├── test ├── .gitignore ├── src │ ├── .gitignore │ ├── Makefile │ ├── examples_serverless_test.go │ ├── examples_complete_test.go │ ├── default_test.go │ ├── aws_utils.go │ ├── framework_test.go │ └── go.mod ├── Makefile.alpine └── Makefile ├── .github ├── ISSUE_TEMPLATE │ ├── question.md │ ├── config.yml │ ├── bug_report.md │ ├── feature_request.md │ ├── bug_report.yml │ └── feature_request.yml ├── mergify.yml ├── banner.png ├── workflows │ ├── release.yml │ ├── scheduled.yml │ ├── chatops.yml │ └── branch.yml ├── renovate.json ├── settings.yml ├── PULL_REQUEST_TEMPLATE.md └── CODEOWNERS ├── .gitignore ├── examples ├── complete │ ├── versions.tf │ ├── fixtures.us-east-2.tfvars │ ├── outputs.tf │ ├── main.tf │ ├── variables.tf │ └── context.tf └── serverless │ ├── versions.tf │ ├── fixtures.us-east-2.tfvars │ ├── outputs.tf │ ├── main.tf │ ├── variables.tf │ └── context.tf ├── versions.tf ├── atmos.yaml ├── outputs.tf ├── README.yaml ├── main.tf ├── variables.tf ├── context.tf ├── LICENSE └── README.md /test/.gitignore: -------------------------------------------------------------------------------- 1 | .test-harness 2 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/question.md: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /.github/mergify.yml: -------------------------------------------------------------------------------- 1 | extends: .github 2 | -------------------------------------------------------------------------------- /test/src/.gitignore: -------------------------------------------------------------------------------- 1 | .gopath 2 | vendor/ 3 | -------------------------------------------------------------------------------- /.github/banner.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cloudposse/terraform-aws-documentdb-cluster/HEAD/.github/banner.png -------------------------------------------------------------------------------- /test/Makefile.alpine: -------------------------------------------------------------------------------- 1 | ifneq (,$(wildcard /sbin/apk)) 2 | ## Install all dependencies for alpine 3 | deps:: init 4 | @apk add --update terraform-docs@cloudposse json2hcl@cloudposse 5 | endif 6 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | # Compiled files 2 | *.tfstate 3 | *.tfstate.* 4 | *.tfstate.backup 5 | .terraform.tfstate.lock.info 6 | 7 | # Module directory 8 | .terraform/ 9 | .idea 10 | *.iml 11 | 12 | # Build Harness 13 | .build-harness 14 | build-harness/ 15 | -------------------------------------------------------------------------------- /examples/complete/versions.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_version = ">= 1.3" 3 | 4 | required_providers { 5 | aws = { 6 | source = "hashicorp/aws" 7 | version = ">= 6.8.0" 8 | } 9 | local = { 10 | source = "hashicorp/local" 11 | version = ">= 1.3" 12 | } 13 | } 14 | } 15 | -------------------------------------------------------------------------------- /examples/serverless/versions.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_version = ">= 1.3" 3 | 4 | required_providers { 5 | aws = { 6 | source = "hashicorp/aws" 7 | version = ">= 6.8.0" 8 | } 9 | local = { 10 | source = "hashicorp/local" 11 | version = ">= 1.3" 12 | } 13 | } 14 | } 15 | -------------------------------------------------------------------------------- /.github/workflows/release.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: release 3 | on: 4 | release: 5 | types: 6 | - published 7 | 8 | permissions: 9 | id-token: write 10 | contents: write 11 | pull-requests: write 12 | 13 | jobs: 14 | terraform-module: 15 | uses: cloudposse/.github/.github/workflows/shared-release-branches.yml@main 16 | secrets: inherit 17 | -------------------------------------------------------------------------------- /.github/renovate.json: -------------------------------------------------------------------------------- 1 | { 2 | "extends": [ 3 | "config:base", 4 | ":preserveSemverRanges", 5 | ":rebaseStalePrs" 6 | ], 7 | "baseBranches": ["main"], 8 | "labels": ["auto-update"], 9 | "dependencyDashboardAutoclose": true, 10 | "enabledManagers": ["terraform"], 11 | "terraform": { 12 | "ignorePaths": ["**/context.tf"] 13 | } 14 | } 15 | -------------------------------------------------------------------------------- /versions.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_version = ">= 1.3" 3 | 4 | required_providers { 5 | aws = { 6 | source = "hashicorp/aws" 7 | version = ">= 6.8.0" 8 | } 9 | local = { 10 | source = "hashicorp/local" 11 | version = ">= 1.3" 12 | } 13 | random = { 14 | source = "hashicorp/random" 15 | version = ">= 1.0" 16 | } 17 | } 18 | } 19 | -------------------------------------------------------------------------------- /.github/workflows/scheduled.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: scheduled 3 | on: 4 | workflow_dispatch: { } # Allows manually trigger this workflow 5 | schedule: 6 | - cron: "0 3 * * *" 7 | 8 | permissions: 9 | pull-requests: write 10 | id-token: write 11 | contents: write 12 | 13 | jobs: 14 | scheduled: 15 | uses: cloudposse/.github/.github/workflows/shared-terraform-scheduled.yml@main 16 | secrets: inherit 17 | -------------------------------------------------------------------------------- /.github/settings.yml: -------------------------------------------------------------------------------- 1 | # Upstream changes from _extends are only recognized when modifications are made to this file in the default branch. 2 | _extends: .github 3 | repository: 4 | name: terraform-aws-documentdb-cluster 5 | description: Terraform module to provision a DocumentDB cluster on AWS 6 | homepage: https://cloudposse.com/accelerate 7 | topics: mongodb, documentdb-cluster, documentdb, json, database, hcl2 8 | 9 | 10 | 11 | 12 | -------------------------------------------------------------------------------- /.github/workflows/chatops.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: chatops 3 | on: 4 | issue_comment: 5 | types: [created] 6 | 7 | permissions: 8 | pull-requests: write 9 | id-token: write 10 | contents: write 11 | statuses: write 12 | 13 | jobs: 14 | test: 15 | uses: cloudposse/.github/.github/workflows/shared-terraform-chatops.yml@main 16 | if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/terratest') }} 17 | secrets: inherit 18 | -------------------------------------------------------------------------------- /atmos.yaml: -------------------------------------------------------------------------------- 1 | # Atmos Configuration — powered by https://atmos.tools 2 | # 3 | # This configuration enables centralized, DRY, and consistent project scaffolding using Atmos. 4 | # 5 | # Included features: 6 | # - Organizational custom commands: https://atmos.tools/core-concepts/custom-commands 7 | # - Automated README generation: https://atmos.tools/cli/commands/docs/generate 8 | # 9 | 10 | # Import shared configuration used by all modules 11 | import: 12 | - https://raw.githubusercontent.com/cloudposse/.github/refs/heads/main/.github/atmos/terraform-module.yaml 13 | -------------------------------------------------------------------------------- /.github/workflows/branch.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: Branch 3 | on: 4 | pull_request: 5 | branches: 6 | - main 7 | - release/** 8 | types: [opened, synchronize, reopened, labeled, unlabeled] 9 | push: 10 | branches: 11 | - main 12 | - release/v* 13 | paths-ignore: 14 | - '.github/**' 15 | - 'docs/**' 16 | - 'examples/**' 17 | - 'test/**' 18 | - 'README.md' 19 | 20 | permissions: {} 21 | 22 | jobs: 23 | terraform-module: 24 | uses: cloudposse/.github/.github/workflows/shared-terraform-module.yml@main 25 | secrets: inherit 26 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/config.yml: -------------------------------------------------------------------------------- 1 | blank_issues_enabled: false 2 | 3 | contact_links: 4 | 5 | - name: Community Slack Team 6 | url: https://cloudposse.com/slack/ 7 | about: |- 8 | Please ask and answer questions here. 9 | 10 | - name: Office Hours 11 | url: https://cloudposse.com/office-hours/ 12 | about: |- 13 | Join us every Wednesday for FREE Office Hours (lunch & learn). 14 | 15 | - name: DevOps Accelerator Program 16 | url: https://cloudposse.com/accelerate/ 17 | about: |- 18 | Own your infrastructure in record time. We build it. You drive it. 19 | -------------------------------------------------------------------------------- /.github/PULL_REQUEST_TEMPLATE.md: -------------------------------------------------------------------------------- 1 | ## what 2 | 3 | 7 | 8 | ## why 9 | 10 | 15 | 16 | ## references 17 | 18 | 22 | -------------------------------------------------------------------------------- /examples/complete/fixtures.us-east-2.tfvars: -------------------------------------------------------------------------------- 1 | region = "us-east-2" 2 | 3 | availability_zones = ["us-east-2a", "us-east-2b"] 4 | 5 | namespace = "eg" 6 | 7 | stage = "test" 8 | 9 | name = "documentdb-cluster" 10 | 11 | vpc_cidr_block = "172.16.0.0/16" 12 | 13 | instance_class = "db.t4g.medium" 14 | 15 | cluster_size = 1 16 | 17 | db_port = 27017 18 | 19 | master_username = "admin1" 20 | 21 | master_password = "password1" 22 | 23 | retention_period = 5 24 | 25 | preferred_backup_window = "07:00-09:00" 26 | 27 | cluster_family = "docdb5.0" 28 | engine_version = "5.0.0" 29 | 30 | engine = "docdb" 31 | 32 | storage_encrypted = true 33 | 34 | storage_type = "standard" 35 | 36 | skip_final_snapshot = true 37 | 38 | apply_immediately = true 39 | 40 | ssm_parameter_enabled = true 41 | -------------------------------------------------------------------------------- /examples/serverless/fixtures.us-east-2.tfvars: -------------------------------------------------------------------------------- 1 | region = "us-east-2" 2 | 3 | availability_zones = ["us-east-2a", "us-east-2b"] 4 | 5 | namespace = "eg" 6 | 7 | stage = "test" 8 | 9 | name = "documentdb-cluster" 10 | 11 | vpc_cidr_block = "172.16.0.0/16" 12 | 13 | instance_class = "db.serverless" 14 | 15 | cluster_size = 1 16 | 17 | db_port = 27017 18 | 19 | master_username = "admin1" 20 | 21 | master_password = "password1" 22 | 23 | retention_period = 5 24 | 25 | preferred_backup_window = "07:00-09:00" 26 | 27 | cluster_family = "docdb5.0" 28 | engine_version = "5.0.0" 29 | 30 | engine = "docdb" 31 | 32 | storage_encrypted = true 33 | 34 | storage_type = "standard" 35 | 36 | skip_final_snapshot = true 37 | 38 | apply_immediately = true 39 | 40 | ssm_parameter_enabled = true 41 | 42 | serverless_v2_scaling_configuration = { 43 | min_capacity = 0.5 44 | max_capacity = 2 45 | } 46 | -------------------------------------------------------------------------------- /test/src/Makefile: -------------------------------------------------------------------------------- 1 | export TERRAFORM_VERSION ?= $(shell curl -s https://checkpoint-api.hashicorp.com/v1/check/terraform | jq -r -M '.current_version' | cut -d. -f1) 2 | 3 | .DEFAULT_GOAL : all 4 | 5 | .PHONY: all 6 | ## Default target 7 | all: test 8 | 9 | .PHONY : init 10 | ## Initialize tests 11 | init: 12 | @exit 0 13 | 14 | .PHONY : test 15 | ## Run tests 16 | test: init 17 | go mod download 18 | go test -v -timeout 60m -run '^Test[^_]' 19 | 20 | ## Run tests in docker container 21 | docker/test: 22 | docker run --name terratest --rm -it -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY -e AWS_SESSION_TOKEN -e GITHUB_TOKEN \ 23 | -e PATH="/usr/local/terraform/$(TERRAFORM_VERSION)/bin:/go/bin:/usr/local/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" \ 24 | -v $(CURDIR)/../../:/module/ cloudposse/test-harness:latest -C /module/test/src test 25 | 26 | .PHONY : clean 27 | ## Clean up files 28 | clean: 29 | rm -rf $(TF_DATA_DIR) 30 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/bug_report.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: Bug report 3 | about: Create a report to help us improve 4 | title: '' 5 | labels: 'bug' 6 | assignees: '' 7 | 8 | --- 9 | 10 | Found a bug? Maybe our [Slack Community](https://slack.cloudposse.com) can help. 11 | 12 | [![Slack Community](https://slack.cloudposse.com/badge.svg)](https://slack.cloudposse.com) 13 | 14 | ## Describe the Bug 15 | A clear and concise description of what the bug is. 16 | 17 | ## Expected Behavior 18 | A clear and concise description of what you expected to happen. 19 | 20 | ## Steps to Reproduce 21 | Steps to reproduce the behavior: 22 | 1. Go to '...' 23 | 2. Run '....' 24 | 3. Enter '....' 25 | 4. See error 26 | 27 | ## Screenshots 28 | If applicable, add screenshots or logs to help explain your problem. 29 | 30 | ## Environment (please complete the following information): 31 | 32 | Anything that will help us triage the bug will help. Here are some ideas: 33 | - OS: [e.g. Linux, OSX, WSL, etc] 34 | - Version [e.g. 10.15] 35 | 36 | ## Additional Context 37 | Add any other context about the problem here. -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/feature_request.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: Feature Request 3 | about: Suggest an idea for this project 4 | title: '' 5 | labels: 'feature request' 6 | assignees: '' 7 | 8 | --- 9 | 10 | Have a question? Please checkout our [Slack Community](https://slack.cloudposse.com) or visit our [Slack Archive](https://archive.sweetops.com/). 11 | 12 | [![Slack Community](https://slack.cloudposse.com/badge.svg)](https://slack.cloudposse.com) 13 | 14 | ## Describe the Feature 15 | 16 | A clear and concise description of what the bug is. 17 | 18 | ## Expected Behavior 19 | 20 | A clear and concise description of what you expected to happen. 21 | 22 | ## Use Case 23 | 24 | Is your feature request related to a problem/challenge you are trying to solve? Please provide some additional context of why this feature or capability will be valuable. 25 | 26 | ## Describe Ideal Solution 27 | 28 | A clear and concise description of what you want to happen. If you don't know, that's okay. 29 | 30 | ## Alternatives Considered 31 | 32 | Explain what alternative solutions or features you've considered. 33 | 34 | ## Additional Context 35 | 36 | Add any other context or screenshots about the feature request here. 37 | -------------------------------------------------------------------------------- /.github/CODEOWNERS: -------------------------------------------------------------------------------- 1 | # Use this file to define individuals or teams that are responsible for code in a repository. 2 | # Read more: 3 | # 4 | # Order is important: the last matching pattern has the highest precedence 5 | 6 | # These owners will be the default owners for everything 7 | * @cloudposse/engineering @cloudposse/contributors 8 | 9 | # Cloud Posse must review any changes to Makefiles 10 | **/Makefile @cloudposse/engineering 11 | **/Makefile.* @cloudposse/engineering 12 | 13 | # Cloud Posse must review any changes to GitHub actions 14 | .github/* @cloudposse/engineering 15 | 16 | # Cloud Posse must review any changes to standard context definition, 17 | # but some changes can be rubber-stamped. 18 | **/*.tf @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers 19 | README.yaml @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers 20 | README.md @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers 21 | docs/*.md @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers 22 | 23 | # Cloud Posse Admins must review all changes to CODEOWNERS or the mergify configuration 24 | .github/mergify.yml @cloudposse/admins 25 | .github/CODEOWNERS @cloudposse/admins 26 | -------------------------------------------------------------------------------- /test/Makefile: -------------------------------------------------------------------------------- 1 | TEST_HARNESS ?= https://github.com/cloudposse/test-harness.git 2 | TEST_HARNESS_BRANCH ?= master 3 | TEST_HARNESS_PATH = $(realpath .test-harness) 4 | BATS_ARGS ?= --tap 5 | BATS_LOG ?= test.log 6 | 7 | # Define a macro to run the tests 8 | define RUN_TESTS 9 | @echo "Running tests in $(1)" 10 | @cd $(1) && bats $(BATS_ARGS) $(addsuffix .bats,$(addprefix $(TEST_HARNESS_PATH)/test/terraform/,$(TESTS))) 11 | endef 12 | 13 | default: all 14 | 15 | -include Makefile.* 16 | 17 | ## Provision the test-harnesss 18 | .test-harness: 19 | [ -d $@ ] || git clone --depth=1 -b $(TEST_HARNESS_BRANCH) $(TEST_HARNESS) $@ 20 | 21 | ## Initialize the tests 22 | init: .test-harness 23 | 24 | ## Install all dependencies (OS specific) 25 | deps:: 26 | @exit 0 27 | 28 | ## Clean up the test harness 29 | clean: 30 | [ "$(TEST_HARNESS_PATH)" == "/" ] || rm -rf $(TEST_HARNESS_PATH) 31 | 32 | ## Run all tests 33 | all: module examples/complete 34 | all: module examples/serverless 35 | 36 | ## Run basic sanity checks against the module itself 37 | module: export TESTS ?= installed lint module-pinning provider-pinning validate terraform-docs input-descriptions output-descriptions 38 | module: deps 39 | $(call RUN_TESTS, ../) 40 | 41 | ## Run tests against complete example 42 | examples/complete: export TESTS ?= installed lint validate 43 | examples/complete: deps 44 | $(call RUN_TESTS, ../$@) 45 | 46 | ## Run tests against serverless example 47 | examples/serverless: export TESTS ?