16 |
17 |
18 | 
19 |
20 |
21 | 
22 |
23 |
24 | 
25 |
26 |
27 |
28 | 8 | With our comprehensive DevOps toolkit - streamline operations, automate workflows, enhance collaboration and, most importantly, deploy with confidence. 9 |
10 | 11 | 12 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
23 |
24 |
30 |
31 |
32 | 
33 |
34 |
35 | 
36 |
37 |
38 | 
39 |
40 |
41 | 
42 |
43 |
44 |
We are The Cloud Experts!
181 |We ❤️ Open Source and you can check out our other modules to get help with your new Cloud ideas.
183 | 184 | [website]: https://clouddrove.com 185 | [blog]: https://blog.clouddrove.com 186 | [slack]: https://www.launchpass.com/devops-talks 187 | [github]: https://github.com/clouddrove 188 | [linkedin]: https://cpco.io/linkedin 189 | [twitter]: https://twitter.com/clouddrove/ 190 | [email]: https://clouddrove.com/contact-us.html 191 | [terraform_modules]: https://github.com/clouddrove?utf8=%E2%9C%93&q=terraform-&type=&language= 192 | -------------------------------------------------------------------------------- /README.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | # 3 | # This is the canonical configuration for the `README.md` 4 | # Run `make readme` to rebuild the `README.md` 5 | # 6 | 7 | # Name of this project 8 | name: Terraform AWS Elasticache 9 | 10 | # License of this project 11 | license: "APACHE" 12 | 13 | # Canonical GitHub repo 14 | github_repo: clouddrove/terraform-aws-elasticache 15 | 16 | # Badges to display 17 | badges: 18 | - name: "Latest Release" 19 | image: "https://img.shields.io/github/release/clouddrove/terraform-aws-elasticache.svg" 20 | url: "https://github.com/clouddrove/terraform-aws-elasticache/releases/latest" 21 | - name: "tfsec" 22 | image: "https://github.com/clouddrove/terraform-aws-elasticache/actions/workflows/tfsec.yml/badge.svg" 23 | url: "https://github.com/clouddrove/terraform-aws-elasticache/actions/workflows/tfsec.yml" 24 | - name: "Licence" 25 | image: "https://img.shields.io/badge/License-APACHE-blue.svg" 26 | url: "LICENSE.md" 27 | - name: "Changelog" 28 | image: "https://img.shields.io/badge/Changelog-blue" 29 | url: "CHANGELOG.md" 30 | 31 | prerequesties: 32 | - name: Terraform 33 | url: https://learn.hashicorp.com/terraform/getting-started/install.html 34 | version: ">= 1.6.5" 35 | 36 | providers: 37 | - name: aws 38 | url: https://aws.amazon.com/ 39 | version: ">= 5.31.0" 40 | 41 | module_dependencies: 42 | - name: Labels Module 43 | url: https://github.com/clouddrove/terraform-aws-labels 44 | description: Provides resource tagging. 45 | # description of this project 46 | description: |- 47 | Terraform module to create Elasticache Cluster and replica for Redis and Memcache. 48 | 49 | # extra content 50 | include: 51 | - "terraform.md" 52 | 53 | # How to use this project 54 | # How to use this project 55 | usage : |- 56 | Here are some examples of how you can use this module in your inventory structure: 57 | ### Redis 58 | ```hcl 59 | module "redis" { 60 | source = "clouddrove/elasticache/aws 61 | version = "1.3.0" 62 | 63 | name = "redis" 64 | environment = "test" 65 | label_order = ["name", "environment"] 66 | 67 | vpc_id = module.vpc.vpc_id 68 | allowed_ip = [module.vpc.vpc_cidr_block] 69 | allowed_ports = [6379] 70 | 71 | cluster_replication_enabled = true 72 | engine = "redis" 73 | engine_version = "7.0" 74 | parameter_group_name = "default.redis7" 75 | port = 6379 76 | node_type = "cache.t2.micro" 77 | subnet_ids = module.subnets.public_subnet_id 78 | availability_zones = [""] 79 | automatic_failover_enabled = false 80 | multi_az_enabled = false 81 | num_cache_clusters = 1 82 | retention_in_days = 0 83 | snapshot_retention_limit = 7 84 | 85 | log_delivery_configuration = [ 86 | { 87 | destination_type = "cloudwatch-logs" 88 | log_format = "json" 89 | log_type = "slow-log" 90 | }, 91 | { 92 | destination_type = "cloudwatch-logs" 93 | log_format = "json" 94 | log_type = "engine-log" 95 | } 96 | ] 97 | extra_tags = { 98 | Application = "CloudDrove" 99 | } 100 | route53_record_enabled = true 101 | ssm_parameter_endpoint_enabled = true 102 | dns_record_name = "prod" 103 | route53_ttl = "300" 104 | route53_type = "CNAME" 105 | route53_zone_id = "Z017xxxxDLxxx0GH04" 106 | } 107 | 108 | ``` 109 | ### Redis Cluster 110 | ```hcl 111 | module "redis-cluster" { 112 | source = "clouddrove/elasticache/aws 113 | version = "1.3.0" 114 | 115 | name = "redis-cluster" 116 | environment = "test" 117 | label_order = ["environment", "name"] 118 | 119 | vpc_id = module.vpc.vpc_id 120 | allowed_ip = [module.vpc.vpc_cidr_block] 121 | allowed_ports = [6379] 122 | 123 | cluster_replication_enabled = true 124 | engine = "redis" 125 | engine_version = "7.0" 126 | parameter_group_name = "default.redis7.cluster.on" 127 | port = 6379 128 | node_type = "cache.t2.micro" 129 | subnet_ids = module.subnets.public_subnet_id 130 | availability_zones = ["eu-west-1a", "eu-west-1b"] 131 | num_cache_nodes = 1 132 | snapshot_retention_limit = 7 133 | automatic_failover_enabled = true 134 | extra_tags = { 135 | Application = "CloudDrove" 136 | } 137 | 138 | route53_record_enabled = false 139 | ssm_parameter_endpoint_enabled = false 140 | dns_record_name = "prod" 141 | route53_ttl = "300" 142 | route53_type = "CNAME" 143 | route53_zone_id = "SERFxxxx6XCsY9Lxxxxx" 144 | } 145 | ``` 146 | ### Memcache 147 | ```hcl 148 | module "memcached" { 149 | source = "clouddrove/elasticache/aws 150 | version = "1.3.0" 151 | 152 | name = "memcached" 153 | environment = "test" 154 | label_order = ["name", "environment"] 155 | 156 | vpc_id = module.vpc.vpc_id 157 | allowed_ip = [module.vpc.vpc_cidr_block] 158 | allowed_ports = [11211] 159 | 160 | cluster_enabled = true 161 | memcached_ssm_parameter_endpoint_enabled = true 162 | memcached_route53_record_enabled = true 163 | engine = "memcached" 164 | engine_version = "1.6.17" 165 | family = "memcached1.5" 166 | parameter_group_name = "" 167 | az_mode = "cross-az" 168 | port = 11211 169 | node_type = "cache.t2.micro" 170 | num_cache_nodes = 2 171 | subnet_ids = module.subnets.public_subnet_id 172 | availability_zones = ["eu-west-1a", "eu-west-1b"] 173 | extra_tags = { 174 | Application = "CloudDrove" 175 | } 176 | route53_record_enabled = false 177 | ssm_parameter_endpoint_enabled = false 178 | dns_record_name = "prod" 179 | route53_ttl = "300" 180 | route53_type = "CNAME" 181 | route53_zone_id = "SERFxxxx6XCsY9Lxxxxx" 182 | 183 | } 184 | ``` 185 | -------------------------------------------------------------------------------- /docs/io.md: -------------------------------------------------------------------------------- 1 | ## Inputs 2 | 3 | | Name | Description | Type | Default | Required | 4 | |------|-------------|------|---------|:--------:| 5 | | alias | The display name of the alias. The name must start with the word `alias` followed by a forward slash. | `string` | `"alias/redis"` | no | 6 | | allowed\_ip | List of allowed ip. | `list(any)` | `[]` | no | 7 | | allowed\_ports | List of allowed ingress ports | `list(any)` | `[]` | no | 8 | | auth\_token | The password used to access a password protected server. Can be specified only if transit\_encryption\_enabled = true. Find auto generated auth\_token in terraform.tfstate or in AWS SSM Parameter Store. | `string` | `null` | no | 9 | | auth\_token\_enable | Flag to specify whether to create auth token (password) protected cluster. Can be specified only if transit\_encryption\_enabled = true. | `bool` | `true` | no | 10 | | availability\_zones | A list of EC2 availability zones