Skip to content

Commit d1db17b

Browse files
TheOneFromNorwaybogsi17
TheOneFromNorway
authored and
bogsi17
committed
Implement dms module to create pre-migration configuration
- Increase max ACU - The migration is quite memory intensive on the target & source DBs - Implement template file - Allow new ECS module access to DB secrets - Include target DB secrets into permission scope for ECS task execution role - Include target DM in existing security group configuration - This simplifies setup as existing security group can simply persist post-migration - Create custom kms key - This is the crucial element needed to allow remote backups of target db - Implement naming convention/strategy for db instance configuration - One locals with for_each loop - Read and write node are in failover configuration so refer to them simply as primary 1 and 2 - Create read instance for the source DB - This is needed for DB failover to reboot instances without downtime - Allows syncing to updated parameter groups as needed for the migration - Update policy with base permissions needed for running deployments via github - Create additional policy document with DMS specific permissions (to be attached to github deployment role)
1 parent 08fc1bc commit d1db17b

13 files changed

+309
-5
lines changed

‎terraform/account/deployment_permissions.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,3 +45,15 @@ resource "aws_iam_role_policy_attachment" "data_replication" {
4545
role = aws_iam_role.data_replication_deploy.name
4646
policy_arn = each.value
4747
}
48+
49+
################ DMS Policies ################
50+
51+
resource "aws_iam_policy" "dms" {
52+
name = "DMSGithubPolicy"
53+
policy = file("resources/iam_policy_DMSGithubPolicy.json")
54+
}
55+
56+
resource "aws_iam_role_policy_attachment" "mavis_dms" {
57+
role = aws_iam_role.mavis_deploy.name
58+
policy_arn = aws_iam_policy.dms.arn
59+
}

‎terraform/account/resources/iam_policy_DMSGithubPolicy.json‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Sid": "Statement1",
6+
"Effect": "Allow",
7+
"Action": [
8+
"dms:CreateDataMigration",
9+
"dms:CreateEndpoint",
10+
"dms:CreateReplicationConfig",
11+
"dms:CreateReplicationInstance",
12+
"dms:CreateReplicationSubnetGroup",
13+
"dms:CreateReplicationTask",
14+
"dms:DeleteEndpoint",
15+
"dms:DeleteReplicationConfig",
16+
"dms:DeleteReplicationInstance",
17+
"dms:DeleteReplicationTask",
18+
"dms:DeleteReplicationSubnetGroup",
19+
"dms:ModifyEndpoint",
20+
"dms:ModifyReplicationConfig",
21+
"dms:ModifyReplicationTask",
22+
"dms:ModifyReplicationInstance",
23+
"dms:ModifyReplicationSubnetGroup"
24+
],
25+
"Resource": ["*"]
26+
}
27+
]
28+
}

‎terraform/account/resources/iam_policy_DeployMavisResources.json‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@
3434
"ec2:CreateSecurityGroup",
3535
"ec2:CreateSubnet",
3636
"ec2:CreateVpc",
37+
"ec2:CreateVpcEndpoint",
3738
"ec2:DeleteFlowLogs",
3839
"ec2:DeleteInternetGateway",
3940
"ec2:DeleteNatGateway",
@@ -42,6 +43,7 @@
4243
"ec2:DeleteSecurityGroup",
4344
"ec2:DeleteSubnet",
4445
"ec2:DeleteVpc",
46+
"ec2:DeleteVpcEndpoints",
4547
"ec2:DetachInternetGateway",
4648
"ec2:DetachNetworkInterface",
4749
"ec2:DisassociateAddress",
@@ -95,12 +97,16 @@
9597
"rds:CreateDBCluster",
9698
"rds:CreateDBInstance",
9799
"rds:CreateDBSubnetGroup",
100+
"rds:CreateDBClusterParameterGroup",
98101
"rds:DeleteDBCluster",
99102
"rds:DeleteDBInstance",
100103
"rds:DeleteDBSubnetGroup",
104+
"rds:DeleteDBClusterParameterGroup",
101105
"rds:ModifyDBCluster",
102106
"rds:ModifyCurrentDBClusterCapacity",
103107
"rds:ModifyDBInstance",
108+
"rds:ModifyDBClusterParameterGroup",
109+
"rds:ResetDBClusterParameterGroup",
104110
"resource-groups:CreateGroup",
105111
"resource-groups:DeleteGroup",
106112
"route53:ChangeResourceRecordSets",
@@ -119,6 +125,9 @@
119125
"secretsmanager:CreateSecret",
120126
"secretsmanager:PutSecretValue",
121127
"secretsmanager:UpdateSecret",
128+
"secretsmanager:GetSecretValue",
129+
"secretsmanager:RotateSecret",
130+
"secretsmanager:DeleteSecret",
122131
"ssm:DeleteParameter",
123132
"ssm:DeleteParameters",
124133
"ssm:PutParameter"