= installed lint validate 48 | examples/serverless: deps 49 | $(call RUN_TESTS, ../$@) 50 | -------------------------------------------------------------------------------- /test/src/examples_serverless_test.go: -------------------------------------------------------------------------------- 1 | package test 2 | 3 | import ( 4 | "context" 5 | "testing" 6 | 7 | "github.com/aws/aws-sdk-go-v2/aws" 8 | "github.com/aws/aws-sdk-go-v2/service/docdb" 9 | "github.com/gruntwork-io/terratest/modules/terraform" 10 | "github.com/stretchr/testify/assert" 11 | ) 12 | 13 | // Test the Terraform module in examples/serverless using Terratest. 14 | func testExamplesServerless(t *testing.T, terraformOptions *terraform.Options, randID string, _ string) { 15 | 16 | // Run `terraform output` to get the value of an output variable 17 | clusterName := terraform.Output(t, terraformOptions, "cluster_name") 18 | // Verify we're getting back the outputs we expect 19 | assert.Equal(t, "eg-test-documentdb-cluster-"+randID, clusterName) 20 | 21 | // Assert that AWS says the cluster is available 22 | docdbSvc := docdb.NewFromConfig(AWSConfig()) 23 | 24 | // Describe the cluster 25 | result, err := docdbSvc.DescribeDBClusters(context.TODO(), &docdb.DescribeDBClustersInput{ 26 | DBClusterIdentifier: &clusterName, 27 | }) 28 | assert.NoError(t, err) 29 | 30 | // Check if the slice is not empty and the status is available 31 | if len(result.DBClusters) > 0 { 32 | assert.Equal(t, "available", aws.ToString(result.DBClusters[0].Status), "Cluster is not in an available state") 33 | } else { 34 | assert.Fail(t, "No clusters found or cluster data is incomplete") 35 | } 36 | 37 | if result.DBClusters[0].ServerlessV2ScalingConfiguration != nil { 38 | assert.Equal(t, float64(0.5), aws.ToFloat64(result.DBClusters[0].ServerlessV2ScalingConfiguration.MinCapacity), "Min capacity is not as expected") 39 | assert.Equal(t, float64(2), aws.ToFloat64(result.DBClusters[0].ServerlessV2ScalingConfiguration.MaxCapacity), "Max capacity is not as expected") 40 | } else { 41 | assert.Fail(t, "Serverless V2 scaling configuration is not set") 42 | } 43 | } 44 | -------------------------------------------------------------------------------- /examples/complete/outputs.tf: -------------------------------------------------------------------------------- 1 | output "public_subnet_cidrs" { 2 | value = module.subnets.public_subnet_cidrs 3 | description = "Public subnet CIDRs" 4 | } 5 | 6 | output "private_subnet_cidrs" { 7 | value = module.subnets.private_subnet_cidrs 8 | description = "Private subnet CIDRs" 9 | } 10 | 11 | output "vpc_cidr" { 12 | value = module.vpc.vpc_cidr_block 13 | description = "VPC ID" 14 | } 15 | 16 | output "master_username" { 17 | value = module.documentdb_cluster.master_username 18 | description = "DocumentDB Username for the master DB user" 19 | } 20 | 21 | output "cluster_name" { 22 | value = module.documentdb_cluster.cluster_name 23 | description = "DocumentDB Cluster Identifier" 24 | } 25 | 26 | output "arn" { 27 | value = module.documentdb_cluster.arn 28 | description = "Amazon Resource Name (ARN) of the DocumentDB cluster" 29 | } 30 | 31 | output "endpoint" { 32 | value = module.documentdb_cluster.endpoint 33 | description = "Endpoint of the DocumentDB cluster" 34 | } 35 | 36 | output "reader_endpoint" { 37 | value = module.documentdb_cluster.reader_endpoint 38 | description = "Read-only endpoint of the DocumentDB cluster, automatically load-balanced across replicas" 39 | } 40 | 41 | output "master_host" { 42 | value = module.documentdb_cluster.master_host 43 | description = "DocumentDB master hostname" 44 | } 45 | 46 | output "replicas_host" { 47 | value = module.documentdb_cluster.replicas_host 48 | description = "DocumentDB replicas hostname" 49 | } 50 | 51 | output "security_group_id" { 52 | value = module.documentdb_cluster.security_group_id 53 | description = "ID of the DocumentDB cluster Security Group" 54 | } 55 | 56 | output "security_group_arn" { 57 | value = module.documentdb_cluster.security_group_arn 58 | description = "ARN of the DocumentDB cluster Security Group" 59 | } 60 | 61 | output "security_group_name" { 62 | value = module.documentdb_cluster.security_group_name 63 | description = "Name of the DocumentDB cluster Security Group" 64 | } 65 | -------------------------------------------------------------------------------- /examples/serverless/outputs.tf: -------------------------------------------------------------------------------- 1 | output "public_subnet_cidrs" { 2 | value = module.subnets.public_subnet_cidrs 3 | description = "Public subnet CIDRs" 4 | } 5 | 6 | output "private_subnet_cidrs" { 7 | value = module.subnets.private_subnet_cidrs 8 | description = "Private subnet CIDRs" 9 | } 10 | 11 | output "vpc_cidr" { 12 | value = module.vpc.vpc_cidr_block 13 | description = "VPC ID" 14 | } 15 | 16 | output "master_username" { 17 | value = module.documentdb_cluster.master_username 18 | description = "DocumentDB Username for the master DB user" 19 | } 20 | 21 | output "cluster_name" { 22 | value = module.documentdb_cluster.cluster_name 23 | description = "DocumentDB Cluster Identifier" 24 | } 25 | 26 | output "arn" { 27 | value = module.documentdb_cluster.arn 28 | description = "Amazon Resource Name (ARN) of the DocumentDB cluster" 29 | } 30 | 31 | output "endpoint" { 32 | value = module.documentdb_cluster.endpoint 33 | description = "Endpoint of the DocumentDB cluster" 34 | } 35 | 36 | output "reader_endpoint" { 37 | value = module.documentdb_cluster.reader_endpoint 38 | description = "Read-only endpoint of the DocumentDB cluster, automatically load-balanced across replicas" 39 | } 40 | 41 | output "master_host" { 42 | value = module.documentdb_cluster.master_host 43 | description = "DocumentDB master hostname" 44 | } 45 | 46 | output "replicas_host" { 47 | value = module.documentdb_cluster.replicas_host 48 | description = "DocumentDB replicas hostname" 49 | } 50 | 51 | output "security_group_id" { 52 | value = module.documentdb_cluster.security_group_id 53 | description = "ID of the DocumentDB cluster Security Group" 54 | } 55 | 56 | output "security_group_arn" { 57 | value = module.documentdb_cluster.security_group_arn 58 | description = "ARN of the DocumentDB cluster Security Group" 59 | } 60 | 61 | output "security_group_name" { 62 | value = module.documentdb_cluster.security_group_name 63 | description = "Name of the DocumentDB cluster Security Group" 64 | } 65 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/bug_report.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: Bug report 3 | description: Create a report to help us improve 4 | labels: ["bug"] 5 | assignees: [""] 6 | body: 7 | - type: markdown 8 | attributes: 9 | value: | 10 | Found a bug? 11 | 12 | Please checkout our [Slack Community](https://slack.cloudposse.com) 13 | or visit our [Slack Archive](https://archive.sweetops.com/). 14 | 15 | [![Slack Community](https://slack.cloudposse.com/badge.svg)](https://slack.cloudposse.com) 16 | 17 | - type: textarea 18 | id: concise-description 19 | attributes: 20 | label: Describe the Bug 21 | description: A clear and concise description of what the bug is. 22 | placeholder: What is the bug about? 23 | validations: 24 | required: true 25 | 26 | - type: textarea 27 | id: expected 28 | attributes: 29 | label: Expected Behavior 30 | description: A clear and concise description of what you expected. 31 | placeholder: What happened? 32 | validations: 33 | required: true 34 | 35 | - type: textarea 36 | id: reproduction-steps 37 | attributes: 38 | label: Steps to Reproduce 39 | description: Steps to reproduce the behavior. 40 | placeholder: How do we reproduce it? 41 | validations: 42 | required: true 43 | 44 | - type: textarea 45 | id: screenshots 46 | attributes: 47 | label: Screenshots 48 | description: If applicable, add screenshots or logs to help explain. 49 | validations: 50 | required: false 51 | 52 | - type: textarea 53 | id: environment 54 | attributes: 55 | label: Environment 56 | description: Anything that will help us triage the bug. 57 | placeholder: | 58 | - OS: [e.g. Linux, OSX, WSL, etc] 59 | - Version [e.g. 10.15] 60 | - Module version 61 | - Terraform version 62 | validations: 63 | required: false 64 | 65 | - type: textarea 66 | id: additional 67 | attributes: 68 | label: Additional Context 69 | description: | 70 | Add any other context about the problem here. 71 | validations: 72 | required: false 73 | -------------------------------------------------------------------------------- /outputs.tf: -------------------------------------------------------------------------------- 1 | output "master_username" { 2 | value = join("", aws_docdb_cluster.default[*].master_username) 3 | description = "Username for the master DB user" 4 | } 5 | 6 | output "master_password" { 7 | value = var.manage_master_user_password == true ? null : local.master_password 8 | description = "Password for the master DB user. If `manage_master_user_password` is set to true, this will be set to null and the password is managed by AWS in Secrets Manager." 9 | sensitive = true 10 | } 11 | 12 | output "cluster_name" { 13 | value = join("", aws_docdb_cluster.default[*].cluster_identifier) 14 | description = "Cluster Identifier" 15 | } 16 | 17 | output "arn" { 18 | value = join("", aws_docdb_cluster.default[*].arn) 19 | description = "Amazon Resource Name (ARN) of the cluster" 20 | } 21 | 22 | output "endpoint" { 23 | value = join("", aws_docdb_cluster.default[*].endpoint) 24 | description = "Endpoint of the DocumentDB cluster" 25 | } 26 | 27 | output "reader_endpoint" { 28 | value = join("", aws_docdb_cluster.default[*].reader_endpoint) 29 | description = "A read-only endpoint of the DocumentDB cluster, automatically load-balanced across replicas" 30 | } 31 | 32 | output "cluster_members" { 33 | value = flatten(aws_docdb_cluster.default[*].cluster_members) 34 | description = "List of DocumentDB Instances that are a part of this cluster" 35 | } 36 | 37 | output "master_host" { 38 | value = module.dns_master.hostname 39 | description = "DB master hostname" 40 | } 41 | 42 | output "replicas_host" { 43 | value = module.dns_replicas.hostname 44 | description = "DB replicas hostname" 45 | } 46 | 47 | output "security_group_id" { 48 | description = "ID of the DocumentDB cluster Security Group" 49 | value = join("", aws_security_group.default[*].id) 50 | } 51 | 52 | output "security_group_arn" { 53 | description = "ARN of the DocumentDB cluster Security Group" 54 | value = join("", aws_security_group.default[*].arn) 55 | } 56 | 57 | output "security_group_name" { 58 | description = "Name of the DocumentDB cluster Security Group" 59 | value = join("", aws_security_group.default[*].name) 60 | } 61 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/feature_request.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: Feature Request 3 | description: Suggest an idea for this project 4 | labels: ["feature request"] 5 | assignees: [""] 6 | body: 7 | - type: markdown 8 | attributes: 9 | value: | 10 | Have a question? 11 | 12 | Please checkout our [Slack Community](https://slack.cloudposse.com) 13 | or visit our [Slack Archive](https://archive.sweetops.com/). 14 | 15 | [![Slack Community](https://slack.cloudposse.com/badge.svg)](https://slack.cloudposse.com) 16 | 17 | - type: textarea 18 | id: concise-description 19 | attributes: 20 | label: Describe the Feature 21 | description: A clear and concise description of what the feature is. 22 | placeholder: What is the feature about? 23 | validations: 24 | required: true 25 | 26 | - type: textarea 27 | id: expected 28 | attributes: 29 | label: Expected Behavior 30 | description: A clear and concise description of what you expected. 31 | placeholder: What happened? 32 | validations: 33 | required: true 34 | 35 | - type: textarea 36 | id: use-case 37 | attributes: 38 | label: Use Case 39 | description: | 40 | Is your feature request related to a problem/challenge you are trying 41 | to solve? 42 | 43 | Please provide some additional context of why this feature or 44 | capability will be valuable. 45 | validations: 46 | required: true 47 | 48 | - type: textarea 49 | id: ideal-solution 50 | attributes: 51 | label: Describe Ideal Solution 52 | description: A clear and concise description of what you want to happen. 53 | validations: 54 | required: true 55 | 56 | - type: textarea 57 | id: alternatives-considered 58 | attributes: 59 | label: Alternatives Considered 60 | description: Explain alternative solutions or features considered. 61 | validations: 62 | required: false 63 | 64 | - type: textarea 65 | id: additional 66 | attributes: 67 | label: Additional Context 68 | description: | 69 | Add any other context about the problem here. 70 | validations: 71 | required: false 72 | -------------------------------------------------------------------------------- /test/src/examples_complete_test.go: -------------------------------------------------------------------------------- 1 | package test 2 | 3 | import ( 4 | "context" 5 | "github.com/aws/aws-sdk-go-v2/aws" 6 | "github.com/aws/aws-sdk-go-v2/service/docdb" 7 | "github.com/gruntwork-io/terratest/modules/terraform" 8 | "github.com/stretchr/testify/assert" 9 | "testing" 10 | ) 11 | 12 | // Test the Terraform module in examples/complete using Terratest. 13 | func testExamplesComplete(t *testing.T, terraformOptions *terraform.Options, randID string, _ string) { 14 | 15 | // Run `terraform output` to get the value of an output variable 16 | vpcCidr := terraform.Output(t, terraformOptions, "vpc_cidr") 17 | // Verify we're getting back the outputs we expect 18 | assert.Equal(t, "172.16.0.0/16", vpcCidr) 19 | 20 | // Run `terraform output` to get the value of an output variable 21 | privateSubnetCidrs := terraform.OutputList(t, terraformOptions, "private_subnet_cidrs") 22 | // Verify we're getting back the outputs we expect 23 | assert.Equal(t, []string{"172.16.0.0/19", "172.16.32.0/19"}, privateSubnetCidrs) 24 | 25 | // Run `terraform output` to get the value of an output variable 26 | publicSubnetCidrs := terraform.OutputList(t, terraformOptions, "public_subnet_cidrs") 27 | // Verify we're getting back the outputs we expect 28 | assert.Equal(t, []string{"172.16.96.0/19", "172.16.128.0/19"}, publicSubnetCidrs) 29 | 30 | // Run `terraform output` to get the value of an output variable 31 | securityGroupName := terraform.Output(t, terraformOptions, "security_group_name") 32 | // Verify we're getting back the outputs we expect 33 | assert.Equal(t, "eg-test-documentdb-cluster-"+randID, securityGroupName) 34 | 35 | // Run `terraform output` to get the value of an output variable 36 | clusterName := terraform.Output(t, terraformOptions, "cluster_name") 37 | // Verify we're getting back the outputs we expect 38 | assert.Equal(t, "eg-test-documentdb-cluster-"+randID, clusterName) 39 | 40 | // Run `terraform output` to get the value of an output variable 41 | endpoint := terraform.Output(t, terraformOptions, "endpoint") 42 | // Verify we're getting back the outputs we expect 43 | assert.Contains(t, endpoint, "eg-test-documentdb-cluster-"+randID+".cluster") 44 | 45 | // Run `terraform output` to get the value of an output variable 46 | readerEndpoint := terraform.Output(t, terraformOptions, "reader_endpoint") 47 | // Verify we're getting back the outputs we expect 48 | assert.Contains(t, readerEndpoint, "eg-test-documentdb-cluster-"+randID+".cluster-ro") 49 | 50 | // Assert that AWS says the cluster is available 51 | docdbSvc := docdb.NewFromConfig(AWSConfig()) 52 | 53 | // Describe the cluster 54 | result, err := docdbSvc.DescribeDBClusters(context.TODO(), &docdb.DescribeDBClustersInput{ 55 | DBClusterIdentifier: &clusterName, 56 | }) 57 | assert.NoError(t, err) 58 | 59 | // Check if the slice is not empty and the status is available 60 | if len(result.DBClusters) > 0 { 61 | assert.Equal(t, "available", aws.ToString(result.DBClusters[0].Status), "Cluster is not in an available state") 62 | } else { 63 | assert.Fail(t, "No clusters found or cluster data is incomplete") 64 | } 65 | } 66 | -------------------------------------------------------------------------------- /examples/complete/main.tf: -------------------------------------------------------------------------------- 1 | /* 2 | Useful references: 3 | 4 | https://docs.aws.amazon.com/documentdb/latest/developerguide/db-instance-classes.html#db-instance-class-specs 5 | https://docs.aws.amazon.com/documentdb/latest/developerguide/db-cluster-parameter-group-create.html 6 | https://www.terraform.io/docs/providers/aws/r/docdb_cluster.html 7 | https://www.terraform.io/docs/providers/aws/r/docdb_cluster_instance.html 8 | https://www.terraform.io/docs/providers/aws/r/docdb_cluster_parameter_group.html 9 | https://www.terraform.io/docs/providers/aws/r/docdb_subnet_group.html 10 | https://docs.aws.amazon.com/documentdb/latest/developerguide/troubleshooting.html 11 | */ 12 | 13 | provider "aws" { 14 | region = var.region 15 | } 16 | 17 | module "vpc" { 18 | source = "cloudposse/vpc/aws" 19 | version = "2.3.0" 20 | 21 | ipv4_primary_cidr_block = var.vpc_cidr_block 22 | 23 | context = module.this.context 24 | } 25 | 26 | module "subnets" { 27 | source = "cloudposse/dynamic-subnets/aws" 28 | version = "2.4.2" 29 | 30 | availability_zones = var.availability_zones 31 | vpc_id = module.vpc.vpc_id 32 | igw_id = [module.vpc.igw_id] 33 | ipv4_cidr_block = [module.vpc.vpc_cidr_block] 34 | nat_gateway_enabled = false 35 | nat_instance_enabled = false 36 | 37 | context = module.this.context 38 | } 39 | 40 | module "documentdb_cluster" { 41 | source = "../../" 42 | cluster_size = var.cluster_size 43 | master_username = var.master_username 44 | master_password = var.master_password 45 | instance_class = var.instance_class 46 | db_port = var.db_port 47 | vpc_id = module.vpc.vpc_id 48 | subnet_ids = module.subnets.private_subnet_ids 49 | zone_id = var.zone_id 50 | apply_immediately = var.apply_immediately 51 | auto_minor_version_upgrade = var.auto_minor_version_upgrade 52 | allowed_security_groups = var.allowed_security_groups 53 | allowed_cidr_blocks = var.allowed_cidr_blocks 54 | snapshot_identifier = var.snapshot_identifier 55 | retention_period = var.retention_period 56 | preferred_backup_window = var.preferred_backup_window 57 | preferred_maintenance_window = var.preferred_maintenance_window 58 | cluster_parameters = var.cluster_parameters 59 | cluster_family = var.cluster_family 60 | engine = var.engine 61 | engine_version = var.engine_version 62 | storage_encrypted = var.storage_encrypted 63 | storage_type = var.storage_type 64 | kms_key_id = var.kms_key_id 65 | skip_final_snapshot = var.skip_final_snapshot 66 | enabled_cloudwatch_logs_exports = var.enabled_cloudwatch_logs_exports 67 | cluster_dns_name = var.cluster_dns_name 68 | reader_dns_name = var.reader_dns_name 69 | ssm_parameter_enabled = var.ssm_parameter_enabled 70 | 71 | context = module.this.context 72 | } 73 | -------------------------------------------------------------------------------- /test/src/default_test.go: -------------------------------------------------------------------------------- 1 | // This file is a work-in-progress proposed set of `go` Test wrappers 2 | // to be standardized across all Cloud Posse Terraform modules. 