in which the replication group's cache clusters will be created. The order of the availability zones in the list is not important. | `list(string)` | n/a | yes | 11 | | az\_mode | (Memcached only) Specifies whether the nodes in this Memcached node group are created in a single Availability Zone or created across multiple Availability Zones in the cluster's region. Valid values for this parameter are single-az or cross-az, default is single-az. If you want to choose cross-az, num\_cache\_nodes must be greater than 1. | `string` | `"single-az"` | no | 12 | | cluster\_enabled | (Memcache only) Enabled or disabled cluster. | `bool` | `false` | no | 13 | | cluster\_replication\_enabled | (Redis only) Enabled or disabled replication\_group for redis cluster. | `bool` | `false` | no | 14 | | customer\_master\_key\_spec | Specifies whether the key contains a symmetric key or an asymmetric key pair and the encryption algorithms or signing algorithms that the key supports. Valid values: SYMMETRIC\_DEFAULT, RSA\_2048, RSA\_3072, RSA\_4096, ECC\_NIST\_P256, ECC\_NIST\_P384, ECC\_NIST\_P521, or ECC\_SECG\_P256K1. Defaults to SYMMETRIC\_DEFAULT. | `string` | `"SYMMETRIC_DEFAULT"` | no | 15 | | deletion\_window\_in\_days | Duration in days after which the key is deleted after destruction of the resource. | `number` | `7` | no | 16 | | egress\_rule | Enable to create egress rule | `bool` | `true` | no | 17 | | enable | Enable or disable of elasticache | `bool` | `true` | no | 18 | | enable\_key\_rotation | Specifies whether key rotation is enabled. | `string` | `true` | no | 19 | | enable\_security\_group | Enable default Security Group with only Egress traffic allowed. | `bool` | `true` | no | 20 | | environment | Environment (e.g. `prod`, `dev`, `staging`). | `string` | `""` | no | 21 | | extra\_tags | Additional tags (e.g. map(`BusinessUnit`,`XYZ`). | `map(string)` | `{}` | no | 22 | | is\_enabled | Specifies whether the key is enabled. | `bool` | `true` | no | 23 | | is\_external | enable to udated existing security Group | `bool` | `false` | no | 24 | | key\_usage | Specifies the intended use of the key. Defaults to ENCRYPT\_DECRYPT, and only symmetric encryption and decryption are supported. | `string` | `"ENCRYPT_DECRYPT"` | no | 25 | | kms\_description | The description of the key as viewed in AWS console. | `string` | `"Parameter Store KMS master key"` | no | 26 | | kms\_key\_enabled | Specifies whether the kms is enabled or disabled. | `bool` | `true` | no | 27 | | kms\_key\_id | The ARN of the key that you wish to use if encrypting at rest. If not supplied, uses service managed encryption. Can be specified only if at\_rest\_encryption\_enabled = true. | `string` | `""` | no | 28 | | kms\_multi\_region | Indicates whether the KMS key is a multi-Region (true) or regional (false) key. | `bool` | `false` | no | 29 | | label\_order | Label order, e.g. `name`,`application`. | `list(any)` |[| no | 30 | | length | n/a | `number` | `25` | no | 31 | | log\_delivery\_configuration | The log\_delivery\_configuration block allows the streaming of Redis SLOWLOG or Redis Engine Log to CloudWatch Logs or Kinesis Data Firehose. Max of 2 blocks. | `list(map(any))` | `[]` | no | 32 | | managedby | ManagedBy, eg 'CloudDrove' or 'AnmolNagpal'. | `string` | `"anmol@clouddrove.com"` | no | 33 | | memcached\_route53\_record\_enabled | Whether to create Route53 record memcached set. | `bool` | `false` | no | 34 | | memcached\_ssm\_parameter\_endpoint\_enabled | Name of the parameter. | `bool` | `false` | no | 35 | | name | Name (e.g. `app` or `cluster`). | `string` | `""` | no | 36 | | network\_type | value of the network type. Valid values are ipv4, ipv6 or dual\_stack. | `string` | `"ipv4"` | no | 37 | | num\_cache\_nodes | (Required unless replication\_group\_id is provided) The initial number of cache nodes that the cache cluster will have. For Redis, this value must be 1. For Memcache, this value must be between 1 and 20. If this number is reduced on subsequent runs, the highest numbered nodes will be removed. | `number` | `1` | no | 38 | | protocol | The protocol. If not icmp, tcp, udp, or all use the. | `string` | `"tcp"` | no | 39 | | replication\_group | n/a | `map(any)` | `{}` | no | 40 | | repository | Terraform current module repo | `string` | `"https://github.com/clouddrove/terraform-aws-elasticache"` | no | 41 | | retention\_in\_days | Specifies the number of days you want to retain log events in the specified log group. | `number` | `0` | no | 42 | | route53 | Route53 Configurations. | `map(any)` | `{}` | no | 43 | | route53\_record\_enabled | Whether to create Route53 record set. | `bool` | `false` | no | 44 | | security\_group\_names | A list of cache security group names to associate with this replication group. | `list(string)` | `null` | no | 45 | | sg\_description | The security group description. | `string` | `"Instance default security group (only egress access is allowed)."` | no | 46 | | sg\_egress\_description | Description of the egress and ingress rule | `string` | `"Description of the rule."` | no | 47 | | sg\_egress\_ipv6\_description | Description of the egress\_ipv6 rule | `string` | `"Description of the rule."` | no | 48 | | sg\_ids | of the security group id. | `list(any)` | `[]` | no | 49 | | sg\_ingress\_description | Description of the ingress rule | `string` | `"Description of the ingress rule use elasticache."` | no | 50 | | snapshot\_arns | A single-element string list containing an Amazon Resource Name (ARN) of a Redis RDB snapshot file stored in Amazon S3. | `list(string)` | `null` | no | 51 | | special | n/a | `bool` | `false` | no | 52 | | ssm\_parameter\_description | SSM Parameters can be imported using. | `string` | `"Description of the parameter."` | no | 53 | | ssm\_parameter\_endpoint\_enabled | Name of the parameter. | `bool` | `false` | no | 54 | | ssm\_parameter\_type | Type of the parameter. | `string` | `"SecureString"` | no | 55 | | subnet\_group\_description | Description for the cache subnet group. Defaults to `Managed by Terraform`. | `string` | `"The Description of the ElastiCache Subnet Group."` | no | 56 | | subnet\_ids | List of VPC Subnet IDs for the cache subnet group. | `list(any)` | `[]` | no | 57 | | user\_group\_ids | User Group ID to associate with the replication group. | `list(string)` | `null` | no | 58 | | vpc\_id | The ID of the VPC that the instance security group belongs to. | `string` | `""` | no | 59 | 60 | ## Outputs 61 | 62 | | Name | Description | 63 | |------|-------------| 64 | | Memcached\_ssm\_name | A list of all of the parameter values | 65 | | auth\_token | Auth token generated value | 66 | | hostname | DNS hostname | 67 | | id | Redis cluster id. | 68 | | memcached\_arn | Memcached arn | 69 | | memcached\_endpoint | Memcached endpoint address. | 70 | | memcached\_hostname | DNS hostname | 71 | | port | Redis port. | 72 | | redis\_arn | Redis arn | 73 | | redis\_endpoint | Redis endpoint address. | 74 | | redis\_ssm\_name | A list of all of the parameter values | 75 | | sg\_id | n/a | 76 | | tags | A mapping of tags to assign to the resource. | 77 | 78 | -------------------------------------------------------------------------------- /examples/memcached/example.tf: -------------------------------------------------------------------------------- 1 | ####---------------------------------------------------------------------------------- 2 | ## Provider block added, Use the Amazon Web Services (AWS) provider to interact with the many resources supported by AWS. 3 | ####---------------------------------------------------------------------------------- 4 | provider "aws" { 5 | region = local.region 6 | } 7 | locals { 8 | name = "memcached" 9 | environment = "test" 10 | region = "eu-west-1" 11 | } 12 | ####---------------------------------------------------------------------------------- 13 | ## A VPC is a virtual network that closely resembles a traditional network that you'd operate in your own data center. 