‎terraform/app/db_migration_configuration.tf‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
module "dms_custom_kms_migration" {
2+
source = "./modules/dms"
3+
environment = var.environment
4+
5+
ecs_sg_ids = concat(local.ecs_sg_ids, [module.prepare_new_db_service.security_group_id])
6+
source_endpoint = aws_rds_cluster.aurora_cluster.endpoint
7+
source_port = aws_rds_cluster.aurora_cluster.port
8+
source_database_name = aws_rds_cluster.aurora_cluster.database_name
9+
source_db_secret_arn = var.db_secret_arn == null ? aws_rds_cluster.aurora_cluster.master_user_secret[0].secret_arn : var.db_secret_arn
10+
11+
target_endpoint = aws_rds_cluster.core.endpoint
12+
target_port = aws_rds_cluster.core.port
13+
target_database_name = aws_rds_cluster.core.database_name
14+
target_db_secret_arn = aws_rds_cluster.core.master_user_secret[0].secret_arn
15+
target_db_rotation_arn = aws_secretsmanager_secret_rotation.target.id
16+
17+
engine_name = aws_rds_cluster.aurora_cluster.engine
18+
subnet_ids = [aws_subnet.private_subnet_a.id, aws_subnet.private_subnet_b.id]
19+
20+
rds_cluster_security_group_id = aws_security_group.rds_security_group.id
21+
vpc_id = aws_vpc.application_vpc.id
22+
}
23+
24+
module "prepare_new_db_service" {
25+
source = "./modules/ecs_service"
26+
27+
cluster_id = aws_ecs_cluster.cluster.id
28+
cluster_name = aws_ecs_cluster.cluster.name
29+
environment = var.environment
30+
maximum_replica_count = 1
31+
minimum_replica_count = 1
32+
network_params = {
33+
subnets = [aws_subnet.private_subnet_a.id, aws_subnet.private_subnet_b.id]
34+
vpc_id = aws_vpc.application_vpc.id
35+
}
36+
server_type = "none"
37+
server_type_name = "prepare_new_db"
38+
task_config = {
39+
environment = [{
40+
name = "DB_HOST"
41+
value = aws_rds_cluster.core.endpoint
42+
},
43+
{
44+
name = "DB_NAME"
45+
value = aws_rds_cluster.core.database_name
46+
},
47+
{
48+
name = "RAILS_ENV"
49+
value = var.rails_env
50+
},
51+
{
52+
name = "SENTRY_ENVIRONMENT"
53+
value = var.environment
54+
},
55+
{
56+
name = "MAVIS__CIS2__ENABLED"
57+
value = "false"
58+
},
59+
{
60+
name = "MAVIS__SPLUNK__ENABLED"
61+
value = "false"
62+
}
63+
]
64+
secrets = [
65+
{
66+
name = "DB_CREDENTIALS"
67+
valueFrom = aws_rds_cluster.core.master_user_secret[0].secret_arn
68+
},
69+
{
70+
name = "RAILS_MASTER_KEY"
71+
valueFrom = var.rails_master_key_path
72+
}
73+
]
74+
cpu = 1024
75+
memory = 2048
76+
docker_image = "${var.account_id}.dkr.ecr.eu-west-2.amazonaws.com/${var.docker_image}@${var.image_digest}"
77+
execution_role_arn = aws_iam_role.ecs_task_execution_role.arn
78+
task_role_arn = aws_iam_role.ecs_task_role.arn
79+
log_group_name = aws_cloudwatch_log_group.ecs_log_group.name
80+
region = var.region
81+
health_check_command = ["CMD-SHELL", "echo 'alive' || exit 1"]
82+
}
83+
depends_on = [aws_rds_cluster_instance.core]
84+
}
85+
86+
resource "aws_security_group_rule" "db_prepare_access_to_db" {
87+
type = "ingress"
88+
from_port = aws_rds_cluster.core.port
89+
to_port = aws_rds_cluster.core.port
90+
protocol = "tcp"
91+
security_group_id = aws_security_group.rds_security_group.id
92+
source_security_group_id = module.prepare_new_db_service.security_group_id
93+
94+
description = "Allow access from the prepare_new_db ECS service to the core RDS cluster"
95+
}