3 | // This is likely to change, especially as we move from local helpers 4 | // to Terratest helpers. 5 | // This file should be considered a temporary solution as of June 2024 and should not be duplicated 6 | 7 | package test 8 | 9 | import ( 10 | "os" 11 | "regexp" 12 | "strings" 13 | "testing" 14 | 15 | "github.com/gruntwork-io/terratest/modules/logger" 16 | "github.com/gruntwork-io/terratest/modules/terraform" 17 | "github.com/stretchr/testify/assert" 18 | ) 19 | 20 | // Test the Terraform module in examples/complete using Terratest. 21 | func TestExamplesComplete(t *testing.T) { 22 | t.Parallel() 23 | 24 | testRunner(t, nil, testExamplesComplete, "examples/complete") 25 | } 26 | 27 | func TestExamplesCompleteDisabled(t *testing.T) { 28 | t.Parallel() 29 | 30 | vars := map[string]interface{}{ 31 | "enabled": false, 32 | } 33 | testRunner(t, vars, testExamplesCompleteDisabled, "examples/complete") 34 | } 35 | 36 | func testExamplesCompleteDisabled(t *testing.T, terraformOptions *terraform.Options, randID string, results string) { 37 | // Should complete successfully without creating or changing any resources. 38 | // Extract the "Resources:" section of the output to make the error message more readable. 39 | re := regexp.MustCompile(`Resources: [^.]+\.`) 40 | match := re.FindString(results) 41 | assert.Equal(t, "Resources: 0 added, 0 changed, 0 destroyed.", match, "Re-applying the same configuration should not change any resources") 42 | } 43 | 44 | // Test the Terraform module in examples/serverless using Terratest. 45 | func TestExamplesServerless(t *testing.T) { 46 | t.Parallel() 47 | 48 | testRunner(t, nil, testExamplesServerless, "examples/serverless") 49 | } 50 | 51 | // To speed up debugging, allow running the tests on an existing deployment, 52 | // without creating and destroying one. 53 | // Run this manually by creating a deployment in examples/complete with: 54 | // 55 | // export EXISTING_DEPLOYMENT_ATTRIBUTE="" 56 | // terraform init -upgrade 57 | // terraform apply -var-file fixtures.us-east-2.tfvars -var "attributes=[\"$EXISTING_DEPLOYMENT_ATTRIBUTE\"]" 58 | // 59 | // then in this directory (test/src) run 60 | // go test -run Test_ExistingDeployment 61 | 62 | func Test_ExistingDeployment(t *testing.T) { 63 | randID := strings.ToLower(os.Getenv("EXISTING_DEPLOYMENT_ATTRIBUTE")) 64 | if randID == "" { 65 | t.Skip("(This is normal): EXISTING_DEPLOYMENT_ATTRIBUTE is not set, skipping...") 66 | return 67 | } 68 | 69 | attributes := []string{randID} 70 | 71 | varFiles := []string{"fixtures.us-east-2.tfvars"} 72 | 73 | terraformOptions := &terraform.Options{ 74 | // The path to where our Terraform code is located 75 | TerraformDir: "../../examples/complete", 76 | Upgrade: true, 77 | // Variables to pass to our Terraform code using -var-file options 78 | VarFiles: varFiles, 79 | Vars: map[string]interface{}{ 80 | "attributes": attributes, 81 | }, 82 | } 83 | 84 | // Keep the output quiet 85 | if !testing.Verbose() { 86 | terraformOptions.Logger = logger.Discard 87 | } 88 | 89 | testExamplesComplete(t, terraformOptions, randID, "") 90 | } 91 | -------------------------------------------------------------------------------- /examples/serverless/main.tf: -------------------------------------------------------------------------------- 1 | /* 2 | Useful references: 3 | 4 | https://docs.aws.amazon.com/documentdb/latest/developerguide/db-instance-classes.html#db-instance-class-specs 5 | https://docs.aws.amazon.com/documentdb/latest/developerguide/db-cluster-parameter-group-create.html 6 | https://www.terraform.io/docs/providers/aws/r/docdb_cluster.html 7 | https://www.terraform.io/docs/providers/aws/r/docdb_cluster_instance.html 8 | https://www.terraform.io/docs/providers/aws/r/docdb_cluster_parameter_group.html 9 | https://www.terraform.io/docs/providers/aws/r/docdb_subnet_group.html 10 | https://docs.aws.amazon.com/documentdb/latest/developerguide/troubleshooting.html 11 | */ 12 | 13 | provider "aws" { 14 | region = var.region 15 | } 16 | 17 | module "vpc" { 18 | source = "cloudposse/vpc/aws" 19 | version = "2.1.1" 20 | 21 | ipv4_primary_cidr_block = var.vpc_cidr_block 22 | 23 | context = module.this.context 24 | } 25 | 26 | module "subnets" { 27 | source = "cloudposse/dynamic-subnets/aws" 28 | version = "2.4.2" 29 | 30 | availability_zones = var.availability_zones 31 | vpc_id = module.vpc.vpc_id 32 | igw_id = [module.vpc.igw_id] 33 | ipv4_cidr_block = [module.vpc.vpc_cidr_block] 34 | nat_gateway_enabled = false 35 | nat_instance_enabled = false 36 | 37 | context = module.this.context 38 | } 39 | 40 | module "documentdb_cluster" { 41 | source = "../../" 42 | cluster_size = var.cluster_size 43 | master_username = var.master_username 44 | master_password = var.master_password 45 | instance_class = var.instance_class 46 | db_port = var.db_port 47 | vpc_id = module.vpc.vpc_id 48 | subnet_ids = module.subnets.private_subnet_ids 49 | zone_id = var.zone_id 50 | apply_immediately = var.apply_immediately 51 | auto_minor_version_upgrade = var.auto_minor_version_upgrade 52 | allowed_security_groups = var.allowed_security_groups 53 | allowed_cidr_blocks = var.allowed_cidr_blocks 54 | snapshot_identifier = var.snapshot_identifier 55 | retention_period = var.retention_period 56 | preferred_backup_window = var.preferred_backup_window 57 | preferred_maintenance_window = var.preferred_maintenance_window 58 | cluster_parameters = var.cluster_parameters 59 | cluster_family = var.cluster_family 60 | engine = var.engine 61 | engine_version = var.engine_version 62 | storage_encrypted = var.storage_encrypted 63 | storage_type = var.storage_type 64 | kms_key_id = var.kms_key_id 65 | skip_final_snapshot = var.skip_final_snapshot 66 | enabled_cloudwatch_logs_exports = var.enabled_cloudwatch_logs_exports 67 | cluster_dns_name = var.cluster_dns_name 68 | reader_dns_name = var.reader_dns_name 69 | ssm_parameter_enabled = var.ssm_parameter_enabled 70 | serverless_v2_scaling_configuration = var.serverless_v2_scaling_configuration 71 | 72 | context = module.this.context 73 | } 74 | -------------------------------------------------------------------------------- /test/src/aws_utils.go: -------------------------------------------------------------------------------- 1 | // This file is a work-in-progress proposed set of utility functions 2 | // to be standardized across all Cloud Posse Terraform modules. 3 | // Most, if not all, of these functions will be replaced by 4 | // Terratest functions as they become available. 5 | // This file should be considered a temporary solution as of June 2024 and should not be duplicated 6 | 7 | package test 8 | 9 | // Support AWS operations 10 | // See https://aws.github.io/aws-sdk-go-v2/docs/getting-started/ 11 | // and https://pkg.go.dev/github.com/aws/aws-sdk-go-v2 12 | // 13 | // For type conversions, see https://pkg.go.dev/github.com/aws/aws-sdk-go-v2@v1.16.14/aws#hdr-Value_and_Pointer_Conversion_Utilities 14 | 15 | import ( 16 | "context" 17 | "github.com/aws/aws-sdk-go-v2/aws" 18 | "github.com/aws/aws-sdk-go-v2/config" 19 | "github.com/aws/aws-sdk-go-v2/service/ssm" 20 | "github.com/stretchr/testify/assert" 21 | "log" 22 | "testing" 23 | ) 24 | 25 | func AWSConfig() aws.Config { 26 | return AWSConfigWithRegion("us-east-2") 27 | } 28 | 29 | func AWSConfigWithRegion(region string) aws.Config { 30 | // Load the Shared AWS Configuration (~/.aws/config) 31 | cfg, err := config.LoadDefaultConfig(context.TODO(), config.WithRegion(region)) 32 | if err != nil { 33 | log.Fatal(err) 34 | } 35 | 36 | return cfg 37 | } 38 | 39 | func AssertSSMParameterEqual(t *testing.T, ssmClient *ssm.Client, output map[string]interface{}, ssmPathOutput string, expectedValueOutput string) { 40 | 41 | if assert.NotEmpty(t, output[expectedValueOutput], "Missing "+expectedValueOutput) && 42 | assert.NotEmpty(t, output[ssmPathOutput], "Missing "+ssmPathOutput) { 43 | 44 | withDecryption := true 45 | param, err := ssmClient.GetParameter(context.TODO(), &ssm.GetParameterInput{ 46 | Name: aws.String(output[ssmPathOutput].(string)), 47 | WithDecryption: &withDecryption, 48 | }) 49 | 50 | if assert.Nil(t, err, "Unable to retrieve "+ssmPathOutput+" from SSM Parameter Store") { 51 | assert.Equal(t, output[expectedValueOutput].(string), aws.ToString(param.Parameter.Value)) 52 | } 53 | } 54 | } 55 | 56 | func AssertSSMParameterEmpty(t *testing.T, ssmClient *ssm.Client, output map[string]interface{}, ssmPathOutput string) { 57 | 58 | // No path given 59 | if output[ssmPathOutput] == nil || output[ssmPathOutput] == "" { 60 | return 61 | } 62 | 63 | withDecryption := true 64 | param, err := ssmClient.GetParameter(context.TODO(), &ssm.GetParameterInput{ 65 | Name: aws.String(output[ssmPathOutput].(string)), 66 | WithDecryption: &withDecryption, 67 | }) 68 | 69 | // If a path is given, there should be an empty value to go with it 70 | if assert.Nil(t, err, "Unable to retrieve "+ssmPathOutput+" from SSM Parameter Store") { 71 | assert.Empty(t, aws.ToString(param.Parameter.Value), "Found non-empty value for "+ssmPathOutput) 72 | } 73 | } 74 | 75 | func AssertSSMParameterNotEmpty(t *testing.T, ssmClient *ssm.Client, output map[string]interface{}, ssmPathOutput string) { 76 | 77 | if assert.NotEmpty(t, output[ssmPathOutput], "Missing "+ssmPathOutput) { 78 | 79 | withDecryption := true 80 | param, err := ssmClient.GetParameter(context.TODO(), &ssm.GetParameterInput{ 81 | Name: aws.String(output[ssmPathOutput].(string)), 82 | WithDecryption: &withDecryption, 83 | }) 84 | 85 | if assert.Nil(t, err, "Unable to retrieve "+ssmPathOutput+" from SSM Parameter Store") { 86 | assert.NotEmpty(t, aws.ToString(param.Parameter.Value), "Retrieved empty value for "+ssmPathOutput) 87 | } 88 | } 89 | } 90 | -------------------------------------------------------------------------------- /README.yaml: -------------------------------------------------------------------------------- 1 | # 2 | # This is the canonical configuration for the `README.md` 3 | # Run `make readme` to rebuild the `README.md` 4 | # 5 | 6 | # Name of this project 7 | name: terraform-aws-documentdb-cluster 8 | # Tags of this project 9 | tags: 10 | - aws 11 | - terraform 12 | - terraform-modules 13 | - databases 14 | - documentdb 15 | - mongodb 16 | - cluster 17 | # Categories of this project 18 | categories: 19 | - terraform-modules/databases 20 | # Logo for this project 21 | #logo: docs/logo.png 22 | 23 | # License of this project 24 | license: "APACHE2" 25 | # Canonical GitHub repo 26 | github_repo: cloudposse/terraform-aws-documentdb-cluster 27 | # Badges to display 28 | badges: 29 | - name: Latest Release 30 | image: https://img.shields.io/github/release/cloudposse/terraform-aws-documentdb-cluster.svg?style=for-the-badge 31 | url: https://github.com/cloudposse/terraform-aws-documentdb-cluster/releases/latest 32 | - name: Last Updated 33 | image: https://img.shields.io/github/last-commit/cloudposse/terraform-aws-documentdb-cluster.svg?style=for-the-badge 34 | url: https://github.com/cloudposse/terraform-aws-documentdb-cluster/commits 35 | - name: Slack Community 36 | image: https://slack.cloudposse.com/for-the-badge.svg 37 | url: https://cloudposse.com/slack 38 | 39 | # List any related terraform modules that this module may be used with or that this module depends on. 40 | related: 41 | - name: "terraform-aws-rds" 42 | description: "Terraform module to provision AWS RDS instances for MySQL or Postgres" 43 | url: "https://github.com/cloudposse/terraform-aws-rds" 44 | - name: "terraform-aws-rds-cluster" 45 | description: "Terraform module to provision an RDS Aurora cluster for MySQL or Postgres" 46 | url: "https://github.com/cloudposse/terraform-aws-rds-cluster" 47 | - name: "terraform-aws-rds-cloudwatch-sns-alarms" 48 | description: "Terraform module that configures important RDS alerts using CloudWatch and sends them to an SNS topic" 49 | url: "https://github.com/cloudposse/terraform-aws-rds-cloudwatch-sns-alarms" 50 | # Short description of this project 51 | description: |- 52 | Terraform module to provision an [`Amazon DocumentDB`](https://aws.amazon.com/documentdb/) cluster. 53 | # How to use this project 54 | usage: |2- 55 | 56 | For a complete example, see [examples/complete](examples/complete). 57 | 58 | For automated tests of the complete example using [bats](https://github.com/bats-core/bats-core) and [Terratest](https://github.com/gruntwork-io/terratest) (which tests and deploys the example on AWS), see [test](test). 59 | 60 | ```hcl 61 | module "documentdb_cluster" { 62 | source = "cloudposse/documentdb-cluster/aws" 63 | # Cloud Posse recommends pinning every module to a specific version 64 | # version = "x.x.x" 65 | namespace = "eg" 66 | stage = "testing" 67 | name = "docdb" 68 | cluster_size = 3 69 | master_username = "admin1" 70 | master_password = "Test123456789" 71 | instance_class = "db.r4.large" 72 | vpc_id = "vpc-xxxxxxxx" 73 | subnet_ids = ["subnet-xxxxxxxx", "subnet-yyyyyyyy"] 74 | allowed_security_groups = ["sg-xxxxxxxx"] 75 | zone_id = "Zxxxxxxxx" 76 | } 77 | ``` 78 | references: 79 | - name: Creating an Amazon DocumentDB Cluster 80 | description: official AWS documentation on how to create a DocumentDB cluster 81 | url: https://docs.aws.amazon.com/documentdb/latest/developerguide/db-cluster-create.html 82 | - name: Amazon DocumentDB Instance Class Specifications 83 | description: provides details of the Amazon DocumentDB instance classes 84 | url: https://docs.aws.amazon.com/documentdb/latest/developerguide/db-instance-classes.html#db-instance-class-specs 85 | - name: Creating an Amazon DocumentDB Cluster Parameter Group 86 | description: official AWS documentation on how to create an Amazon DocumentDB Cluster Parameter Group 87 | url: https://docs.aws.amazon.com/documentdb/latest/developerguide/db-cluster-parameter-group-create.html 88 | - name: Amazon DocumentDB Limits 89 | description: describes the resource limits and naming constraints for Amazon DocumentDB 90 | url: https://docs.aws.amazon.com/documentdb/latest/developerguide/limits.html 91 | - name: Understanding Amazon DocumentDB Amazon Resource Names (ARNs) 92 | description: describes ARN formats for DocumentDB resources 93 | url: https://docs.aws.amazon.com/documentdb/latest/developerguide/documentdb-arns.html 94 | - name: Amazon DocumentDB Parameters 95 | description: lists all the parameters that are specific to a DocumentDB cluster 96 | url: https://docs.aws.amazon.com/documentdb/latest/developerguide/db-cluster-parameters.html 97 | - name: Tagging Amazon DocumentDB Resources 98 | description: describes how to use tags to add metadata to DocumentDB resources 99 | url: https://docs.aws.amazon.com/documentdb/latest/developerguide/tagging.html 100 | - name: Amazon DocumentDB FAQs 101 | description: DocumentDB frequently asked questions 102 | url: https://aws.amazon.com/documentdb/faqs/ 103 | - name: Troubleshooting Amazon DocumentDB 104 | description: provides information about how to troubleshoot problems that you might encounter when using Amazon DocumentDB 105 | url: https://docs.aws.amazon.com/documentdb/latest/developerguide/troubleshooting.html 106 | # Example usage 107 | #examples: |- 108 | # Example goes here... 109 | 110 | # How to get started quickly 111 | #quickstart: |- 112 | # Here's how to get started... 113 | 114 | # Other files to include in this README from the project folder 115 | include: [] 116 | contributors: [] 117 | -------------------------------------------------------------------------------- /test/src/framework_test.go: -------------------------------------------------------------------------------- 1 | // This file is a work-in-progress proposed set of utility functions 2 | // to be standardized across all Cloud Posse Terraform modules. 