14 | ####---------------------------------------------------------------------------------- 15 | module "vpc" { 16 | source = "clouddrove/vpc/aws" 17 | version = "2.0.0" 18 | 19 | name = "${local.name}-vpc" 20 | environment = local.environment 21 | cidr_block = "10.0.0.0/16" 22 | } 23 | 24 | ####---------------------------------------------------------------------------------- 25 | ## A subnet is a range of IP addresses in your VPC. 26 | ####---------------------------------------------------------------------------------- 27 | module "subnets" { 28 | source = "clouddrove/subnet/aws" 29 | version = "2.0.0" 30 | 31 | name = "${local.name}-subnets" 32 | environment = local.environment 33 | availability_zones = ["eu-west-1a", "eu-west-1b", "eu-west-1c"] 34 | vpc_id = module.vpc.vpc_id 35 | type = "public" 36 | igw_id = module.vpc.igw_id 37 | cidr_block = module.vpc.vpc_cidr_block 38 | ipv6_cidr_block = module.vpc.ipv6_cidr_block 39 | } 40 | 41 | ####---------------------------------------------------------------------------------- 42 | ## Memcached holds its data in memory. 43 | ####---------------------------------------------------------------------------------- 44 | module "memcached" { 45 | source = "./../../" 46 | 47 | name = local.name 48 | environment = local.environment 49 | ####---------------------------------------------------------------------------------- 50 | ## Below A security group controls the traffic that is allowed to reach and leave the resources that it is associated with. 51 | ####---------------------------------------------------------------------------------- 52 | vpc_id = module.vpc.vpc_id 53 | allowed_ip = [module.vpc.vpc_cidr_block] 54 | allowed_ports = [11211] 55 | 56 | cluster_enabled = true 57 | memcached_ssm_parameter_endpoint_enabled = true 58 | memcached_route53_record_enabled = false 59 | 60 | replication_group = { 61 | engine = "memcached" 62 | engine_version = "1.6.17" 63 | parameter_group_name = "" 64 | port = 11211 65 | node_type = "cache.t2.micro" 66 | parameter_group_name = "" 67 | } 68 | 69 | az_mode = "cross-az" 70 | num_cache_nodes = 2 71 | subnet_ids = module.subnets.public_subnet_id 72 | availability_zones = ["eu-west-1a", "eu-west-1b"] 73 | extra_tags = { 74 | Application = "CloudDrove" 75 | } 76 | 77 | ####---------------------------------------------------------------------------------- 78 | ## will create ROUTE-53 for redis which will add the dns of the cluster. 79 | ####---------------------------------------------------------------------------------- 80 | route53_record_enabled = false 81 | ssm_parameter_endpoint_enabled = false 82 | route53 = { 83 | dns_record_name = "prod" 84 | route53_ttl = "300" 85 | route53_type = "CNAME" 86 | route53_zone_id = "SERFxxxx6XCsY9Lxxxxx" # Change Zone ID with Route53 Zone ID from looking at AWS Console 87 | } 88 | } 89 | -------------------------------------------------------------------------------- /examples/memcached/outputs.tf: -------------------------------------------------------------------------------- 1 | output "id" { 2 | value = module.memcached[*].id 3 | description = "memcached id." 4 | } 5 | 6 | output "tags" { 7 | value = module.memcached.tags 8 | description = "A mapping of tags to assign to the resource." 9 | } 10 | 11 | output "memcached_endpoint" { 12 | value = module.memcached.memcached_endpoint 13 | description = "Memcached endpoint address." 14 | } 15 | 16 | output "hostname" { 17 | value = module.memcached.hostname 18 | description = "DNS hostname" 19 | } 20 | 21 | output "redis_ssm_arn" { 22 | value = module.memcached.Memcached_ssm_name 23 | description = "A map of the names and ARNs created" 24 | } 25 | -------------------------------------------------------------------------------- /examples/memcached/versions.tf: -------------------------------------------------------------------------------- 1 | # Terraform version 2 | terraform { 3 | required_version = ">= 1.6.5" 4 | 5 | required_providers { 6 | aws = { 7 | source = "hashicorp/aws" 8 | version = ">= 5.31.0" 9 | } 10 | } 11 | } 12 | -------------------------------------------------------------------------------- /examples/redis-cluster/example.tf: -------------------------------------------------------------------------------- 1 | ####---------------------------------------------------------------------------------- 2 | ## Provider block added, Use the Amazon Web Services (AWS) provider to interact with the many resources supported by AWS. 3 | ####---------------------------------------------------------------------------------- 4 | provider "aws" { 5 | region = local.region 6 | } 7 | locals { 8 | name = "redis-cluster" 9 | environment = "test" 10 | region = "eu-west-1" 11 | } 12 | ####---------------------------------------------------------------------------------- 13 | ## A VPC is a virtual network that closely resembles a traditional network that you'd operate in your own data center. 14 | ####---------------------------------------------------------------------------------- 15 | module "vpc" { 16 | source = "clouddrove/vpc/aws" 17 | version = "2.0.0" 18 | 19 | name = "${local.name}-vpc" 20 | environment = local.environment 21 | cidr_block = "10.0.0.0/16" 22 | } 23 | 24 | ####---------------------------------------------------------------------------------- 25 | ## A subnet is a range of IP addresses in your VPC. 26 | ####---------------------------------------------------------------------------------- 27 | module "subnets" { 28 | source = "clouddrove/subnet/aws" 29 | version = "2.0.1" 30 | 31 | name = "${local.name}-subnets" 32 | environment = local.environment 33 | availability_zones = ["eu-west-1a", "eu-west-1b", "eu-west-1c"] 34 | vpc_id = module.vpc.vpc_id 35 | type = "public" 36 | igw_id = module.vpc.igw_id 37 | cidr_block = module.vpc.vpc_cidr_block 38 | ipv6_cidr_block = module.vpc.ipv6_cidr_block 39 | } 40 | 41 | ###---------------------------------------------------------------------------------- 42 | # Amazon ElastiCache [REDIS-CLUSTER] is a fully managed in-memory data store and cache service by Amazon Web Services. 43 | # The service improves the performance of web applications by retrieving information from managed in-memory caches, 44 | # instead of relying entirely on slower disk-based databases. 45 | ###---------------------------------------------------------------------------------- 46 | module "redis-cluster" { 47 | source = "./../../" 48 | 49 | name = local.name 50 | environment = local.environment 51 | 52 | ###---------------------------------------------------------------------------------- 53 | # Below A security group controls the traffic that is allowed to reach and leave the resources that it is associated with. 54 | ###---------------------------------------------------------------------------------- 55 | vpc_id = module.vpc.vpc_id 56 | allowed_ip = [module.vpc.vpc_cidr_block] 57 | allowed_ports = [6379] 58 | 59 | cluster_replication_enabled = true 60 | 61 | replication_group = { 62 | engine = "redis" 63 | engine_version = "7.0" 64 | parameter_group_name = "default.redis7.cluster.on" 65 | port = 6379 66 | node_type = "cache.t2.micro" 67 | snapshot_retention_limit = 7 68 | automatic_failover_enabled = true 69 | } 70 | 71 | subnet_ids = module.subnets.public_subnet_id 72 | availability_zones = ["eu-west-1a", "eu-west-1b"] 73 | num_cache_nodes = 1 74 | extra_tags = { 75 | Application = "CloudDrove" 76 | } 77 | 78 | ###---------------------------------------------------------------------------------- 79 | # will create ROUTE-53 for redis which will add the dns of the cluster. 