‎terraform/app/env/production.tfvars‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,10 @@ ecs_log_retention_days = 30
2626
backup_retention_period = 7
2727
ssl_policy = "ELBSecurityPolicy-TLS13-1-2-2021-06"
2828
access_logs_bucket = "nhse-mavis-access-logs-production"
29-
max_aurora_capacity_units = 16
29+
max_aurora_capacity_units = 32
3030
minimum_web_replicas = 2
3131
maximum_web_replicas = 4
3232
container_insights = "enhanced"
3333

3434
enable_backup_to_vault = true
35+

‎terraform/app/env/qa.tfvars‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ http_hosts = {
2424
appspec_bucket = "nhse-mavis-appspec-bucket-qa"
2525
minimum_web_replicas = 2
2626
maximum_web_replicas = 4
27-
max_aurora_capacity_units = 16
27+
max_aurora_capacity_units = 32
2828
container_insights = "enhanced"
2929

3030
enable_backup_to_vault = true

‎terraform/app/env/sandbox-alpha.tfvars‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,3 +24,4 @@ appspec_bucket = "nhse-mavis-appspec-bucket-sandbox-alpha"
2424
minimum_web_replicas = 1
2525
maximum_web_replicas = 2
2626
good_job_replicas = 1
27+

‎terraform/app/env/test.tfvars‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,3 +21,5 @@ http_hosts = {
2121
appspec_bucket = "nhse-mavis-appspec-bucket-test"
2222
minimum_web_replicas = 2
2323
maximum_web_replicas = 4
24+
25+
max_aurora_capacity_units = 32

‎terraform/app/env/training.tfvars‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,3 +28,5 @@ http_hosts = {
2828
appspec_bucket = "nhse-mavis-appspec-bucket-training"
2929
minimum_web_replicas = 2
3030
maximum_web_replicas = 4
31+
32+
max_aurora_capacity_units = 32

‎terraform/app/iam_policy_documents.tf‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,8 @@ data "aws_iam_policy_document" "ecs_secrets_access" {
6060
sid = "dbSecretSid"
6161
actions = ["secretsmanager:GetSecretValue"]
6262
resources = [
63-
var.db_secret_arn == null ? aws_rds_cluster.aurora_cluster.master_user_secret[0].secret_arn : var.db_secret_arn
63+
var.db_secret_arn == null ? aws_rds_cluster.aurora_cluster.master_user_secret[0].secret_arn : var.db_secret_arn,
64+
aws_rds_cluster.core.master_user_secret[0].secret_arn
6465
]
6566
effect = "Allow"
6667
}

0 commit comments

Comments
 (0)