3 | // Most, if not all, of these functions will be replaced by 4 | // Terratest functions as they become available. 5 | // This file should be considered a temporary solution as of June 2024 and should not be duplicated 6 | 7 | package test 8 | 9 | import ( 10 | "context" 11 | "encoding/base64" 12 | "github.com/gruntwork-io/terratest/modules/logger" 13 | "github.com/gruntwork-io/terratest/modules/random" 14 | "github.com/gruntwork-io/terratest/modules/terraform" 15 | testStructure "github.com/gruntwork-io/terratest/modules/test-structure" 16 | "github.com/stretchr/testify/assert" 17 | "github.com/stretchr/testify/require" 18 | corev1 "k8s.io/api/core/v1" 19 | metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" 20 | "k8s.io/apimachinery/pkg/util/runtime" 21 | "k8s.io/client-go/kubernetes" 22 | "k8s.io/client-go/rest" 23 | "os" 24 | "sigs.k8s.io/aws-iam-authenticator/pkg/token" 25 | "strings" 26 | "testing" 27 | 28 | "github.com/aws/aws-sdk-go/aws" 29 | "github.com/aws/aws-sdk-go/service/eks" 30 | ) 31 | 32 | // Test the Terraform module in terraformFolderRelativeToRoot using Terratest. 33 | func testRunner(t *testing.T, vars map[string]interface{}, testFunc func(t *testing.T, terraformOptions *terraform.Options, randID string, results string), terraformFolderRelativeToRoot string) { 34 | varFiles := []string{"fixtures.us-east-2.tfvars"} 35 | 36 | terraformOptions := &terraform.Options{ 37 | VarFiles: varFiles, 38 | Vars: vars, 39 | } 40 | 41 | explicitTestRunner(t, terraformOptions, testFunc, terraformFolderRelativeToRoot) 42 | } 43 | 44 | func explicitTestRunner(t *testing.T, terraformOptions *terraform.Options, 45 | testFunc func(t *testing.T, terraformOptions *terraform.Options, randID string, results string), terraformFolderRelativeToRoot string) { 46 | 47 | randID := strings.ToLower(random.UniqueId()) 48 | attributes := []string{randID} 49 | 50 | // If supplied vars is nil, create a new map with the attributes 51 | vars := terraformOptions.Vars 52 | if vars == nil { 53 | vars = map[string]interface{}{ 54 | "attributes": attributes, 55 | } 56 | } else { 57 | // If supplied vars is not nil, add the attributes to the existing map 58 | existingAttributes, ok := vars["attributes"].([]string) 59 | if !ok || len(existingAttributes) == 0 { 60 | vars["attributes"] = attributes 61 | } else { 62 | // If the existing map already has attributes, append the new attributes 63 | vars["attributes"] = append(existingAttributes, attributes...) 64 | } 65 | } 66 | 67 | rootFolder := "../../" 68 | 69 | tempTestFolder := testStructure.CopyTerraformFolderToTemp(t, rootFolder, terraformFolderRelativeToRoot) 70 | t.Logf("test run in temporary folder: %s", tempTestFolder) 71 | 72 | terraformOptions.TerraformDir = tempTestFolder 73 | terraformOptions.Upgrade = true 74 | terraformOptions.Vars = vars 75 | 76 | // Keep the output quiet 77 | if !testing.Verbose() { 78 | terraformOptions.Logger = logger.Discard 79 | } 80 | 81 | // At the end of the test, run `terraform destroy` to clean up any resources that were created 82 | defer cleanup(t, terraformOptions, tempTestFolder) 83 | 84 | // If the Go runtime crashes, try to clean up any resources that were created 85 | defer runtime.HandleCrash(func(i interface{}) { 86 | cleanup(t, terraformOptions, tempTestFolder) 87 | }) 88 | 89 | // This will run `terraform init` and `terraform apply` and fail the test if there are any errors 90 | results := terraform.InitAndApply(t, terraformOptions) 91 | 92 | testFunc(t, terraformOptions, randID, results) 93 | } 94 | 95 | func cleanup(t *testing.T, terraformOptions *terraform.Options, tempTestFolder string) { 96 | t.Logf("Cleanup running Terraform destroy in folder %s\n", tempTestFolder) 97 | // If Destroy fails, it will log the error, so we do not need to log it again, 98 | // but we want to fail immediately rather than delete the temp folder, so we 99 | // have a chance to inspect the state, fix what went wrong, and destroy the resources. 100 | if _, err := terraform.DestroyE(t, terraformOptions); err != nil { 101 | require.FailNow(t, "Terraform destroy failed.\nNot deleting temp test folder (%s)", tempTestFolder) 102 | } 103 | err := os.RemoveAll(tempTestFolder) 104 | assert.NoError(t, err) 105 | } 106 | 107 | // EKS support 108 | func newClientset(cluster *eks.Cluster) (*kubernetes.Clientset, error) { 109 | gen, err := token.NewGenerator(true, false) 110 | if err != nil { 111 | return nil, err 112 | } 113 | opts := &token.GetTokenOptions{ 114 | ClusterID: aws.StringValue(cluster.Name), 115 | } 116 | tok, err := gen.GetWithOptions(opts) 117 | if err != nil { 118 | return nil, err 119 | } 120 | ca, err := base64.StdEncoding.DecodeString(aws.StringValue(cluster.CertificateAuthority.Data)) 121 | if err != nil { 122 | return nil, err 123 | } 124 | clientset, err := kubernetes.NewForConfig( 125 | &rest.Config{ 126 | Host: aws.StringValue(cluster.Endpoint), 127 | BearerToken: tok.Token, 128 | TLSClientConfig: rest.TLSClientConfig{ 129 | CAData: ca, 130 | }, 131 | }, 132 | ) 133 | if err != nil { 134 | return nil, err 135 | } 136 | return clientset, nil 137 | } 138 | 139 | // Check that at least one Node has the given label 140 | func checkSomeNodeHasLabel(clientset *kubernetes.Clientset, labelKey string, labelValue string) bool { 141 | nodes, err := clientset.CoreV1().Nodes().List(context.Background(), metav1.ListOptions{}) 142 | if err != nil { 143 | panic(err.Error()) 144 | } 145 | for _, node := range nodes.Items { 146 | if value, ok := node.Labels[labelKey]; ok && value == labelValue { 147 | return true 148 | } 149 | } 150 | return false 151 | } 152 | 153 | // Check that at least one Node has the given taint 154 | func checkSomeNodeHasTaint(clientset *kubernetes.Clientset, taintKey string, taintValue string, taintEffect corev1.TaintEffect) bool { 155 | nodes, err := clientset.CoreV1().Nodes().List(context.Background(), metav1.ListOptions{}) 156 | if err != nil { 157 | panic(err.Error()) 158 | } 159 | for _, node := range nodes.Items { 160 | for _, taint := range node.Spec.Taints { 161 | if taint.Key == taintKey && taint.Value == taintValue && taint.Effect == taintEffect { 162 | return true 163 | } 164 | } 165 | } 166 | return false 167 | } 168 | -------------------------------------------------------------------------------- /examples/complete/variables.tf: -------------------------------------------------------------------------------- 1 | variable "region" { 2 | type = string 3 | description = "AWS Region for S3 bucket" 4 | } 5 | 6 | variable "availability_zones" { 7 | type = list(string) 8 | description = "List of availability zones" 9 | } 10 | 11 | variable "vpc_cidr_block" { 12 | type = string 13 | description = "VPC CIDR block" 14 | } 15 | 16 | variable "zone_id" { 17 | type = string 18 | default = "" 19 | description = "Route53 parent zone ID. If provided (not empty), the module will create sub-domain DNS records for the DocumentDB master and replicas" 20 | } 21 | 22 | variable "allowed_security_groups" { 23 | type = list(string) 24 | default = [] 25 | description = "List of existing Security Groups to be allowed to connect to the DocumentDB cluster" 26 | } 27 | 28 | variable "allowed_cidr_blocks" { 29 | type = list(string) 30 | default = [] 31 | description = "List of CIDR blocks to be allowed to connect to the DocumentDB cluster" 32 | } 33 | 34 | variable "instance_class" { 35 | type = string 36 | default = "db.r4.large" 37 | description = "The instance class to use. For more details, see https://docs.aws.amazon.com/documentdb/latest/developerguide/db-instance-classes.html#db-instance-class-specs" 38 | } 39 | 40 | variable "cluster_size" { 41 | type = number 42 | default = 2 43 | description = "Number of DB instances to create in the cluster" 44 | } 45 | 46 | variable "snapshot_identifier" { 47 | type = string 48 | default = "" 49 | description = "Specifies whether or not to create this cluster from a snapshot. You can use either the name or ARN when specifying a DB cluster snapshot, or the ARN when specifying a DB snapshot" 50 | } 51 | 52 | variable "db_port" { 53 | type = number 54 | default = 27017 55 | description = "DocumentDB port" 56 | } 57 | 58 | variable "master_username" { 59 | type = string 60 | default = "admin1" 61 | description = "(Required unless a snapshot_identifier is provided) Username for the master DB user" 62 | } 63 | 64 | variable "master_password" { 65 | type = string 66 | default = "" 67 | description = "(Required unless a snapshot_identifier is provided) Password for the master DB user. Note that this may show up in logs, and it will be stored in the state file. Please refer to the DocumentDB Naming Constraints" 68 | } 69 | 70 | variable "retention_period" { 71 | type = number 72 | default = 5 73 | description = "Number of days to retain backups for" 74 | } 75 | 76 | variable "preferred_backup_window" { 77 | type = string 78 | default = "07:00-09:00" 79 | description = "Daily time range during which the backups happen" 80 | } 81 | 82 | variable "preferred_maintenance_window" { 83 | type = string 84 | default = "Mon:22:00-Mon:23:00" 85 | description = "The window to perform maintenance in. Syntax: `ddd:hh24:mi-ddd:hh24:mi`." 86 | } 87 | 88 | variable "cluster_parameters" { 89 | type = list(object({ 90 | apply_method = string 91 | name = string 92 | value = string 93 | })) 94 | default = [] 95 | description = "List of DB parameters to apply" 96 | } 97 | 98 | variable "cluster_family" { 99 | type = string 100 | default = "docdb3.6" 101 | description = "The family of the DocumentDB cluster parameter group. For more details, see https://docs.aws.amazon.com/documentdb/latest/developerguide/db-cluster-parameter-group-create.html" 102 | } 103 | 104 | variable "engine" { 105 | type = string 106 | default = "docdb" 107 | description = "The name of the database engine to be used for this DB cluster. Defaults to `docdb`. Valid values: `docdb`" 108 | } 109 | 110 | variable "engine_version" { 111 | type = string 112 | default = "3.6.0" 113 | description = "The version number of the database engine to use" 114 | } 115 | 116 | variable "storage_encrypted" { 117 | type = bool 118 | description = "Specifies whether the DB cluster is encrypted" 119 | default = true 120 | } 121 | 122 | variable "storage_type" { 123 | type = string 124 | description = "The storage type to associate with the DB cluster. Valid values: standard, iopt1" 125 | default = "standard" 126 | 127 | validation { 128 | condition = contains(["standard", "iopt1"], var.storage_type) 129 | error_message = "Error: storage_type value must be one of two options - 'standard' or 'iopt1'." 130 | } 131 | } 132 | 133 | variable "kms_key_id" { 134 | type = string 135 | description = "The ARN for the KMS encryption key. When specifying `kms_key_id`, `storage_encrypted` needs to be set to `true`" 136 | default = "" 137 | } 138 | 139 | variable "skip_final_snapshot" { 140 | type = bool 141 | description = "Determines whether a final DB snapshot is created before the DB cluster is deleted" 142 | default = true 143 | } 144 | 145 | variable "apply_immediately" { 146 | type = bool 147 | description = "Specifies whether any cluster modifications are applied immediately, or during the next maintenance window" 148 | default = true 149 | } 150 | 151 | variable "auto_minor_version_upgrade" { 152 | type = bool 153 | description = "Specifies whether any minor engine upgrades will be applied automatically to the DB instance during the maintenance window or not" 154 | default = true 155 | } 156 | 157 | variable "enabled_cloudwatch_logs_exports" { 158 | type = list(string) 159 | description = "List of log types to export to cloudwatch. The following log types are supported: `audit`, `profiler`" 160 | default = [] 161 | } 162 | 163 | variable "cluster_dns_name" { 164 | type = string 165 | description = "Name of the cluster CNAME record to create in the parent DNS zone specified by `zone_id`. If left empty, the name will be auto-asigned using the format `master.var.name`" 166 | default = "" 167 | } 168 | 169 | variable "reader_dns_name" { 170 | type = string 171 | description = "Name of the reader endpoint CNAME record to create in the parent DNS zone specified by `zone_id`. If left empty, the name will be auto-asigned using the format `replicas.var.name`" 172 | default = "" 173 | } 174 | 175 | variable "ssm_parameter_enabled" { 176 | type = bool 177 | description = "Whether an SSM parameter store value is created to store the database password." 178 | } 179 | -------------------------------------------------------------------------------- /examples/serverless/variables.tf: -------------------------------------------------------------------------------- 1 | variable "region" { 2 | type = string 3 | description = "AWS Region for S3 bucket" 4 | } 5 | 6 | variable "availability_zones" { 7 | type = list(string) 8 | description = "List of availability zones" 9 | } 10 | 11 | variable "vpc_cidr_block" { 12 | type = string 13 | description = "VPC CIDR block" 14 | } 15 | 16 | variable "zone_id" { 17 | type = string 18 | default = "" 19 | description = "Route53 parent zone ID. If provided (not empty), the module will create sub-domain DNS records for the DocumentDB master and replicas" 20 | } 21 | 22 | variable "allowed_security_groups" { 23 | type = list(string) 24 | default = [] 25 | description = "List of existing Security Groups to be allowed to connect to the DocumentDB cluster" 26 | } 27 | 28 | variable "allowed_cidr_blocks" { 29 | type = list(string) 30 | default = [] 31 | description = "List of CIDR blocks to be allowed to connect to the DocumentDB cluster" 32 | } 33 | 34 | variable "instance_class" { 35 | type = string 36 | default = "db.r4.large" 37 | description = "The instance class to use. For more details, see https://docs.aws.amazon.com/documentdb/latest/developerguide/db-instance-classes.html#db-instance-class-specs" 38 | } 39 | 40 | variable "cluster_size" { 41 | type = number 42 | default = 2 43 | description = "Number of DB instances to create in the cluster" 44 | } 45 | 46 | variable "snapshot_identifier" { 47 | type = string 48 | default = "" 49 | description = "Specifies whether or not to create this cluster from a snapshot. You can use either the name or ARN when specifying a DB cluster snapshot, or the ARN when specifying a DB snapshot" 50 | } 51 | 52 | variable "db_port" { 53 | type = number 54 | default = 27017 55 | description = "DocumentDB port" 56 | } 57 | 58 | variable "master_username" { 59 | type = string 60 | default = "admin1" 61 | description = "(Required unless a snapshot_identifier is provided) Username for the master DB user" 62 | } 63 | 64 | variable "master_password" { 65 | type = string 66 | default = "" 67 | description = "(Required unless a snapshot_identifier is provided) Password for the master DB user. Note that this may show up in logs, and it will be stored in the state file. Please refer to the DocumentDB Naming Constraints" 68 | } 69 | 70 | variable "retention_period" { 71 | type = number 72 | default = 5 73 | description = "Number of days to retain backups for" 74 | } 75 | 76 | variable "preferred_backup_window" { 77 | type = string 78 | default = "07:00-09:00" 79 | description = "Daily time range during which the backups happen" 80 | } 81 | 82 | variable "preferred_maintenance_window" { 83 | type = string 84 | default = "Mon:22:00-Mon:23:00" 85 | description = "The window to perform maintenance in. Syntax: `ddd:hh24:mi-ddd:hh24:mi`." 86 | } 87 | 88 | variable "cluster_parameters" { 89 | type = list(object({ 90 | apply_method = string 91 | name = string 92 | value = string 93 | })) 94 | default = [] 95 | description = "List of DB parameters to apply" 96 | } 97 | 98 | variable "cluster_family" { 99 | type = string 100 | default = "docdb3.6" 101 | description = "The family of the DocumentDB cluster parameter group. For more details, see https://docs.aws.amazon.com/documentdb/latest/developerguide/db-cluster-parameter-group-create.html" 102 | } 103 | 104 | variable "engine" { 105 | type = string 106 | default = "docdb" 107 | description = "The name of the database engine to be used for this DB cluster. Defaults to `docdb`. Valid values: `docdb`" 108 | } 109 | 110 | variable "engine_version" { 111 | type = string 112 | default = "3.6.0" 113 | description = "The version number of the database engine to use" 114 | } 115 | 116 | variable "storage_encrypted" { 117 | type = bool 118 | description = "Specifies whether the DB cluster is encrypted" 119 | default = true 120 | } 121 | 122 | variable "storage_type" { 123 | type = string 124 | description = "The storage type to associate with the DB cluster. Valid values: standard, iopt1" 125 | default = "standard" 126 | 127 | validation { 128 | condition = contains(["standard", "iopt1"], var.storage_type) 129 | error_message = "Error: storage_type value must be one of two options - 'standard' or 'iopt1'." 