80 | ###---------------------------------------------------------------------------------- 81 | route53_record_enabled = false 82 | ssm_parameter_endpoint_enabled = false 83 | route53 = { 84 | dns_record_name = "prod" 85 | route53_ttl = "300" 86 | route53_type = "CNAME" 87 | route53_zone_id = "SERFxxxx6XCsY9Lxxxxx" 88 | } 89 | } 90 | -------------------------------------------------------------------------------- /examples/redis-cluster/outputs.tf: -------------------------------------------------------------------------------- 1 | output "id" { 2 | value = module.redis-cluster.id 3 | description = "Redis cluster id." 4 | } 5 | 6 | output "tags" { 7 | value = module.redis-cluster.tags 8 | description = "A mapping of tags to assign to the resource." 9 | } 10 | 11 | output "redis_endpoint" { 12 | value = module.redis-cluster[*].redis_endpoint 13 | description = "Redis endpoint address." 14 | } 15 | 16 | output "hostname" { 17 | value = module.redis-cluster.hostname 18 | description = "DNS hostname" 19 | } 20 | 21 | output "redis_ssm_arn" { 22 | value = module.redis-cluster.redis_ssm_name 23 | description = "A map of the names and ARNs created" 24 | } 25 | 26 | output "auth_token" { 27 | value = module.redis-cluster.auth_token 28 | sensitive = true 29 | } -------------------------------------------------------------------------------- /examples/redis-cluster/versions.tf: -------------------------------------------------------------------------------- 1 | # Terraform version 2 | terraform { 3 | required_version = ">= 1.6.2" 4 | 5 | required_providers { 6 | aws = { 7 | source = "hashicorp/aws" 8 | version = ">= 5.22.0" 9 | } 10 | } 11 | } 12 | -------------------------------------------------------------------------------- /examples/redis/example.tf: -------------------------------------------------------------------------------- 1 | ####---------------------------------------------------------------------------------- 2 | ## Provider block added, Use the Amazon Web Services (AWS) provider to interact with the many resources supported by AWS. 3 | ####---------------------------------------------------------------------------------- 4 | provider "aws" { 5 | region = local.region 6 | } 7 | locals { 8 | name = "redis" 9 | environment = "test" 10 | region = "eu-west-1" 11 | } 12 | ####---------------------------------------------------------------------------------- 13 | ## A VPC is a virtual network that closely resembles a traditional network that you'd operate in your own data center. 14 | ####---------------------------------------------------------------------------------- 15 | module "vpc" { 16 | source = "clouddrove/vpc/aws" 17 | version = "2.0.0" 18 | 19 | name = "${local.name}-vpc" 20 | environment = local.environment 21 | cidr_block = "10.0.0.0/16" 22 | } 23 | 24 | ####---------------------------------------------------------------------------------- 25 | ## A subnet is a range of IP addresses in your VPC. 26 | ####---------------------------------------------------------------------------------- 27 | module "subnets" { 28 | source = "clouddrove/subnet/aws" 29 | version = "2.0.1" 30 | 31 | name = "${local.name}-subnets" 32 | environment = local.environment 33 | availability_zones = ["eu-west-1a", "eu-west-1b", "eu-west-1c"] 34 | vpc_id = module.vpc.vpc_id 35 | type = "public" 36 | igw_id = module.vpc.igw_id 37 | cidr_block = module.vpc.vpc_cidr_block 38 | ipv6_cidr_block = module.vpc.ipv6_cidr_block 39 | } 40 | 41 | ####---------------------------------------------------------------------------------- 42 | ## Amazon ElastiCache [REDIS-CLUSTER] is a fully managed in-memory data store and cache service by Amazon Web Services. 43 | ## The service improves the performance of web applications by retrieving information from managed in-memory caches, 44 | ## instead of relying entirely on slower disk-based databases. 45 | ####---------------------------------------------------------------------------------- 46 | #tfsec:ignore:aws-cloudwatch-log-group-customer-key 47 | module "redis" { 48 | source = "./../../" 49 | 50 | 51 | name = local.name 52 | environment = local.environment 53 | ####---------------------------------------------------------------------------------- 54 | ## Below A security group controls the traffic that is allowed to reach and leave the resources that it is associated with. 55 | ####---------------------------------------------------------------------------------- 56 | vpc_id = module.vpc.vpc_id 57 | allowed_ip = [module.vpc.vpc_cidr_block] 58 | allowed_ports = [6379] 59 | 60 | cluster_replication_enabled = true 61 | 62 | replication_group = { 63 | engine = "redis" 64 | engine_version = "7.0" 65 | parameter_group_name = "default.redis7" 66 | port = 6379 67 | node_type = "cache.t2.micro" 68 | automatic_failover_enabled = false 69 | num_cache_clusters = 1 70 | } 71 | 72 | subnet_ids = module.subnets.public_subnet_id 73 | availability_zones = [""] 74 | retention_in_days = 0 75 | 76 | log_delivery_configuration = [ 77 | { 78 | destination_type = "cloudwatch-logs" 79 | log_format = "json" 80 | log_type = "slow-log" 81 | }, 82 | { 83 | destination_type = "cloudwatch-logs" 84 | log_format = "json" 85 | log_type = "engine-log" 86 | } 87 | ] 88 | extra_tags = { 89 | Application = "CloudDrove" 90 | } 91 | 92 | ####---------------------------------------------------------------------------------- 93 | ## will create ROUTE-53 for redis which will add the dns of the cluster. 94 | ####---------------------------------------------------------------------------------- 95 | route53_record_enabled = false 96 | ssm_parameter_endpoint_enabled = true 97 | route53 = { 98 | dns_record_name = "prod" 99 | route53_ttl = "300" 100 | route53_type = "CNAME" 101 | route53_zone_id = "Z017xxxxDLxxx0GH04" 102 | } 103 | } 104 | -------------------------------------------------------------------------------- /examples/redis/outputs.tf: -------------------------------------------------------------------------------- 1 | output "id" { 2 | value = module.redis[*].id 3 | description = "Redis cluster id." 4 | } 5 | 6 | output "tags" { 7 | value = module.redis.tags 8 | description = "A mapping of tags to assign to the resource." 9 | } 10 | 11 | output "redis_endpoint" { 12 | value = module.redis.redis_endpoint 13 | description = "Redis endpoint address." 