
-  name       = replace(format("%.255s", lower(replace("tf-redis-${var.name}-${var.env}-${data.aws_vpc.vpc.tags["Name"]}", "_", "-"))), "/\\s/", "-")
+  name       = replace(format("%.255s", lower(replace("tf-redis-${var.name}-${var.env}-${local.vpc_name}", "_", "-"))), "/\\s/", "-")
   subnet_ids = var.subnets
 }

security_groups.tf

@@ -1,10 +1,10 @@
 resource "aws_security_group" "redis_security_group" {
-  name        = format("%.255s", "tf-sg-ec-${var.name}-${var.env}-${data.aws_vpc.vpc.tags["Name"]}")
-  description = "Terraform-managed ElastiCache security group for ${var.name}-${var.env}-${data.aws_vpc.vpc.tags["Name"]}"
+  name        = format("%.255s", "tf-sg-ec-${var.name}-${var.env}-${local.vpc_name}")
+  description = "Terraform-managed ElastiCache security group for ${var.name}-${var.env}-${local.vpc_name}"
   vpc_id      = data.aws_vpc.vpc.id
 
   tags = {
-    Name = "tf-sg-ec-${var.name}-${var.env}-${data.aws_vpc.vpc.tags["Name"]}"
+    Name = "tf-sg-ec-${var.name}-${var.env}-${local.vpc_name}"
   }
 }
 

variables.tf

@@ -122,3 +122,63 @@ variable "tags" {
   type        = map(string)
   default     = {}
 }
+
+variable "auto_minor_version_upgrade" {
+  description = "Specifies whether a minor engine upgrades will be applied automatically to the underlying Cache Cluster instances during the maintenance window"
+  type        = bool
+  default     = true
+}
+
+variable "availability_zones" {
+  description = "A list of EC2 availability zones in which the replication group's cache clusters will be created. The order of the availability zones in the list is not important"
+  type        = list(string)
+  default     = []
+}
+
+variable "at_rest_encryption_enabled" {
+  description = "Whether to enable encryption at rest"
+  type        = bool
+  default     = false
+}
+
+variable "kms_key_id" {
+  description = "The ARN of the key that you wish to use if encrypting at rest. If not supplied, uses service managed encryption. Can be specified only if at_rest_encryption_enabled = true"
+  type        = string
+  default     = ""
+}
+
+variable "transit_encryption_enabled" {
+  description = "Whether to enable encryption in transit. Requires 3.2.6 or >=4.0 redis_version"
+  type        = bool
+  default     = false
+}
+
+variable "auth_token" {
+  description = "The password used to access a password protected server. Can be specified only if transit_encryption_enabled = true. If specified must contain from 16 to 128 alphanumeric characters or symbols"
+  type        = string
+  default     = null
+}
+
+variable "security_group_names" {
+  description = "A list of cache security group names to associate with this replication group"
+  type        = list(string)
+  default     = []
+}
+
+variable "snapshot_arns" {
+  description = "A single-element string list containing an Amazon Resource Name (ARN) of a Redis RDB snapshot file stored in Amazon S3. Example: arn:aws:s3:::my_bucket/snapshot1.rdb"
+  type        = list(string)
+  default     = []
+}
+
+variable "snapshot_name" {
+  description = " The name of a snapshot from which to restore data into the new node group. Changing the snapshot_name forces a new resource"
+  type        = string
+  default     = ""
+}
+
+variable "notification_topic_arn" {
+  description = "An Amazon Resource Name (ARN) of an SNS topic to send ElastiCache notifications to. Example: arn:aws:sns:us-east-1:012345678999:my_sns_topic"
+  type        = string
+  default     = ""
+}