130 | } 131 | } 132 | 133 | variable "kms_key_id" { 134 | type = string 135 | description = "The ARN for the KMS encryption key. When specifying `kms_key_id`, `storage_encrypted` needs to be set to `true`" 136 | default = "" 137 | } 138 | 139 | variable "skip_final_snapshot" { 140 | type = bool 141 | description = "Determines whether a final DB snapshot is created before the DB cluster is deleted" 142 | default = true 143 | } 144 | 145 | variable "apply_immediately" { 146 | type = bool 147 | description = "Specifies whether any cluster modifications are applied immediately, or during the next maintenance window" 148 | default = true 149 | } 150 | 151 | variable "auto_minor_version_upgrade" { 152 | type = bool 153 | description = "Specifies whether any minor engine upgrades will be applied automatically to the DB instance during the maintenance window or not" 154 | default = true 155 | } 156 | 157 | variable "enabled_cloudwatch_logs_exports" { 158 | type = list(string) 159 | description = "List of log types to export to cloudwatch. The following log types are supported: `audit`, `profiler`" 160 | default = [] 161 | } 162 | 163 | variable "cluster_dns_name" { 164 | type = string 165 | description = "Name of the cluster CNAME record to create in the parent DNS zone specified by `zone_id`. If left empty, the name will be auto-asigned using the format `master.var.name`" 166 | default = "" 167 | } 168 | 169 | variable "reader_dns_name" { 170 | type = string 171 | description = "Name of the reader endpoint CNAME record to create in the parent DNS zone specified by `zone_id`. If left empty, the name will be auto-asigned using the format `replicas.var.name`" 172 | default = "" 173 | } 174 | 175 | variable "ssm_parameter_enabled" { 176 | type = bool 177 | description = "Whether an SSM parameter store value is created to store the database password." 178 | } 179 | 180 | variable "serverless_v2_scaling_configuration" { 181 | type = object({ 182 | min_capacity = number 183 | max_capacity = number 184 | }) 185 | default = null 186 | description = "Configuration for serverless v2 scaling." 187 | } 188 | -------------------------------------------------------------------------------- /test/src/go.mod: -------------------------------------------------------------------------------- 1 | module github.com/cloudposse/terraform-aws-documentdb-cluster 2 | 3 | go 1.24 4 | 5 | toolchain go1.24.0 6 | 7 | require ( 8 | github.com/aws/aws-sdk-go v1.44.332 9 | github.com/aws/aws-sdk-go-v2 v1.38.0 10 | github.com/aws/aws-sdk-go-v2/config v1.27.21 11 | github.com/aws/aws-sdk-go-v2/service/docdb v1.45.0 12 | github.com/aws/aws-sdk-go-v2/service/ssm v1.51.1 13 | github.com/gruntwork-io/terratest v0.46.15 14 | github.com/stretchr/testify v1.8.4 15 | k8s.io/api v0.29.6 16 | k8s.io/apimachinery v0.29.6 17 | k8s.io/client-go v0.29.6 18 | sigs.k8s.io/aws-iam-authenticator v0.6.19 19 | ) 20 | 21 | require ( 22 | cloud.google.com/go v0.110.2 // indirect 23 | cloud.google.com/go/compute v1.20.1 // indirect 24 | cloud.google.com/go/compute/metadata v0.2.3 // indirect 25 | cloud.google.com/go/iam v0.13.0 // indirect 26 | cloud.google.com/go/storage v1.29.0 // indirect 27 | github.com/agext/levenshtein v1.2.3 // indirect 28 | github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect 29 | github.com/aws/aws-sdk-go-v2/credentials v1.17.21 // indirect 30 | github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.8 // indirect 31 | github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.3 // indirect 32 | github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.3 // indirect 33 | github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect 34 | github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0 // indirect 35 | github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.3 // indirect 36 | github.com/aws/aws-sdk-go-v2/service/sso v1.21.1 // indirect 37 | github.com/aws/aws-sdk-go-v2/service/ssooidc v1.25.1 // indirect 38 | github.com/aws/aws-sdk-go-v2/service/sts v1.29.1 // indirect 39 | github.com/aws/smithy-go v1.22.5 // indirect 40 | github.com/beorn7/perks v1.0.1 // indirect 41 | github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect 42 | github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect 43 | github.com/cespare/xxhash/v2 v2.2.0 // indirect 44 | github.com/cpuguy83/go-md2man/v2 v2.0.0 // indirect 45 | github.com/davecgh/go-spew v1.1.1 // indirect 46 | github.com/emicklei/go-restful/v3 v3.11.0 // indirect 47 | github.com/go-errors/errors v1.0.2-0.20180813162953-d98b870cc4e0 // indirect 48 | github.com/go-logr/logr v1.4.1 // indirect 49 | github.com/go-openapi/jsonpointer v0.20.2 // indirect 50 | github.com/go-openapi/jsonreference v0.20.4 // indirect 51 | github.com/go-openapi/swag v0.22.7 // indirect 52 | github.com/go-sql-driver/mysql v1.4.1 // indirect 53 | github.com/gofrs/flock v0.8.1 // indirect 54 | github.com/gogo/protobuf v1.3.2 // indirect 55 | github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect 56 | github.com/golang/protobuf v1.5.4 // indirect 57 | github.com/google/gnostic-models v0.6.8 // indirect 58 | github.com/google/go-cmp v0.6.0 // indirect 59 | github.com/google/gofuzz v1.2.0 // indirect 60 | github.com/google/s2a-go v0.1.4 // indirect 61 | github.com/google/uuid v1.5.0 // indirect 62 | github.com/googleapis/enterprise-certificate-proxy v0.2.3 // indirect 63 | github.com/googleapis/gax-go/v2 v2.11.0 // indirect 64 | github.com/gruntwork-io/go-commons v0.8.0 // indirect 65 | github.com/hashicorp/errwrap v1.0.0 // indirect 66 | github.com/hashicorp/go-cleanhttp v0.5.2 // indirect 67 | github.com/hashicorp/go-getter v1.7.5 // indirect 68 | github.com/hashicorp/go-multierror v1.1.0 // indirect 69 | github.com/hashicorp/go-safetemp v1.0.0 // indirect 70 | github.com/hashicorp/go-version v1.6.0 // indirect 71 | github.com/hashicorp/hcl/v2 v2.9.1 // indirect 72 | github.com/hashicorp/terraform-json v0.13.0 // indirect 73 | github.com/imdario/mergo v0.3.16 // indirect 74 | github.com/jinzhu/copier v0.0.0-20190924061706-b57f9002281a // indirect 75 | github.com/jmespath/go-jmespath v0.4.0 // indirect 76 | github.com/josharian/intern v1.0.0 // indirect 77 | github.com/json-iterator/go v1.1.12 // indirect 78 | github.com/klauspost/compress v1.15.11 // indirect 79 | github.com/mailru/easyjson v0.7.7 // indirect 80 | github.com/mattn/go-zglob v0.0.2-0.20190814121620-e3c945676326 // indirect 81 | github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect 82 | github.com/mitchellh/go-homedir v1.1.0 // indirect 83 | github.com/mitchellh/go-testing-interface v1.14.1 // indirect 84 | github.com/mitchellh/go-wordwrap v1.0.1 // indirect 85 | github.com/moby/spdystream v0.2.0 // indirect 86 | github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect 87 | github.com/modern-go/reflect2 v1.0.2 // indirect 88 | github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect 89 | github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect 90 | github.com/pmezard/go-difflib v1.0.0 // indirect 91 | github.com/pquerna/otp v1.2.0 // indirect 92 | github.com/prometheus/client_golang v1.16.0 // indirect 93 | github.com/prometheus/client_model v0.4.0 // indirect 94 | github.com/prometheus/common v0.44.0 // indirect 95 | github.com/prometheus/procfs v0.10.1 // indirect 96 | github.com/russross/blackfriday/v2 v2.1.0 // indirect 97 | github.com/sirupsen/logrus v1.9.3 // indirect 98 | github.com/spf13/pflag v1.0.5 // indirect 99 | github.com/tmccombs/hcl2json v0.3.3 // indirect 100 | github.com/ulikunitz/xz v0.5.10 // indirect 101 | github.com/urfave/cli v1.22.2 // indirect 102 | github.com/zclconf/go-cty v1.9.1 // indirect 103 | go.opencensus.io v0.24.0 // indirect 104 | golang.org/x/crypto v0.21.0 // indirect 105 | golang.org/x/net v0.23.0 // indirect 106 | golang.org/x/oauth2 v0.15.0 // indirect 107 | golang.org/x/sys v0.18.0 // indirect 108 | golang.org/x/term v0.18.0 // indirect 109 | golang.org/x/text v0.14.0 // indirect 110 | golang.org/x/time v0.5.0 // indirect 111 | golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect 112 | google.golang.org/api v0.126.0 // indirect 113 | google.golang.org/appengine v1.6.8 // indirect 114 | google.golang.org/genproto v0.0.0-20230530153820-e85fd2cbaebc // indirect 115 | google.golang.org/genproto/googleapis/api v0.0.0-20230530153820-e85fd2cbaebc // indirect 116 | google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc // indirect 117 | google.golang.org/grpc v1.56.3 // indirect 118 | google.golang.org/protobuf v1.33.0 // indirect 119 | gopkg.in/inf.v0 v0.9.1 // indirect 120 | gopkg.in/yaml.v2 v2.4.0 // indirect 121 | gopkg.in/yaml.v3 v3.0.1 // indirect 122 | k8s.io/klog/v2 v2.120.1 // indirect 123 | k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 // indirect 124 | k8s.io/utils v0.0.0-20240102154912-e7106e64919e // indirect 125 | sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect 126 | sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect 127 | sigs.k8s.io/yaml v1.4.0 // indirect 128 | ) 129 | -------------------------------------------------------------------------------- /main.tf: -------------------------------------------------------------------------------- 1 | locals { 2 | enabled = module.this.enabled 3 | create_password = local.enabled && var.master_password == null && var.manage_master_user_password == null 4 | # 1. If manage_master_user_password is not null, AWS manages the password (master_password must be null) 5 | # 2. If master_password is provided, that value is used (manage_master_user_password must be null) 6 | # 3. If both are null, the module creates a random password 7 | master_password = local.create_password ? one(random_password.password[*].result) : var.master_password 8 | } 9 | 10 | resource "aws_security_group" "default" { 11 | count = local.enabled ? 1 : 0 12 | name = module.this.id 13 | description = "Security Group for DocumentDB cluster" 14 | vpc_id = var.vpc_id 15 | tags = module.this.tags 16 | } 17 | 18 | resource "aws_security_group_rule" "egress" { 19 | count = local.enabled ? 1 : 0 20 | type = "egress" 21 | description = "Allow outbound traffic from CIDR blocks" 22 | from_port = var.egress_from_port 23 | to_port = var.egress_to_port 24 | protocol = var.egress_protocol 25 | cidr_blocks = var.allowed_egress_cidr_blocks 26 | security_group_id = join("", aws_security_group.default[*].id) 27 | } 28 | 29 | resource "aws_security_group_rule" "allow_ingress_from_self" { 30 | count = local.enabled && var.allow_ingress_from_self ? 1 : 0 31 | type = "ingress" 32 | description = "Allow traffic within the security group" 33 | from_port = var.db_port 34 | to_port = var.db_port 35 | protocol = "tcp" 36 | security_group_id = join("", aws_security_group.default[*].id) 37 | self = true 38 | } 39 | 40 | resource "aws_security_group_rule" "ingress_security_groups" { 41 | count = local.enabled ? length(var.allowed_security_groups) : 0 42 | type = "ingress" 43 | description = "Allow inbound traffic from existing Security Groups" 44 | from_port = var.db_port 45 | to_port = var.db_port 46 | protocol = "tcp" 47 | source_security_group_id = element(var.allowed_security_groups, count.index) 48 | security_group_id = join("", aws_security_group.default[*].id) 49 | } 50 | 51 | resource "aws_security_group_rule" "ingress_cidr_blocks" { 52 | type = "ingress" 53 | count = local.enabled && length(var.allowed_cidr_blocks) > 0 ? 1 : 0 54 | description = "Allow inbound traffic from CIDR blocks" 55 | from_port = var.db_port 56 | to_port = var.db_port 57 | protocol = "tcp" 58 | cidr_blocks = var.allowed_cidr_blocks 59 | security_group_id = join("", aws_security_group.default[*].id) 60 | } 61 | 62 | resource "random_password" "password" { 63 | count = local.create_password ? 1 : 0 64 | length = 16 65 | special = false 66 | } 67 | 68 | resource "aws_docdb_cluster" "default" { 69 | count = local.enabled ? 1 : 0 70 | cluster_identifier = module.this.id 71 | master_username = var.master_username 72 | # Set master_password OR manage_master_user_password, but not both (one must be null) 73 | # manage_master_user_password=true enables AWS-managed passwords via Secrets Manager 74 | master_password = var.manage_master_user_password != null ? null : local.master_password 75 | manage_master_user_password = var.manage_master_user_password 76 | backup_retention_period = var.retention_period 77 | preferred_backup_window = var.preferred_backup_window 78 | preferred_maintenance_window = var.preferred_maintenance_window 79 | final_snapshot_identifier = lower(module.this.id) 80 | skip_final_snapshot = var.skip_final_snapshot 81 | deletion_protection = var.deletion_protection 82 | apply_immediately = var.apply_immediately 83 | storage_encrypted = var.storage_encrypted 84 | storage_type = var.storage_type 85 | kms_key_id = var.kms_key_id 86 | port = var.db_port 87 | snapshot_identifier = var.snapshot_identifier 88 | vpc_security_group_ids = concat([join("", aws_security_group.default[*].id)], var.external_security_group_id_list) 89 | db_subnet_group_name = join("", aws_docdb_subnet_group.default[*].name) 90 | db_cluster_parameter_group_name = join("", aws_docdb_cluster_parameter_group.default[*].name) 91 | engine = var.engine 92 | engine_version = var.engine_version 93 | enabled_cloudwatch_logs_exports = var.enabled_cloudwatch_logs_exports 94 | allow_major_version_upgrade = var.allow_major_version_upgrade 95 | tags = module.this.tags 96 | 97 | dynamic "serverless_v2_scaling_configuration" { 98 | for_each = var.serverless_v2_scaling_configuration != null ? [1] : [] 99 | content { 100 | min_capacity = var.serverless_v2_scaling_configuration.min_capacity 101 | max_capacity = var.serverless_v2_scaling_configuration.max_capacity 102 | } 103 | } 104 | 105 | lifecycle { 106 | precondition { 107 | condition = (var.serverless_v2_scaling_configuration != null && contains(["db.serverless"], var.instance_class)) || (var.serverless_v2_scaling_configuration == null && var.instance_class != "db.serverless") 108 | error_message = "Error: when serverless_v2_scaling_configuration is set, instance_class must be set to 'db.serverless'" 109 | } 110 | } 111 | } 112 | 113 | resource "aws_docdb_cluster_instance" "default" { 114 | count = local.enabled ? var.cluster_size : 0 115 | identifier = "${module.this.id}-${count.index + 1}" 116 | cluster_identifier = join("", aws_docdb_cluster.default[*].id) 117 | apply_immediately = var.apply_immediately 118 | preferred_maintenance_window = var.preferred_maintenance_window 119 | instance_class = var.instance_class 120 | engine = var.engine 121 | auto_minor_version_upgrade = var.auto_minor_version_upgrade 122 | enable_performance_insights = var.enable_performance_insights 123 | ca_cert_identifier = var.ca_cert_identifier 124 | tags = module.this.tags 125 | } 126 | 127 | resource "aws_docdb_subnet_group" "default" { 128 | count = local.enabled ? 1 : 0 129 | name = module.this.id 130 | description = "Allowed subnets for DB cluster instances" 131 | subnet_ids = var.subnet_ids 132 | tags = module.this.tags 133 | } 134 | 135 | # https://docs.aws.amazon.com/documentdb/latest/developerguide/db-cluster-parameter-group-create.html 136 | resource "aws_docdb_cluster_parameter_group" "default" { 137 | count = local.enabled ? 1 : 0 138 | name = module.this.id 139 | description = "DB cluster parameter group" 140 | family = var.cluster_family 141 | 142 | dynamic "parameter" { 143 | for_each = var.cluster_parameters 144 | content { 145 | apply_method = lookup(parameter.value, "apply_method", null) 146 | name = parameter.value.name 147 | value = parameter.value.value 148 | } 149 | } 150 | 151 | tags = module.this.tags 152 | } 153 | 154 | locals { 155 | cluster_dns_name_default = "master.${module.this.name}" 156 | cluster_dns_name = var.cluster_dns_name != "" ? var.cluster_dns_name : local.cluster_dns_name_default 157 | replicas_dns_name_default = "replicas.${module.this.name}" 158 | replicas_dns_name = var.reader_dns_name != "" ? var.reader_dns_name : local.replicas_dns_name_default 159 | } 160 | 161 | module "dns_master" { 162 | source = "cloudposse/route53-cluster-hostname/aws" 163 | version = "0.13.0" 164 | 165 | enabled = local.enabled && var.zone_id != "" 166 | dns_name = local.cluster_dns_name 167 | zone_id = var.zone_id 168 | records = coalescelist(aws_docdb_cluster.default[*].endpoint, [""]) 169 | 170 | context = module.this.context 171 | } 172 | 173 | module "dns_replicas" { 174 | source = "cloudposse/route53-cluster-hostname/aws" 175 | version = "0.13.0" 176 | 177 | enabled = local.enabled && var.zone_id != "" 178 | dns_name = local.replicas_dns_name 179 | zone_id = var.zone_id 180 | records = coalescelist(aws_docdb_cluster.default[*].reader_endpoint, [""]) 181 | 182 | context = module.this.context 183 | } 184 | 185 | module "ssm_write_db_password" { 186 | source = "cloudposse/ssm-parameter-store/aws" 187 | version = "0.13.0" 188 | 189 | enabled = local.enabled && var.ssm_parameter_enabled && var.manage_master_user_password != null 190 | parameter_write = [ 191 | { 192 | name = format("%s%s", var.ssm_parameter_path_prefix, module.this.id) 193 | value = local.master_password 194 | type = "SecureString" 195 | description = "Master password for ${module.this.id} DocumentDB cluster" 196 | } 197 | ] 198 | 199 | context = module.this.context 200 | } 201 | -------------------------------------------------------------------------------- /variables.tf: -------------------------------------------------------------------------------- 1 | variable "zone_id" { 2 | type = string 3 | default = "" 4 | description = "Route53 parent zone ID. If provided (not empty), the module will create sub-domain DNS records for the DocumentDB master and replicas" 5 | } 6 | 7 | variable "egress_from_port" { 8 | type = number 9 | default = 0 10 | description = "[from_port]DocumentDB initial port range for egress (e.g. `0`)" 11 | } 12 | 13 | variable "egress_to_port" { 14 | type = number 15 | default = 0 16 | description = "[to_port]DocumentDB initial port range for egress (e.g. `65535`)" 17 | } 18 | 19 | variable "egress_protocol" { 20 | type = string 21 | default = "-1" 22 | description = "DocumentDB protocol for egress (e.g. `-1`, `tcp`)" 23 | } 24 | 25 | variable "allowed_egress_cidr_blocks" { 26 | type = list(string) 27 | default = ["0.0.0.0/0"] 28 | description = "List of CIDR blocks to be allowed to send traffic outside of the DocumentDB cluster" 29 | } 30 | 31 | variable "allowed_security_groups" { 32 | type = list(string) 33 | default = [] 34 | description = "List of existing Security Groups to be allowed to connect to the DocumentDB cluster" 35 | } 36 | 37 | variable "allow_ingress_from_self" { 38 | type = bool 39 | default = false 40 | description = "Adds the Document DB security group itself as a source for ingress rules. Useful when this security group will be shared with applications." 