14 | } 15 | 16 | output "sg_id" { 17 | value = module.redis[*].sg_id 18 | description = "of the security group id." 19 | } 20 | 21 | output "hostname" { 22 | value = module.redis[*].hostname 23 | description = "DNS hostname" 24 | } 25 | 26 | 27 | output "redis_ssm_arn" { 28 | value = module.redis.redis_ssm_name 29 | description = "A map of the names and ARNs created" 30 | } 31 | -------------------------------------------------------------------------------- /examples/redis/versions.tf: -------------------------------------------------------------------------------- 1 | # Terraform version 2 | terraform { 3 | required_version = ">= 1.6.2" 4 | 5 | required_providers { 6 | aws = { 7 | source = "hashicorp/aws" 8 | version = ">= 5.22.0" 9 | } 10 | } 11 | } 12 | -------------------------------------------------------------------------------- /main.tf: -------------------------------------------------------------------------------- 1 | ##---------------------------------------------------------------------------------- 2 | ## Labels module callled that will be used for naming and tags. 3 | ##---------------------------------------------------------------------------------- 4 | module "labels" { 5 | source = "clouddrove/labels/aws" 6 | version = "1.3.0" 7 | 8 | enabled = var.enable 9 | name = var.name 10 | repository = var.repository 11 | environment = var.environment 12 | managedby = var.managedby 13 | label_order = var.label_order 14 | extra_tags = var.extra_tags 15 | } 16 | 17 | ##---------------------------------------------------------------------------------- 18 | ## Below resources will create SECURITY-GROUP and its components. 19 | ##---------------------------------------------------------------------------------- 20 | resource "aws_security_group" "default" { 21 | count = var.enable && var.enable_security_group && length(var.sg_ids) < 1 ? 1 : 0 22 | 23 | name = format("%s-sg", module.labels.id) 24 | vpc_id = var.vpc_id 25 | description = var.sg_description 26 | tags = module.labels.tags 27 | lifecycle { 28 | create_before_destroy = true 29 | } 30 | } 31 | 32 | ##---------------------------------------------------------------------------------- 33 | ## Below resources will create SECURITY-GROUP-RULE and its components. 34 | ##---------------------------------------------------------------------------------- 35 | #tfsec:ignore:aws-ec2-no-public-egress-sgr 36 | resource "aws_security_group_rule" "egress" { 37 | count = (var.enable && var.enable_security_group == true && length(var.sg_ids) < 1 && var.is_external == false && var.egress_rule == true) ? 1 : 0 38 | 39 | description = var.sg_egress_description 40 | type = "egress" 41 | from_port = 0 42 | to_port = 65535 43 | protocol = "-1" 44 | cidr_blocks = ["0.0.0.0/0"] 45 | security_group_id = join("", aws_security_group.default[*].id) 46 | } 47 | #tfsec:ignore:aws-ec2-no-public-egress-sgr 48 | resource "aws_security_group_rule" "egress_ipv6" { 49 | count = (var.enable && var.enable_security_group == true && length(var.sg_ids) < 1 && var.is_external == false) && var.egress_rule == true ? 1 : 0 50 | 51 | description = var.sg_egress_ipv6_description 52 | type = "egress" 53 | from_port = 0 54 | to_port = 65535 55 | protocol = "-1" 56 | ipv6_cidr_blocks = ["::/0"] 57 | security_group_id = join("", aws_security_group.default[*].id) 58 | } 59 | resource "aws_security_group_rule" "ingress" { 60 | count = var.enable && length(var.allowed_ip) > 0 == true && length(var.sg_ids) < 1 ? length(compact(var.allowed_ports)) : 0 61 | 62 | description = var.sg_ingress_description 63 | type = "ingress" 64 | from_port = element(var.allowed_ports, count.index) 65 | to_port = element(var.allowed_ports, count.index) 66 | protocol = var.protocol 67 | cidr_blocks = var.allowed_ip 68 | security_group_id = join("", aws_security_group.default[*].id) 69 | } 70 | 71 | ##---------------------------------------------------------------------------------- 72 | ## Below resources will create KMS-KEY and its components. 73 | ##---------------------------------------------------------------------------------- 74 | resource "aws_kms_key" "default" { 75 | count = var.enable && var.kms_key_enabled && var.kms_key_id == "" ? 1 : 0 76 | 77 | description = var.kms_description 78 | key_usage = var.key_usage 79 | deletion_window_in_days = var.deletion_window_in_days 80 | is_enabled = var.is_enabled 81 | enable_key_rotation = var.enable_key_rotation 82 | customer_master_key_spec = var.customer_master_key_spec 83 | policy = data.aws_iam_policy_document.default.json 84 | multi_region = var.kms_multi_region 85 | tags = module.labels.tags 86 | } 87 | 88 | resource "aws_kms_alias" "default" { 89 | count = var.enable && var.kms_key_enabled && var.kms_key_id == "" ? 1 : 0 90 | 91 | name = coalesce(var.alias, format("alias/%v", module.labels.id)) 92 | target_key_id = var.kms_key_id == "" ? join("", aws_kms_key.default[*].id) : var.kms_key_id 93 | } 94 | 95 | ##---------------------------------------------------------------------------------- 96 | ## Data block called to get Permissions that will be used in creating policy. 97 | ##---------------------------------------------------------------------------------- 98 | data "aws_partition" "current" {} 99 | data "aws_caller_identity" "current" {} 100 | data "aws_iam_policy_document" "default" { 101 | version = "2012-10-17" 102 | statement { 103 | sid = "Enable IAM User Permissions" 104 | effect = "Allow" 105 | principals { 106 | type = "AWS" 107 | identifiers = [ 108 | format( 109 | "arn:%s:iam::%s:root", 110 | join("", data.aws_partition.current[*].partition), 111 | data.aws_caller_identity.current.account_id 112 | ) 113 | ] 114 | } 115 | actions = ["kms:*"] 116 | resources = ["*"] 117 | } 118 | } 119 | 120 | ##---------------------------------------------------------------------------------- 121 | ## Below resource will create will save logs cloudwatch_log_group resource for redis-cluster and memcached. 122 | ##---------------------------------------------------------------------------------- 123 | resource "aws_cloudwatch_log_group" "default" { 124 | count = var.enable && length(var.log_delivery_configuration) > 0 ? length(var.log_delivery_configuration) : 0 125 | name = format("%s-%s", module.labels.name, var.log_delivery_configuration[count.index].log_type) 126 | retention_in_days = var.retention_in_days 127 | tags = module.labels.tags 128 | } 129 | 130 | 131 | resource "aws_elasticache_subnet_group" "default" { 132 | count = var.enable ? 1 : 0 133 | name = format("%s-subnet-group", module.labels.id) 134 | subnet_ids = var.subnet_ids 135 | description = var.subnet_group_description 136 | 137 | tags = module.labels.tags 138 | } 139 | 140 | ##---------------------------------------------------------------------------------- 141 | ## Below resource will create random passoword for the auth_token 142 | ##---------------------------------------------------------------------------------- 143 | 144 | resource "random_password" "auth_token" { 145 | count = var.enable && var.auth_token_enable && var.auth_token == null ? 1 : 0 146 | length = var.length 147 | special = var.special 148 | } 149 | 150 | ##---------------------------------------------------------------------------------- 151 | ## Below resource will create replication-group resource for redis-cluster and memcached. 152 | ##---------------------------------------------------------------------------------- 153 | resource "aws_elasticache_replication_group" "cluster" { 154 | count = var.enable && var.cluster_replication_enabled ? 1 : 0 155 | 156 | engine = lookup(var.replication_group, "engine", "") 157 | replication_group_id = module.labels.id 158 | description = lookup(var.replication_group, "replication_group_description", "User-created description for the replication group.") 