41 | } 42 | 43 | variable "allowed_cidr_blocks" { 44 | type = list(string) 45 | default = [] 46 | description = "List of CIDR blocks to be allowed to connect to the DocumentDB cluster" 47 | } 48 | 49 | variable "external_security_group_id_list" { 50 | type = list(string) 51 | default = [] 52 | description = "List of external security group IDs to attach to the Document DB" 53 | } 54 | 55 | variable "vpc_id" { 56 | type = string 57 | description = "VPC ID to create the cluster in (e.g. `vpc-a22222ee`)" 58 | } 59 | 60 | variable "subnet_ids" { 61 | type = list(string) 62 | description = "List of VPC subnet IDs to place DocumentDB instances in" 63 | } 64 | 65 | # https://docs.aws.amazon.com/documentdb/latest/developerguide/limits.html#suported-instance-types 66 | variable "instance_class" { 67 | type = string 68 | default = "db.r4.large" 69 | description = "The instance class to use. For more details, see https://docs.aws.amazon.com/documentdb/latest/developerguide/db-instance-classes.html#db-instance-class-specs" 70 | } 71 | 72 | variable "cluster_size" { 73 | type = number 74 | default = 3 75 | description = "Number of DB instances to create in the cluster" 76 | } 77 | 78 | variable "snapshot_identifier" { 79 | type = string 80 | default = "" 81 | description = "Specifies whether or not to create this cluster from a snapshot. You can use either the name or ARN when specifying a DB cluster snapshot, or the ARN when specifying a DB snapshot" 82 | } 83 | 84 | variable "db_port" { 85 | type = number 86 | default = 27017 87 | description = "DocumentDB port" 88 | } 89 | 90 | variable "master_username" { 91 | type = string 92 | default = "admin1" 93 | description = "(Required unless a snapshot_identifier is provided) Username for the master DB user" 94 | } 95 | 96 | variable "master_password" { 97 | type = string 98 | default = null 99 | description = "(Required unless a snapshot_identifier is provided) Password for the master DB user. Note that this may show up in logs, and it will be stored in the state file. Please refer to the DocumentDB Naming Constraints" 100 | } 101 | 102 | variable "manage_master_user_password" { 103 | type = bool 104 | description = "Whether to manage the master user password using AWS Secrets Manager." 105 | default = null 106 | validation { 107 | condition = var.manage_master_user_password == null || var.manage_master_user_password == true 108 | error_message = "Error: `manage_master_user_password` must be set to `true` or `null`" 109 | } 110 | } 111 | 112 | variable "retention_period" { 113 | type = number 114 | default = 5 115 | description = "Number of days to retain backups for" 116 | } 117 | 118 | variable "preferred_backup_window" { 119 | type = string 120 | default = "07:00-09:00" 121 | description = "Daily time range during which the backups happen" 122 | } 123 | 124 | variable "preferred_maintenance_window" { 125 | type = string 126 | default = "Mon:22:00-Mon:23:00" 127 | description = "The window to perform maintenance in. Syntax: `ddd:hh24:mi-ddd:hh24:mi`." 128 | } 129 | 130 | variable "cluster_parameters" { 131 | type = list(object({ 132 | apply_method = string 133 | name = string 134 | value = string 135 | })) 136 | default = [] 137 | description = "List of DB parameters to apply" 138 | } 139 | 140 | variable "cluster_family" { 141 | type = string 142 | default = "docdb3.6" 143 | description = "The family of the DocumentDB cluster parameter group. For more details, see https://docs.aws.amazon.com/documentdb/latest/developerguide/db-cluster-parameter-group-create.html" 144 | } 145 | 146 | variable "engine" { 147 | type = string 148 | default = "docdb" 149 | description = "The name of the database engine to be used for this DB cluster. Defaults to `docdb`. Valid values: `docdb`" 150 | } 151 | 152 | variable "engine_version" { 153 | type = string 154 | default = "3.6.0" 155 | description = "The version number of the database engine to use" 156 | } 157 | 158 | variable "storage_encrypted" { 159 | type = bool 160 | description = "Specifies whether the DB cluster is encrypted" 161 | default = true 162 | } 163 | 164 | variable "storage_type" { 165 | type = string 166 | description = "The storage type to associate with the DB cluster. Valid values: standard, iopt1" 167 | default = "standard" 168 | 169 | validation { 170 | condition = contains(["standard", "iopt1"], var.storage_type) 171 | error_message = "Error: storage_type value must be one of two options - 'standard' or 'iopt1'." 172 | } 173 | } 174 | 175 | variable "kms_key_id" { 176 | type = string 177 | description = "The ARN for the KMS encryption key. When specifying `kms_key_id`, `storage_encrypted` needs to be set to `true`" 178 | default = "" 179 | } 180 | 181 | variable "skip_final_snapshot" { 182 | type = bool 183 | description = "Determines whether a final DB snapshot is created before the DB cluster is deleted" 184 | default = true 185 | } 186 | 187 | variable "deletion_protection" { 188 | type = bool 189 | description = "A value that indicates whether the DB cluster has deletion protection enabled" 190 | default = false 191 | } 192 | 193 | variable "apply_immediately" { 194 | type = bool 195 | description = "Specifies whether any cluster modifications are applied immediately, or during the next maintenance window" 196 | default = true 197 | } 198 | 199 | variable "auto_minor_version_upgrade" { 200 | type = bool 201 | description = "Specifies whether any minor engine upgrades will be applied automatically to the DB instance during the maintenance window or not" 202 | default = true 203 | } 204 | 205 | variable "enabled_cloudwatch_logs_exports" { 206 | type = list(string) 207 | description = "List of log types to export to cloudwatch. The following log types are supported: `audit`, `profiler`" 208 | default = [] 209 | } 210 | 211 | variable "cluster_dns_name" { 212 | type = string 213 | description = "Name of the cluster CNAME record to create in the parent DNS zone specified by `zone_id`. If left empty, the name will be auto-asigned using the format `master.var.name`" 214 | default = "" 215 | } 216 | 217 | variable "reader_dns_name" { 218 | type = string 219 | description = "Name of the reader endpoint CNAME record to create in the parent DNS zone specified by `zone_id`. If left empty, the name will be auto-asigned using the format `replicas.var.name`" 220 | default = "" 221 | } 222 | 223 | variable "enable_performance_insights" { 224 | type = bool 225 | description = "Specifies whether to enable Performance Insights for the DB Instance." 226 | default = false 227 | } 228 | 229 | variable "ca_cert_identifier" { 230 | type = string 231 | description = "The identifier of the CA certificate for the DB instance" 232 | default = null 233 | } 234 | 235 | variable "ssm_parameter_enabled" { 236 | type = bool 237 | default = false 238 | description = "Whether an SSM parameter store value is created to store the database password." 239 | } 240 | 241 | variable "ssm_parameter_path_prefix" { 242 | type = string 243 | default = "/docdb/master-password/" 244 | description = "The path prefix for the created SSM parameter e.g. '/docdb/master-password/dev'. `ssm_parameter_enabled` must be set to `true` for this to take affect." 245 | } 246 | 247 | variable "allow_major_version_upgrade" { 248 | type = bool 249 | description = "Specifies whether major version upgrades are allowed. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/docdb_cluster#allow_major_version_upgrade" 250 | default = false 251 | } 252 | 253 | variable "serverless_v2_scaling_configuration" { 254 | type = object({ 255 | min_capacity = optional(number, 0.5) 256 | max_capacity = optional(number, 256) 257 | }) 258 | default = null 259 | description = "Configuration for serverless v2 scaling. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/docdb_cluster#serverless_v2_scaling_configuration" 260 | } 261 | -------------------------------------------------------------------------------- /context.tf: -------------------------------------------------------------------------------- 1 | # 2 | # ONLY EDIT THIS FILE IN github.com/cloudposse/terraform-null-label 3 | # All other instances of this file should be a copy of that one 4 | # 5 | # 6 | # Copy this file from https://github.com/cloudposse/terraform-null-label/blob/master/exports/context.tf 7 | # and then place it in your Terraform module to automatically get 8 | # Cloud Posse's standard configuration inputs suitable for passing 9 | # to Cloud Posse modules. 10 | # 11 | # curl -sL https://raw.githubusercontent.com/cloudposse/terraform-null-label/master/exports/context.tf -o context.tf 12 | # 13 | # Modules should access the whole context as `module.this.context` 14 | # to get the input variables with nulls for defaults, 15 | # for example `context = module.this.context`, 16 | # and access individual variables as `module.this.`, 17 | # with final values filled in. 18 | # 19 | # For example, when using defaults, `module.this.context.delimiter` 20 | # will be null, and `module.this.delimiter` will be `-` (hyphen). 21 | # 22 | 23 | module "this" { 24 | source = "cloudposse/label/null" 25 | version = "0.25.0" # requires Terraform >= 0.13.0 26 | 27 | enabled = var.enabled 28 | namespace = var.namespace 29 | tenant = var.tenant 30 | environment = var.environment 31 | stage = var.stage 32 | name = var.name 33 | delimiter = var.delimiter 34 | attributes = var.attributes 35 | tags = var.tags 36 | additional_tag_map = var.additional_tag_map 37 | label_order = var.label_order 38 | regex_replace_chars = var.regex_replace_chars 39 | id_length_limit = var.id_length_limit 40 | label_key_case = var.label_key_case 41 | label_value_case = var.label_value_case 42 | descriptor_formats = var.descriptor_formats 43 | labels_as_tags = var.labels_as_tags 44 | 45 | context = var.context 46 | } 47 | 48 | # Copy contents of cloudposse/terraform-null-label/variables.tf here 49 | 50 | variable "context" { 51 | type = any 52 | default = { 53 | enabled = true 54 | namespace = null 55 | tenant = null 56 | environment = null 57 | stage = null 58 | name = null 59 | delimiter = null 60 | attributes = [] 61 | tags = {} 62 | additional_tag_map = {} 63 | regex_replace_chars = null 64 | label_order = [] 65 | id_length_limit = null 66 | label_key_case = null 67 | label_value_case = null 68 | descriptor_formats = {} 69 | # Note: we have to use [] instead of null for unset lists due to 70 | # https://github.com/hashicorp/terraform/issues/28137 71 | # which was not fixed until Terraform 1.0.0, 72 | # but we want the default to be all the labels in `label_order` 73 | # and we want users to be able to prevent all tag generation 74 | # by setting `labels_as_tags` to `[]`, so we need 75 | # a different sentinel to indicate "default" 76 | labels_as_tags = ["unset"] 77 | } 78 | description = <<-EOT 79 | Single object for setting entire context at once. 80 | See description of individual variables for details. 81 | Leave string and numeric variables as `null` to use default value. 82 | Individual variable settings (non-null) override settings in context object, 83 | except for attributes, tags, and additional_tag_map, which are merged. 84 | EOT 85 | 86 | validation { 87 | condition = lookup(var.context, "label_key_case", null) == null ? true : contains(["lower", "title", "upper"], var.context["label_key_case"]) 88 | error_message = "Allowed values: `lower`, `title`, `upper`." 89 | } 90 | 91 | validation { 92 | condition = lookup(var.context, "label_value_case", null) == null ? true : contains(["lower", "title", "upper", "none"], var.context["label_value_case"]) 93 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`." 94 | } 95 | } 96 | 97 | variable "enabled" { 98 | type = bool 99 | default = null 100 | description = "Set to false to prevent the module from creating any resources" 101 | } 102 | 103 | variable "namespace" { 104 | type = string 105 | default = null 106 | description = "ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique" 107 | } 108 | 109 | variable "tenant" { 110 | type = string 111 | default = null 112 | description = "ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for" 113 | } 114 | 115 | variable "environment" { 116 | type = string 117 | default = null 118 | description = "ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'" 119 | } 120 | 121 | variable "stage" { 122 | type = string 123 | default = null 124 | description = "ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'" 125 | } 126 | 127 | variable "name" { 128 | type = string 129 | default = null 130 | description = <<-EOT 131 | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'. 132 | This is the only ID element not also included as a `tag`. 133 | The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. 134 | EOT 135 | } 136 | 137 | variable "delimiter" { 138 | type = string 139 | default = null 140 | description = <<-EOT 141 | Delimiter to be used between ID elements. 142 | Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. 143 | EOT 144 | } 145 | 146 | variable "attributes" { 147 | type = list(string) 148 | default = [] 149 | description = <<-EOT 150 | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`, 151 | in the order they appear in the list. New attributes are appended to the 152 | end of the list. The elements of the list are joined by the `delimiter` 153 | and treated as a single ID element. 154 | EOT 155 | } 156 | 157 | variable "labels_as_tags" { 158 | type = set(string) 159 | default = ["default"] 160 | description = <<-EOT 161 | Set of labels (ID elements) to include as tags in the `tags` output. 162 | Default is to include all labels. 163 | Tags with empty values will not be included in the `tags` output. 164 | Set to `[]` to suppress all generated tags. 165 | **Notes:** 166 | The value of the `name` tag, if included, will be the `id`, not the `name`. 167 | Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be 168 | changed in later chained modules. Attempts to change it will be silently ignored. 169 | EOT 170 | } 171 | 172 | variable "tags" { 173 | type = map(string) 174 | default = {} 175 | description = <<-EOT 176 | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`). 177 | Neither the tag keys nor the tag values will be modified by this module. 178 | EOT 179 | } 180 | 181 | variable "additional_tag_map" { 182 | type = map(string) 183 | default = {} 184 | description = <<-EOT 185 | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`. 186 | This is for some rare cases where resources want additional configuration of tags 187 | and therefore take a list of maps with tag key, value, and additional configuration. 188 | EOT 189 | } 190 | 191 | variable "label_order" { 192 | type = list(string) 193 | default = null 194 | description = <<-EOT 195 | The order in which the labels (ID elements) appear in the `id`. 196 | Defaults to ["namespace", "environment", "stage", "name", "attributes"]. 197 | You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. 198 | EOT 199 | } 200 | 201 | variable "regex_replace_chars" { 202 | type = string 203 | default = null 204 | description = <<-EOT 205 | Terraform regular expression (regex) string. 206 | Characters matching the regex will be removed from the ID elements. 207 | If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. 208 | EOT 209 | } 210 | 211 | variable "id_length_limit" { 212 | type = number 213 | default = null 214 | description = <<-EOT 215 | Limit `id` to this many characters (minimum 6). 216 | Set to `0` for unlimited length. 217 | Set to `null` for keep the existing setting, which defaults to `0`. 218 | Does not affect `id_full`. 219 | EOT 220 | validation { 221 | condition = var.id_length_limit == null ? true : var.id_length_limit >= 6 || var.id_length_limit == 0 222 | error_message = "The id_length_limit must be >= 6 if supplied (not null), or 0 for unlimited length." 223 | } 224 | } 225 | 226 | variable "label_key_case" { 227 | type = string 228 | default = null 229 | description = <<-EOT 230 | Controls the letter case of the `tags` keys (label names) for tags generated by this module. 231 | Does not affect keys of tags passed in via the `tags` input. 232 | Possible values: `lower`, `title`, `upper`. 233 | Default value: `title`. 234 | EOT 235 | 236 | validation { 237 | condition = var.label_key_case == null ? true : contains(["lower", "title", "upper"], var.label_key_case) 238 | error_message = "Allowed values: `lower`, `title`, `upper`." 239 | } 240 | } 241 | 242 | variable "label_value_case" { 243 | type = string 244 | default = null 245 | description = <<-EOT 246 | Controls the letter case of ID elements (labels) as included in `id`, 247 | set as tag values, and output by this module individually. 248 | Does not affect values of tags passed in via the `tags` input. 249 | Possible values: `lower`, `title`, `upper` and `none` (no transformation). 250 | Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs. 251 | Default value: `lower`. 252 | EOT 253 | 254 | validation { 255 | condition = var.label_value_case == null ? true : contains(["lower", "title", "upper", "none"], var.label_value_case) 256 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`." 257 | } 258 | } 259 | 260 | variable "descriptor_formats" { 261 | type = any 262 | default = {} 263 | description = <<-EOT 264 | Describe additional descriptors to be output in the `descriptors` output map. 265 | Map of maps. Keys are names of descriptors. Values are maps of the form 266 | `{ 267 | format = string 268 | labels = list(string) 269 | }` 270 | (Type is `any` so the map values can later be enhanced to provide additional options.) 271 | `format` is a Terraform format string to be passed to the `format()` function. 272 | `labels` is a list of labels, in order, to pass to `format()` function. 273 | Label values will be normalized before being passed to `format()` so they will be 274 | identical to how they appear in `id`. 275 | Default is `{}` (`descriptors` output will be empty). 276 | EOT 277 | } 278 | 279 | #### End of copy of cloudposse/terraform-null-label/variables.tf 280 | -------------------------------------------------------------------------------- /examples/complete/context.tf: -------------------------------------------------------------------------------- 1 | # 2 | # ONLY EDIT THIS FILE IN github.com/cloudposse/terraform-null-label 3 | # All other instances of this file should be a copy of that one 4 | # 5 | # 6 | # Copy this file from https://github.com/cloudposse/terraform-null-label/blob/master/exports/context.tf 7 | # and then place it in your Terraform module to automatically get 8 | # Cloud Posse's standard configuration inputs suitable for passing 9 | # to Cloud Posse modules. 10 | # 11 | # curl -sL https://raw.githubusercontent.com/cloudposse/terraform-null-label/master/exports/context.tf -o context.tf 12 | # 13 | # Modules should access the whole context as `module.this.context` 14 | # to get the input variables with nulls for defaults, 15 | # for example `context = module.this.context`, 16 | # and access individual variables as `module.this.`, 17 | # with final values filled in. 18 | # 19 | # For example, when using defaults, `module.this.context.delimiter` 20 | # will be null, and `module.this.delimiter` will be `-` (hyphen). 21 | # 22 | 23 | module "this" { 24 | source = "cloudposse/label/null" 25 | version = "0.25.0" # requires Terraform >= 0.13.0 26 | 27 | enabled = var.enabled 28 | namespace = var.namespace 29 | tenant = var.tenant 30 | environment = var.environment 31 | stage = var.stage 32 | name = var.name 33 | delimiter = var.delimiter 34 | attributes = var.attributes 35 | tags = var.tags 36 | additional_tag_map = var.additional_tag_map 37 | label_order = var.label_order 38 | regex_replace_chars = var.regex_replace_chars 39 | id_length_limit = var.id_length_limit 40 | label_key_case = var.label_key_case 41 | label_value_case = var.label_value_case 42 | descriptor_formats = var.descriptor_formats 43 | labels_as_tags = var.labels_as_tags 44 | 45 | context = var.context 46 | } 47 | 48 | # Copy contents of cloudposse/terraform-null-label/variables.tf here 49 | 50 | variable "context" { 51 | type = any 52 | default = { 53 | enabled = true 54 | namespace = null 55 | tenant = null 56 | environment = null 57 | stage = null 58 | name = null 59 | delimiter = null 60 | attributes = [] 61 | tags = {} 62 | additional_tag_map = {} 63 | regex_replace_chars = null 64 | label_order = [] 65 | id_length_limit = null 66 | label_key_case = null 67 | label_value_case = null 68 | descriptor_formats = {} 69 | # Note: we have to use [] instead of null for unset lists due to 70 | # https://github.com/hashicorp/terraform/issues/28137 71 | # which was not fixed until Terraform 1.0.0, 72 | # but we want the default to be all the labels in `label_order` 73 | # and we want users to be able to prevent all tag generation 74 | # by setting `labels_as_tags` to `[]`, so we need 75 | # a different sentinel to indicate "default" 76 | labels_as_tags = ["unset"] 77 | } 78 | description = <<-EOT 79 | Single object for setting entire context at once. 80 | See description of individual variables for details. 81 | Leave string and numeric variables as `null` to use default value. 82 | Individual variable settings (non-null) override settings in context object, 83 | except for attributes, tags, and additional_tag_map, which are merged. 84 | EOT 85 | 86 | validation { 87 | condition = lookup(var.context, "label_key_case", null) == null ? true : contains(["lower", "title", "upper"], var.context["label_key_case"]) 88 | error_message = "Allowed values: `lower`, `title`, `upper`." 89 | } 90 | 91 | validation { 92 | condition = lookup(var.context, "label_value_case", null) == null ? true : contains(["lower", "title", "upper", "none"], var.context["label_value_case"]) 93 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`." 94 | } 95 | } 96 | 97 | variable "enabled" { 98 | type = bool 99 | default = null 100 | description = "Set to false to prevent the module from creating any resources" 101 | } 102 | 103 | variable "namespace" { 104 | type = string 105 | default = null 106 | description = "ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique" 107 | } 108 | 109 | variable "tenant" { 110 | type = string 111 | default = null 112 | description = "ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for" 113 | } 114 | 115 | variable "environment" { 116 | type = string 117 | default = null 118 | description = "ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'" 119 | } 120 | 121 | variable "stage" { 122 | type = string 123 | default = null 124 | description = "ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'" 125 | } 126 | 127 | variable "name" { 128 | type = string 129 | default = null 130 | description = <<-EOT 131 | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'. 132 | This is the only ID element not also included as a `tag`. 133 | The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. 134 | EOT 135 | } 136 | 137 | variable "delimiter" { 138 | type = string 139 | default = null 140 | description = <<-EOT 141 | Delimiter to be used between ID elements. 142 | Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. 143 | EOT 144 | } 145 | 146 | variable "attributes" { 147 | type = list(string) 148 | default = [] 149 | description = <<-EOT 150 | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`, 151 | in the order they appear in the list. New attributes are appended to the 152 | end of the list. The elements of the list are joined by the `delimiter` 153 | and treated as a single ID element. 154 | EOT 155 | } 156 | 157 | variable "labels_as_tags" { 158 | type = set(string) 159 | default = ["default"] 160 | description = <<-EOT 161 | Set of labels (ID elements) to include as tags in the `tags` output. 162 | Default is to include all labels. 163 | Tags with empty values will not be included in the `tags` output. 164 | Set to `[]` to suppress all generated tags. 165 | **Notes:** 166 | The value of the `name` tag, if included, will be the `id`, not the `name`. 167 | Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be 168 | changed in later chained modules. Attempts to change it will be silently ignored. 169 | EOT 170 | } 171 | 172 | variable "tags" { 173 | type = map(string) 174 | default = {} 175 | description = <<-EOT 176 | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`). 177 | Neither the tag keys nor the tag values will be modified by this module. 178 | EOT 179 | } 180 | 181 | variable "additional_tag_map" { 182 | type = map(string) 183 | default = {} 184 | description = <<-EOT 185 | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`. 186 | This is for some rare cases where resources want additional configuration of tags 187 | and therefore take a list of maps with tag key, value, and additional configuration. 188 | EOT 189 | } 190 | 191 | variable "label_order" { 192 | type = list(string) 193 | default = null 194 | description = <<-EOT 195 | The order in which the labels (ID elements) appear in the `id`. 196 | Defaults to ["namespace", "environment", "stage", "name", "attributes"]. 197 | You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. 198 | EOT 199 | } 200 | 201 | variable "regex_replace_chars" { 202 | type = string 203 | default = null 204 | description = <<-EOT 205 | Terraform regular expression (regex) string. 206 | Characters matching the regex will be removed from the ID elements. 207 | If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. 208 | EOT 209 | } 210 | 211 | variable "id_length_limit" { 212 | type = number 213 | default = null 214 | description = <<-EOT 215 | Limit `id` to this many characters (minimum 6). 216 | Set to `0` for unlimited length. 217 | Set to `null` for keep the existing setting, which defaults to `0`. 218 | Does not affect `id_full`. 219 | EOT 220 | validation { 221 | condition = var.id_length_limit == null ? true : var.id_length_limit >= 6 || var.id_length_limit == 0 222 | error_message = "The id_length_limit must be >= 6 if supplied (not null), or 0 for unlimited length." 223 | } 224 | } 225 | 226 | variable "label_key_case" { 227 | type = string 228 | default = null 229 | description = <<-EOT 230 | Controls the letter case of the `tags` keys (label names) for tags generated by this module. 231 | Does not affect keys of tags passed in via the `tags` input. 232 | Possible values: `lower`, `title`, `upper`. 233 | Default value: `title`. 234 | EOT 235 | 236 | validation { 237 | condition = var.label_key_case == null ? true : contains(["lower", "title", "upper"], var.label_key_case) 238 | error_message = "Allowed values: `lower`, `title`, `upper`." 239 | } 240 | } 241 | 242 | variable "label_value_case" { 243 | type = string 244 | default = null 245 | description = <<-EOT 246 | Controls the letter case of ID elements (labels) as included in `id`, 247 | set as tag values, and output by this module individually. 248 | Does not affect values of tags passed in via the `tags` input. 249 | Possible values: `lower`, `title`, `upper` and `none` (no transformation). 250 | Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs. 251 | Default value: `lower`. 252 | EOT 253 | 254 | validation { 255 | condition = var.label_value_case == null ? true : contains(["lower", "title", "upper", "none"], var.label_value_case) 256 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`." 257 | } 258 | } 259 | 260 | variable "descriptor_formats" { 261 | type = any 262 | default = {} 263 | description = <<-EOT 264 | Describe additional descriptors to be output in the `descriptors` output map. 265 | Map of maps. Keys are names of descriptors. Values are maps of the form 266 | `{ 267 | format = string 268 | labels = list(string) 269 | }` 270 | (Type is `any` so the map values can later be enhanced to provide additional options.) 271 | `format` is a Terraform format string to be passed to the `format()` function. 272 | `labels` is a list of labels, in order, to pass to `format()` function. 273 | Label values will be normalized before being passed to `format()` so they will be 274 | identical to how they appear in `id`. 275 | Default is `{}` (`descriptors` output will be empty). 276 | EOT 277 | } 278 | 279 | #### End of copy of cloudposse/terraform-null-label/variables.tf 280 | -------------------------------------------------------------------------------- /examples/serverless/context.tf: -------------------------------------------------------------------------------- 1 | # 2 | # ONLY EDIT THIS FILE IN github.com/cloudposse/terraform-null-label 3 | # All other instances of this file should be a copy of that one 4 | # 5 | # 6 | # Copy this file from https://github.com/cloudposse/terraform-null-label/blob/master/exports/context.tf 7 | # and then place it in your Terraform module to automatically get 8 | # Cloud Posse's standard configuration inputs suitable for passing 9 | # to Cloud Posse modules. 10 | # 11 | # curl -sL https://raw.githubusercontent.com/cloudposse/terraform-null-label/master/exports/context.tf -o context.tf 12 | # 13 | # Modules should access the whole context as `module.this.context` 14 | # to get the input variables with nulls for defaults, 15 | # for example `context = module.this.context`, 16 | # and access individual variables as `module.this.`, 17 | # with final values filled in. 18 | # 19 | # For example, when using defaults, `module.this.context.delimiter` 20 | # will be null, and `module.this.delimiter` will be `-` (hyphen). 21 | # 22 | 23 | module "this" { 24 | source = "cloudposse/label/null" 25 | version = "0.25.0" # requires Terraform >= 0.13.0 26 | 27 | enabled = var.enabled 28 | namespace = var.namespace 29 | tenant = var.tenant 30 | environment = var.environment 31 | stage = var.stage 32 | name = var.name 33 | delimiter = var.delimiter 34 | attributes = var.attributes 35 | tags = var.tags 36 | additional_tag_map = var.additional_tag_map 37 | label_order = var.label_order 38 | regex_replace_chars = var.regex_replace_chars 39 | id_length_limit = var.id_length_limit 40 | label_key_case = var.label_key_case 41 | label_value_case = var.label_value_case 42 | descriptor_formats = var.descriptor_formats 43 | labels_as_tags = var.labels_as_tags 44 | 45 | context = var.context 46 | } 47 | 48 | # Copy contents of cloudposse/terraform-null-label/variables.tf here 49 | 50 | variable "context" { 51 | type = any 52 | default = { 53 | enabled = true 54 | namespace = null 55 | tenant = null 56 | environment = null 57 | stage = null 58 | name = null 59 | delimiter = null 60 | attributes = [] 61 | tags = {} 62 | additional_tag_map = {} 63 | regex_replace_chars = null 64 | label_order = [] 65 | id_length_limit = null 66 | label_key_case = null 67 | label_value_case = null 68 | descriptor_formats = {} 69 | # Note: we have to use [] instead of null for unset lists due to 70 | # https://github.com/hashicorp/terraform/issues/28137 71 | # which was not fixed until Terraform 1.0.0, 72 | # but we want the default to be all the labels in `label_order` 73 | # and we want users to be able to prevent all tag generation 74 | # by setting `labels_as_tags` to `[]`, so we need 75 | # a different sentinel to indicate "default" 76 | labels_as_tags = ["unset"] 77 | } 78 | description = <<-EOT 79 | Single object for setting entire context at once. 80 | See description of individual variables for details. 81 | Leave string and numeric variables as `null` to use default value. 82 | Individual variable settings (non-null) override settings in context object, 83 | except for attributes, tags, and additional_tag_map, which are merged. 84 | EOT 85 | 86 | validation { 87 | condition = lookup(var.context, "label_key_case", null) == null ? true : contains(["lower", "title", "upper"], var.context["label_key_case"]) 88 | error_message = "Allowed values: `lower`, `title`, `upper`." 89 | } 90 | 91 | validation { 92 | condition = lookup(var.context, "label_value_case", null) == null ? true : contains(["lower", "title", "upper", "none"], var.context["label_value_case"]) 93 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`." 94 | } 95 | } 96 | 97 | variable "enabled" { 98 | type = bool 99 | default = null 100 | description = "Set to false to prevent the module from creating any resources" 101 | } 102 | 103 | variable "namespace" { 104 | type = string 105 | default = null 106 | description = "ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique" 107 | } 108 | 109 | variable "tenant" { 110 | type = string 111 | default = null 112 | description = "ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for" 113 | } 114 | 115 | variable "environment" { 116 | type = string 117 | default = null 118 | description = "ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'" 119 | } 120 | 121 | variable "stage" { 122 | type = string 123 | default = null 124 | description = "ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'" 125 | } 126 | 127 | variable "name" { 128 | type = string 129 | default = null 130 | description = <<-EOT 131 | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'. 132 | This is the only ID element not also included as a `tag`. 133 | The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. 134 | EOT 135 | } 136 | 137 | variable "delimiter" { 138 | type = string 139 | default = null 140 | description = <<-EOT 141 | Delimiter to be used between ID elements. 142 | Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. 