159 | engine_version = lookup(var.replication_group, "engine_version", "") 160 | port = lookup(var.replication_group, "port", "") 161 | parameter_group_name = lookup(var.replication_group, "parameter_group_name", "default.redis5.0") 162 | node_type = lookup(var.replication_group, "node_type", "cache.t2.small") 163 | automatic_failover_enabled = lookup(var.replication_group, "automatic_failover_enabled", true) 164 | subnet_group_name = join("", aws_elasticache_subnet_group.default[*].name) 165 | security_group_ids = length(var.sg_ids) < 1 ? aws_security_group.default[*].id : var.sg_ids 166 | security_group_names = var.security_group_names 167 | snapshot_arns = var.snapshot_arns 168 | snapshot_name = lookup(var.replication_group, "snapshot_name", "") 169 | notification_topic_arn = lookup(var.replication_group, "notification_topic_arn", "") 170 | snapshot_window = lookup(var.replication_group, "snapshot_window", null) 171 | final_snapshot_identifier = lookup(var.replication_group, "final_snapshot_identifier", null) 172 | snapshot_retention_limit = lookup(var.replication_group, "snapshot_retention_limit", "0") 173 | apply_immediately = lookup(var.replication_group, "apply_immediately", false) 174 | auto_minor_version_upgrade = lookup(var.replication_group, "auto_minor_version_upgrade", true) 175 | maintenance_window = lookup(var.replication_group, "maintenance_window", "sun:05:00-sun:06:00") 176 | at_rest_encryption_enabled = lookup(var.replication_group, "at_rest_encryption_enabled", true) 177 | transit_encryption_enabled = lookup(var.replication_group, "transit_encryption_enabled", true) 178 | multi_az_enabled = lookup(var.replication_group, "multi_az_enabled", false) 179 | network_type = var.network_type 180 | 181 | auth_token = var.auth_token_enable ? (var.auth_token == null ? random_password.auth_token[0].result : var.auth_token) : "" 182 | kms_key_id = var.kms_key_id == "" ? join("", aws_kms_key.default[*].arn) : var.kms_key_id 183 | tags = module.labels.tags 184 | num_cache_clusters = lookup(var.replication_group, "num_cache_clusters", 1) 185 | user_group_ids = var.user_group_ids 186 | 187 | dynamic "log_delivery_configuration" { 188 | for_each = var.log_delivery_configuration 189 | 190 | content { 191 | destination = lookup(log_delivery_configuration.value, "destination", aws_cloudwatch_log_group.default[index(var.log_delivery_configuration, log_delivery_configuration.value)].name) 192 | destination_type = lookup(log_delivery_configuration.value, "destination_type", null) 193 | log_format = lookup(log_delivery_configuration.value, "log_format", null) 194 | log_type = lookup(log_delivery_configuration.value, "log_type", null) 195 | } 196 | } 197 | } 198 | 199 | ##---------------------------------------------------------------------------------- 200 | ## Below resource will create cluster. 201 | ##---------------------------------------------------------------------------------- 202 | resource "aws_elasticache_cluster" "default" { 203 | count = var.enable && var.cluster_enabled ? 1 : 0 204 | engine = lookup(var.replication_group, "engine", "") 205 | cluster_id = module.labels.id 206 | engine_version = lookup(var.replication_group, "engine_version", "") 207 | port = lookup(var.replication_group, "port", "") 208 | num_cache_nodes = var.num_cache_nodes 209 | az_mode = var.az_mode 210 | parameter_group_name = lookup(var.replication_group, "parameter_group_name", "default.redis5.0") 211 | node_type = lookup(var.replication_group, "node_type", "cache.t2.small") 212 | subnet_group_name = join("", aws_elasticache_subnet_group.default[*].name) 213 | security_group_ids = length(var.sg_ids) < 1 ? aws_security_group.default[*].id : var.sg_ids 214 | snapshot_arns = var.snapshot_arns 215 | snapshot_name = lookup(var.replication_group, "snapshot_name", "") 216 | notification_topic_arn = lookup(var.replication_group, "notification_topic_arn", "") 217 | snapshot_window = lookup(var.replication_group, "snapshot_window", null) 218 | snapshot_retention_limit = lookup(var.replication_group, "snapshot_retention_limit", "0") 219 | apply_immediately = lookup(var.replication_group, "apply_immediately", false) 220 | preferred_availability_zones = slice(var.availability_zones, 0, var.num_cache_nodes) 221 | maintenance_window = lookup(var.replication_group, "maintenance_window", "sun:05:00-sun:06:00") 222 | network_type = var.network_type 223 | tags = module.labels.tags 224 | 225 | } 226 | 227 | ##---------------------------------------------------------------------------------- 228 | ## Below resource will create ROUTE-53 resource for redis and memcached. 229 | ##---------------------------------------------------------------------------------- 230 | resource "aws_route53_record" "elasticache" { 231 | count = var.enable && var.route53_record_enabled ? 1 : 0 232 | 233 | name = lookup(var.route53, "dns_record_name", "elasticache") 234 | type = lookup(var.route53, "route53_type", "") 235 | ttl = lookup(var.route53, "route53_ttl", null) 236 | zone_id = lookup(var.route53, "route53_zone_id", null) 237 | records = lookup(var.replication_group, "automatic_failover_enabled", true) ? [aws_elasticache_replication_group.cluster[0].configuration_endpoint_address] : [aws_elasticache_replication_group.cluster[0].primary_endpoint_address] 238 | } 239 | 240 | ##---------------------------------------------------------------------------------- 241 | ## Below resource will create ssm-parameter resource for redis and memcached with auth-token. 242 | ##---------------------------------------------------------------------------------- 243 | resource "aws_ssm_parameter" "secret" { 244 | count = var.enable && var.auth_token_enable ? 1 : 0 245 | 246 | name = format("/%s/%s/auth-token", var.environment, var.name) 247 | description = var.ssm_parameter_description 248 | type = var.ssm_parameter_type 249 | value = var.auth_token == null ? random_password.auth_token[0].result : var.auth_token 250 | key_id = var.kms_key_id == "" ? join("", aws_kms_key.default[*].arn) : var.kms_key_id 251 | } 252 | 253 | ##---------------------------------------------------------------------------------- 254 | ## Below resource will create ssm-parameter resource for redis with endpoint. 255 | ##---------------------------------------------------------------------------------- 256 | resource "aws_ssm_parameter" "secret-endpoint" { 257 | count = var.enable && var.ssm_parameter_endpoint_enabled ? 1 : 0 258 | 259 | name = format("/%s/%s/endpoint", var.environment, var.name) 260 | description = var.ssm_parameter_description 261 | type = var.ssm_parameter_type 262 | value = lookup(var.replication_group, "automatic_failover_enabled", true) ? [join("", aws_elasticache_replication_group.cluster[*].configuration_endpoint_address)][0] : [join("", aws_elasticache_replication_group.cluster[*].primary_endpoint_address)][0] 263 | key_id = var.kms_key_id == "" ? join("", aws_kms_key.default[*].arn) : var.kms_key_id 264 | } 265 | 266 | ##---------------------------------------------------------------------------------- 267 | ## Below resource will create ROUTE-53 resource for memcached. 268 | ##---------------------------------------------------------------------------------- 269 | resource "aws_route53_record" "memcached_route_53" { 270 | count = var.enable && var.memcached_route53_record_enabled ? 1 : 0 271 | 272 | name = lookup(var.route53, "dns_record_name", "") 273 | type = lookup(var.route53, "route53_type", "A") 274 | ttl = lookup(var.route53, "route53_ttl", 300) 275 | zone_id = lookup(var.route53, "route53_zone_id", null) 276 | records = aws_elasticache_cluster.default[*].configuration_endpoint 277 | } 278 | 279 | ##---------------------------------------------------------------------------------- 280 | ## Below resource will create ssm-parameter resource for memcached with endpoint. 281 | ##---------------------------------------------------------------------------------- 282 | resource "aws_ssm_parameter" "memcached_secret-endpoint" { 283 | count = var.enable && var.memcached_ssm_parameter_endpoint_enabled ? 1 : 0 284 | 285 | name = format("/%s/%s/memcached-endpoint", var.environment, var.name) 286 | description = var.ssm_parameter_description 287 | type = var.ssm_parameter_type 288 | value = join("", aws_elasticache_cluster.default[*].configuration_endpoint) 289 | key_id = var.kms_key_id == "" ? join("", aws_kms_key.default[*].arn) : var.kms_key_id 290 | } 291 | -------------------------------------------------------------------------------- /outputs.tf: -------------------------------------------------------------------------------- 1 | # Module : Redis 2 | # Description : Terraform module to create Elasticache Cluster and replica for Redis. 3 | output "id" { 4 | value = var.cluster_enabled ? "" : (var.cluster_replication_enabled ? join("", aws_elasticache_replication_group.cluster[*].id) : join("", aws_elasticache_replication_group.cluster[*].id)) 5 | description = "Redis cluster id." 6 | } 7 | 8 | output "port" { 9 | value = lookup(var.replication_group, "port", null) 10 | sensitive = true 11 | description = "Redis port." 12 | } 13 | 14 | output "tags" { 15 | value = module.labels.tags 16 | description = "A mapping of tags to assign to the resource." 17 | } 18 | 19 | output "redis_endpoint" { 20 | value = var.cluster_replication_enabled ? "" : (var.cluster_replication_enabled ? join("", aws_elasticache_replication_group.cluster[*].primary_endpoint_address) : join("", aws_elasticache_cluster.default[*].configuration_endpoint)) 21 | description = "Redis endpoint address." 22 | } 23 | 24 | output "redis_arn" { 25 | value = var.enable && length(aws_elasticache_replication_group.cluster) > 0 ? aws_elasticache_replication_group.cluster[0].arn : length(aws_elasticache_replication_group.cluster) > 0 ? aws_elasticache_replication_group.cluster[0].arn : null 26 | description = "Redis arn" 27 | } 28 | 29 | output "memcached_endpoint" { 30 | value = var.enable && var.cluster_enabled ? join("", aws_elasticache_cluster.default[*].configuration_endpoint) : null 31 | description = "Memcached endpoint address." 32 | } 33 | 34 | output "memcached_arn" { 35 | value = var.enable && length(aws_elasticache_cluster.default) > 0 ? aws_elasticache_cluster.default[0].arn : null 36 | description = "Memcached arn" 37 | } 38 | 39 | output "sg_id" { 40 | value = try(join("", aws_security_group.default[*].id), null) 41 | } 42 | 43 | output "hostname" { 44 | value = try(join("", aws_route53_record.elasticache[*].fqdn), null) 45 | description = "DNS hostname" 46 | } 47 | 48 | output "memcached_hostname" { 49 | value = try(join("", aws_route53_record.memcached_route_53[*].fqdn), null) 50 | description = "DNS hostname" 51 | } 52 | 53 | output "redis_ssm_name" { 54 | value = try(join("", aws_ssm_parameter.secret-endpoint[*].name), null) 55 | description = "A list of all of the parameter values" 56 | } 57 | 58 | output "Memcached_ssm_name" { 59 | value = try(join("", aws_ssm_parameter.memcached_secret-endpoint[*].name), null) 60 | description = "A list of all of the parameter values" 61 | } 62 | 63 | output "auth_token" { 64 | value = var.enable && var.auth_token_enable ? random_password.auth_token[0].result : null 65 | sensitive = true 66 | description = "Auth token generated value" 67 | } -------------------------------------------------------------------------------- /variables.tf: -------------------------------------------------------------------------------- 1 | #Module : LABEL 2 | #Description : Terraform label module variables. 3 | variable "name" { 4 | type = string 5 | default = "" 6 | description = "Name (e.g. `app` or `cluster`)." 7 | } 8 | 9 | variable "repository" { 10 | type = string 11 | default = "https://github.com/clouddrove/terraform-aws-elasticache" 12 | description = "Terraform current module repo" 13 | 14 | validation { 15 | condition = can(regex("^https://", var.repository)) 16 | error_message = "The module-repo value must be a valid Git repo link." 17 | } 18 | } 19 | 20 | variable "environment" { 21 | type = string 22 | default = "" 23 | description = "Environment (e.g. `prod`, `dev`, `staging`)." 24 | } 25 | 26 | variable "label_order" { 27 | type = list(any) 28 | default = ["environment", "name"] 29 | description = "Label order, e.g. `name`,`application`." 30 | } 31 | 32 | variable "extra_tags" { 33 | type = map(string) 34 | default = {} 35 | description = "Additional tags (e.g. map(`BusinessUnit`,`XYZ`)." 36 | } 37 | 38 | variable "managedby" { 39 | type = string 40 | default = "anmol@clouddrove.com" 41 | description = "ManagedBy, eg 'CloudDrove' or 'AnmolNagpal'." 42 | } 43 | 44 | variable "enable" { 45 | type = bool 46 | default = true 47 | description = "Enable or disable of elasticache" 48 | } 49 | 50 | variable "user_group_ids" { 51 | type = list(string) 52 | default = null 53 | description = "User Group ID to associate with the replication group." 54 | } 55 | variable "security_group_names" { 56 | type = list(string) 57 | default = null 58 | description = "A list of cache security group names to associate with this replication group." 59 | } 60 | 61 | variable "snapshot_arns" { 62 | type = list(string) 63 | default = null 64 | description = "A single-element string list containing an Amazon Resource Name (ARN) of a Redis RDB snapshot file stored in Amazon S3." 65 | } 66 | 67 | variable "replication_group" { 68 | type = map(any) 69 | default = {} 70 | } 71 | 72 | variable "subnet_ids" { 73 | type = list(any) 74 | default = [] 75 | description = "List of VPC Subnet IDs for the cache subnet group." 76 | sensitive = true 77 | } 78 | 79 | variable "subnet_group_description" { 80 | type = string 81 | default = "The Description of the ElastiCache Subnet Group." 82 | description = "Description for the cache subnet group. Defaults to `Managed by Terraform`." 83 | } 84 | 85 | variable "availability_zones" { 86 | type = list(string) 87 | description = "A list of EC2 availability zones in which the replication group's cache clusters will be created. The order of the availability zones in the list is not important." 88 | } 89 | 90 | variable "auth_token_enable" { 91 | type = bool 92 | default = true 93 | description = "Flag to specify whether to create auth token (password) protected cluster. Can be specified only if transit_encryption_enabled = true." 94 | } 95 | 96 | variable "auth_token" { 97 | type = string 98 | default = null 99 | description = "The password used to access a password protected server. Can be specified only if transit_encryption_enabled = true. Find auto generated auth_token in terraform.tfstate or in AWS SSM Parameter Store." 100 | } 101 | 102 | variable "cluster_replication_enabled" { 103 | type = bool 104 | default = false 105 | description = "(Redis only) Enabled or disabled replication_group for redis cluster." 106 | } 107 | 108 | # Module : Cluster 109 | # Description : Terraform cluster module variables. 110 | variable "cluster_enabled" { 111 | type = bool 112 | default = false 113 | description = "(Memcache only) Enabled or disabled cluster." 114 | } 115 | 116 | variable "num_cache_nodes" { 117 | type = number 118 | default = 1 119 | description = "(Required unless replication_group_id is provided) The initial number of cache nodes that the cache cluster will have. For Redis, this value must be 1. For Memcache, this value must be between 1 and 20. If this number is reduced on subsequent runs, the highest numbered nodes will be removed." 120 | } 121 | 122 | variable "az_mode" { 123 | type = string 124 | default = "single-az" 125 | description = "(Memcached only) Specifies whether the nodes in this Memcached node group are created in a single Availability Zone or created across multiple Availability Zones in the cluster's region. Valid values for this parameter are single-az or cross-az, default is single-az. If you want to choose cross-az, num_cache_nodes must be greater than 1." 126 | } 127 | 128 | variable "log_delivery_configuration" { 129 | type = list(map(any)) 130 | default = [] 131 | description = "The log_delivery_configuration block allows the streaming of Redis SLOWLOG or Redis Engine Log to CloudWatch Logs or Kinesis Data Firehose. Max of 2 blocks." 132 | } 133 | 134 | variable "retention_in_days" { 135 | type = number 136 | default = 0 137 | description = "Specifies the number of days you want to retain log events in the specified log group." 138 | } 139 | 140 | variable "kms_key_enabled" { 141 | type = bool 142 | default = true 143 | description = "Specifies whether the kms is enabled or disabled." 144 | } 145 | 146 | variable "kms_key_id" { 147 | type = string 148 | default = "" 149 | description = "The ARN of the key that you wish to use if encrypting at rest. If not supplied, uses service managed encryption. Can be specified only if at_rest_encryption_enabled = true." 150 | } 151 | 152 | variable "alias" { 153 | type = string 154 | default = "alias/redis" 155 | description = "The display name of the alias. The name must start with the word `alias` followed by a forward slash." 156 | } 157 | 158 | variable "kms_description" { 159 | type = string 160 | default = "Parameter Store KMS master key" 161 | description = "The description of the key as viewed in AWS console." 162 | } 163 | 164 | variable "key_usage" { 165 | type = string 166 | default = "ENCRYPT_DECRYPT" 167 | sensitive = true 168 | description = "Specifies the intended use of the key. Defaults to ENCRYPT_DECRYPT, and only symmetric encryption and decryption are supported." 169 | } 170 | 171 | variable "network_type" { 172 | type = string 173 | default = "ipv4" 174 | description = "value of the network type. Valid values are ipv4, ipv6 or dual_stack." 175 | } 176 | 177 | 178 | variable "deletion_window_in_days" { 179 | type = number 180 | default = 7 181 | description = "Duration in days after which the key is deleted after destruction of the resource." 182 | } 183 | 184 | variable "is_enabled" { 185 | type = bool 186 | default = true 187 | description = "Specifies whether the key is enabled." 188 | } 189 | 190 | variable "enable_key_rotation" { 191 | type = string 192 | default = true 193 | description = "Specifies whether key rotation is enabled." 194 | } 195 | 196 | variable "customer_master_key_spec" { 197 | type = string 198 | default = "SYMMETRIC_DEFAULT" 199 | description = "Specifies whether the key contains a symmetric key or an asymmetric key pair and the encryption algorithms or signing algorithms that the key supports. Valid values: SYMMETRIC_DEFAULT, RSA_2048, RSA_3072, RSA_4096, ECC_NIST_P256, ECC_NIST_P384, ECC_NIST_P521, or ECC_SECG_P256K1. Defaults to SYMMETRIC_DEFAULT." 200 | sensitive = true 201 | } 202 | 203 | variable "kms_multi_region" { 204 | type = bool 205 | default = false 206 | description = "Indicates whether the KMS key is a multi-Region (true) or regional (false) key." 207 | } 208 | variable "vpc_id" { 209 | type = string 210 | default = "" 211 | description = "The ID of the VPC that the instance security group belongs to." 212 | sensitive = true 213 | } 214 | 215 | variable "allowed_ip" { 216 | type = list(any) 217 | default = [] 218 | description = "List of allowed ip." 219 | } 220 | 221 | variable "allowed_ports" { 222 | type = list(any) 223 | default = [] 224 | description = "List of allowed ingress ports" 225 | } 226 | 227 | variable "protocol" { 228 | type = string 229 | default = "tcp" 230 | description = "The protocol. If not icmp, tcp, udp, or all use the." 231 | } 232 | 233 | variable "enable_security_group" { 234 | type = bool 235 | default = true 236 | description = "Enable default Security Group with only Egress traffic allowed." 237 | } 238 | 239 | variable "egress_rule" { 240 | type = bool 241 | default = true 242 | description = "Enable to create egress rule" 243 | } 244 | 245 | variable "is_external" { 246 | type = bool 247 | default = false 248 | description = "enable to udated existing security Group" 249 | } 250 | 251 | variable "sg_ids" { 252 | type = list(any) 253 | default = [] 254 | description = "of the security group id." 255 | } 256 | 257 | variable "sg_description" { 258 | type = string 259 | default = "Instance default security group (only egress access is allowed)." 260 | description = "The security group description." 261 | } 262 | variable "sg_egress_description" { 263 | type = string 264 | default = "Description of the rule." 265 | description = "Description of the egress and ingress rule" 266 | } 267 | 268 | variable "sg_egress_ipv6_description" { 269 | type = string 270 | default = "Description of the rule." 271 | description = "Description of the egress_ipv6 rule" 272 | } 273 | 274 | variable "sg_ingress_description" { 275 | type = string 276 | default = "Description of the ingress rule use elasticache." 277 | description = "Description of the ingress rule" 278 | } 279 | 280 | ##---------------------route53------------------------ 281 | variable "route53_record_enabled" { 282 | type = bool 283 | default = false 284 | description = "Whether to create Route53 record set." 285 | } 286 | 287 | variable "memcached_route53_record_enabled" { 288 | type = bool 289 | default = false 290 | description = "Whether to create Route53 record memcached set." 291 | } 292 | 293 | variable "route53" { 294 | type = map(any) 295 | default = {} 296 | description = "Route53 Configurations." 297 | } 298 | 299 | ###------------------------------- ssm_parameter---------------------------- 300 | 301 | variable "ssm_parameter_endpoint_enabled" { 302 | type = bool 303 | default = false 304 | description = "Name of the parameter." 305 | } 306 | 307 | variable "memcached_ssm_parameter_endpoint_enabled" { 308 | type = bool 309 | default = false 310 | description = "Name of the parameter." 311 | } 312 | 313 | variable "ssm_parameter_description" { 314 | type = string 315 | default = "Description of the parameter." 316 | description = "SSM Parameters can be imported using." 317 | } 318 | 319 | variable "ssm_parameter_type" { 320 | type = string 321 | default = "SecureString" 322 | description = "Type of the parameter." 323 | } 324 | 325 | ###------------------------------- random_password---------------------------- 326 | 327 | variable "length" { 328 | type = number 329 | default = 25 330 | } 331 | 332 | variable "special" { 333 | type = bool 334 | default = false 335 | 336 | } 337 | -------------------------------------------------------------------------------- /versions.tf: -------------------------------------------------------------------------------- 1 | # Terraform version 2 | terraform { 3 | required_version = ">= 1.6.5" 4 | 5 | required_providers { 6 | aws = { 7 | source = "hashicorp/aws" 8 | version = ">= 5.31.0" 9 | } 10 | random = { 11 | source = "hashicorp/random" 12 | version = ">= 3.6.0" 13 | } 14 | } 15 | } 16 | --------------------------------------------------------------------------------
"environment",
"name"
]