143 | EOT 144 | } 145 | 146 | variable "attributes" { 147 | type = list(string) 148 | default = [] 149 | description = <<-EOT 150 | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`, 151 | in the order they appear in the list. New attributes are appended to the 152 | end of the list. The elements of the list are joined by the `delimiter` 153 | and treated as a single ID element. 154 | EOT 155 | } 156 | 157 | variable "labels_as_tags" { 158 | type = set(string) 159 | default = ["default"] 160 | description = <<-EOT 161 | Set of labels (ID elements) to include as tags in the `tags` output. 162 | Default is to include all labels. 163 | Tags with empty values will not be included in the `tags` output. 164 | Set to `[]` to suppress all generated tags. 165 | **Notes:** 166 | The value of the `name` tag, if included, will be the `id`, not the `name`. 167 | Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be 168 | changed in later chained modules. Attempts to change it will be silently ignored. 169 | EOT 170 | } 171 | 172 | variable "tags" { 173 | type = map(string) 174 | default = {} 175 | description = <<-EOT 176 | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`). 177 | Neither the tag keys nor the tag values will be modified by this module. 178 | EOT 179 | } 180 | 181 | variable "additional_tag_map" { 182 | type = map(string) 183 | default = {} 184 | description = <<-EOT 185 | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`. 186 | This is for some rare cases where resources want additional configuration of tags 187 | and therefore take a list of maps with tag key, value, and additional configuration. 188 | EOT 189 | } 190 | 191 | variable "label_order" { 192 | type = list(string) 193 | default = null 194 | description = <<-EOT 195 | The order in which the labels (ID elements) appear in the `id`. 196 | Defaults to ["namespace", "environment", "stage", "name", "attributes"]. 197 | You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. 198 | EOT 199 | } 200 | 201 | variable "regex_replace_chars" { 202 | type = string 203 | default = null 204 | description = <<-EOT 205 | Terraform regular expression (regex) string. 206 | Characters matching the regex will be removed from the ID elements. 207 | If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. 208 | EOT 209 | } 210 | 211 | variable "id_length_limit" { 212 | type = number 213 | default = null 214 | description = <<-EOT 215 | Limit `id` to this many characters (minimum 6). 216 | Set to `0` for unlimited length. 217 | Set to `null` for keep the existing setting, which defaults to `0`. 218 | Does not affect `id_full`. 219 | EOT 220 | validation { 221 | condition = var.id_length_limit == null ? true : var.id_length_limit >= 6 || var.id_length_limit == 0 222 | error_message = "The id_length_limit must be >= 6 if supplied (not null), or 0 for unlimited length." 223 | } 224 | } 225 | 226 | variable "label_key_case" { 227 | type = string 228 | default = null 229 | description = <<-EOT 230 | Controls the letter case of the `tags` keys (label names) for tags generated by this module. 231 | Does not affect keys of tags passed in via the `tags` input. 232 | Possible values: `lower`, `title`, `upper`. 233 | Default value: `title`. 234 | EOT 235 | 236 | validation { 237 | condition = var.label_key_case == null ? true : contains(["lower", "title", "upper"], var.label_key_case) 238 | error_message = "Allowed values: `lower`, `title`, `upper`." 239 | } 240 | } 241 | 242 | variable "label_value_case" { 243 | type = string 244 | default = null 245 | description = <<-EOT 246 | Controls the letter case of ID elements (labels) as included in `id`, 247 | set as tag values, and output by this module individually. 248 | Does not affect values of tags passed in via the `tags` input. 249 | Possible values: `lower`, `title`, `upper` and `none` (no transformation). 250 | Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs. 251 | Default value: `lower`. 252 | EOT 253 | 254 | validation { 255 | condition = var.label_value_case == null ? true : contains(["lower", "title", "upper", "none"], var.label_value_case) 256 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`." 257 | } 258 | } 259 | 260 | variable "descriptor_formats" { 261 | type = any 262 | default = {} 263 | description = <<-EOT 264 | Describe additional descriptors to be output in the `descriptors` output map. 265 | Map of maps. Keys are names of descriptors. Values are maps of the form 266 | `{ 267 | format = string 268 | labels = list(string) 269 | }` 270 | (Type is `any` so the map values can later be enhanced to provide additional options.) 271 | `format` is a Terraform format string to be passed to the `format()` function. 272 | `labels` is a list of labels, in order, to pass to `format()` function. 273 | Label values will be normalized before being passed to `format()` so they will be 274 | identical to how they appear in `id`. 275 | Default is `{}` (`descriptors` output will be empty). 276 | EOT 277 | } 278 | 279 | #### End of copy of cloudposse/terraform-null-label/variables.tf 280 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Apache License 2 | Version 2.0, January 2004 3 | http://www.apache.org/licenses/ 4 | 5 | TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 6 | 7 | 1. Definitions. 8 | 9 | "License" shall mean the terms and conditions for use, reproduction, 10 | and distribution as defined by Sections 1 through 9 of this document. 11 | 12 | "Licensor" shall mean the copyright owner or entity authorized by 13 | the copyright owner that is granting the License. 14 | 15 | "Legal Entity" shall mean the union of the acting entity and all 16 | other entities that control, are controlled by, or are under common 17 | control with that entity. For the purposes of this definition, 18 | "control" means (i) the power, direct or indirect, to cause the 19 | direction or management of such entity, whether by contract or 20 | otherwise, or (ii) ownership of fifty percent (50%) or more of the 21 | outstanding shares, or (iii) beneficial ownership of such entity. 22 | 23 | "You" (or "Your") shall mean an individual or Legal Entity 24 | exercising permissions granted by this License. 25 | 26 | "Source" form shall mean the preferred form for making modifications, 27 | including but not limited to software source code, documentation 28 | source, and configuration files. 29 | 30 | "Object" form shall mean any form resulting from mechanical 31 | transformation or translation of a Source form, including but 32 | not limited to compiled object code, generated documentation, 33 | and conversions to other media types. 34 | 35 | "Work" shall mean the work of authorship, whether in Source or 36 | Object form, made available under the License, as indicated by a 37 | copyright notice that is included in or attached to the work 38 | (an example is provided in the Appendix below). 39 | 40 | "Derivative Works" shall mean any work, whether in Source or Object 41 | form, that is based on (or derived from) the Work and for which the 42 | editorial revisions, annotations, elaborations, or other modifications 43 | represent, as a whole, an original work of authorship. For the purposes 44 | of this License, Derivative Works shall not include works that remain 45 | separable from, or merely link (or bind by name) to the interfaces of, 46 | the Work and Derivative Works thereof. 47 | 48 | "Contribution" shall mean any work of authorship, including 49 | the original version of the Work and any modifications or additions 50 | to that Work or Derivative Works thereof, that is intentionally 51 | submitted to Licensor for inclusion in the Work by the copyright owner 52 | or by an individual or Legal Entity authorized to submit on behalf of 53 | the copyright owner. For the purposes of this definition, "submitted" 54 | means any form of electronic, verbal, or written communication sent 55 | to the Licensor or its representatives, including but not limited to 56 | communication on electronic mailing lists, source code control systems, 57 | and issue tracking systems that are managed by, or on behalf of, the 58 | Licensor for the purpose of discussing and improving the Work, but 59 | excluding communication that is conspicuously marked or otherwise 60 | designated in writing by the copyright owner as "Not a Contribution." 61 | 62 | "Contributor" shall mean Licensor and any individual or Legal Entity 63 | on behalf of whom a Contribution has been received by Licensor and 64 | subsequently incorporated within the Work. 65 | 66 | 2. Grant of Copyright License. Subject to the terms and conditions of 67 | this License, each Contributor hereby grants to You a perpetual, 68 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 69 | copyright license to reproduce, prepare Derivative Works of, 70 | publicly display, publicly perform, sublicense, and distribute the 71 | Work and such Derivative Works in Source or Object form. 72 | 73 | 3. Grant of Patent License. Subject to the terms and conditions of 74 | this License, each Contributor hereby grants to You a perpetual, 75 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 76 | (except as stated in this section) patent license to make, have made, 77 | use, offer to sell, sell, import, and otherwise transfer the Work, 78 | where such license applies only to those patent claims licensable 79 | by such Contributor that are necessarily infringed by their 80 | Contribution(s) alone or by combination of their Contribution(s) 81 | with the Work to which such Contribution(s) was submitted. If You 82 | institute patent litigation against any entity (including a 83 | cross-claim or counterclaim in a lawsuit) alleging that the Work 84 | or a Contribution incorporated within the Work constitutes direct 85 | or contributory patent infringement, then any patent licenses 86 | granted to You under this License for that Work shall terminate 87 | as of the date such litigation is filed. 88 | 89 | 4. Redistribution. You may reproduce and distribute copies of the 90 | Work or Derivative Works thereof in any medium, with or without 91 | modifications, and in Source or Object form, provided that You 92 | meet the following conditions: 93 | 94 | (a) You must give any other recipients of the Work or 95 | Derivative Works a copy of this License; and 96 | 97 | (b) You must cause any modified files to carry prominent notices 98 | stating that You changed the files; and 99 | 100 | (c) You must retain, in the Source form of any Derivative Works 101 | that You distribute, all copyright, patent, trademark, and 102 | attribution notices from the Source form of the Work, 103 | excluding those notices that do not pertain to any part of 104 | the Derivative Works; and 105 | 106 | (d) If the Work includes a "NOTICE" text file as part of its 107 | distribution, then any Derivative Works that You distribute must 108 | include a readable copy of the attribution notices contained 109 | within such NOTICE file, excluding those notices that do not 110 | pertain to any part of the Derivative Works, in at least one 111 | of the following places: within a NOTICE text file distributed 112 | as part of the Derivative Works; within the Source form or 113 | documentation, if provided along with the Derivative Works; or, 114 | within a display generated by the Derivative Works, if and 115 | wherever such third-party notices normally appear. The contents 116 | of the NOTICE file are for informational purposes only and 117 | do not modify the License. You may add Your own attribution 118 | notices within Derivative Works that You distribute, alongside 119 | or as an addendum to the NOTICE text from the Work, provided 120 | that such additional attribution notices cannot be construed 121 | as modifying the License. 122 | 123 | You may add Your own copyright statement to Your modifications and 124 | may provide additional or different license terms and conditions 125 | for use, reproduction, or distribution of Your modifications, or 126 | for any such Derivative Works as a whole, provided Your use, 127 | reproduction, and distribution of the Work otherwise complies with 128 | the conditions stated in this License. 129 | 130 | 5. Submission of Contributions. Unless You explicitly state otherwise, 131 | any Contribution intentionally submitted for inclusion in the Work 132 | by You to the Licensor shall be under the terms and conditions of 133 | this License, without any additional terms or conditions. 134 | Notwithstanding the above, nothing herein shall supersede or modify 135 | the terms of any separate license agreement you may have executed 136 | with Licensor regarding such Contributions. 137 | 138 | 6. Trademarks. This License does not grant permission to use the trade 139 | names, trademarks, service marks, or product names of the Licensor, 140 | except as required for reasonable and customary use in describing the 141 | origin of the Work and reproducing the content of the NOTICE file. 142 | 143 | 7. Disclaimer of Warranty. Unless required by applicable law or 144 | agreed to in writing, Licensor provides the Work (and each 145 | Contributor provides its Contributions) on an "AS IS" BASIS, 146 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or 147 | implied, including, without limitation, any warranties or conditions 148 | of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A 149 | PARTICULAR PURPOSE. You are solely responsible for determining the 150 | appropriateness of using or redistributing the Work and assume any 151 | risks associated with Your exercise of permissions under this License. 152 | 153 | 8. Limitation of Liability. In no event and under no legal theory, 154 | whether in tort (including negligence), contract, or otherwise, 155 | unless required by applicable law (such as deliberate and grossly 156 | negligent acts) or agreed to in writing, shall any Contributor be 157 | liable to You for damages, including any direct, indirect, special, 158 | incidental, or consequential damages of any character arising as a 159 | result of this License or out of the use or inability to use the 160 | Work (including but not limited to damages for loss of goodwill, 161 | work stoppage, computer failure or malfunction, or any and all 162 | other commercial damages or losses), even if such Contributor 163 | has been advised of the possibility of such damages. 164 | 165 | 9. Accepting Warranty or Additional Liability. While redistributing 166 | the Work or Derivative Works thereof, You may choose to offer, 167 | and charge a fee for, acceptance of support, warranty, indemnity, 168 | or other liability obligations and/or rights consistent with this 169 | License. However, in accepting such obligations, You may act only 170 | on Your own behalf and on Your sole responsibility, not on behalf 171 | of any other Contributor, and only if You agree to indemnify, 172 | defend, and hold each Contributor harmless for any liability 173 | incurred by, or claims asserted against, such Contributor by reason 174 | of your accepting any such warranty or additional liability. 175 | 176 | END OF TERMS AND CONDITIONS 177 | 178 | APPENDIX: How to apply the Apache License to your work. 179 | 180 | To apply the Apache License to your work, attach the following 181 | boilerplate notice, with the fields enclosed by brackets "[]" 182 | replaced with your own identifying information. (Don't include 183 | the brackets!) The text should be enclosed in the appropriate 184 | comment syntax for the file format. We also recommend that a 185 | file or class name and description of purpose be included on the 186 | same "printed page" as the copyright notice for easier 187 | identification within third-party archives. 188 | 189 | Copyright 2019-2021 Cloud Posse, LLC 190 | 191 | Licensed under the Apache License, Version 2.0 (the "License"); 192 | you may not use this file except in compliance with the License. 193 | You may obtain a copy of the License at 194 | 195 | http://www.apache.org/licenses/LICENSE-2.0 196 | 197 | Unless required by applicable law or agreed to in writing, software 198 | distributed under the License is distributed on an "AS IS" BASIS, 199 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 200 | See the License for the specific language governing permissions and 201 | limitations under the License. 202 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Project Banner
5 | 6 | 7 |

Latest ReleaseLast UpdatedSlack CommunityGet Support 8 | 9 |

10 | 11 | 12 | 32 | 33 | Terraform module to provision an [`Amazon DocumentDB`](https://aws.amazon.com/documentdb/) cluster. 34 | 35 | 36 | > [!TIP] 37 | > #### 👽 Use Atmos with Terraform 38 | > Cloud Posse uses [`atmos`](https://atmos.tools) to easily orchestrate multiple environments using Terraform.
39 | > Works with [Github Actions](https://atmos.tools/integrations/github-actions/), [Atlantis](https://atmos.tools/integrations/atlantis), or [Spacelift](https://atmos.tools/integrations/spacelift). 40 | > 41 | >
42 | > Watch demo of using Atmos with Terraform 43 | >
44 | > Example of running atmos to manage infrastructure from our Quick Start tutorial. 45 | > 46 | 47 | 48 | 49 | 50 | 51 | ## Usage 52 | 53 | For a complete example, see [examples/complete](examples/complete). 54 | 55 | For automated tests of the complete example using [bats](https://github.com/bats-core/bats-core) and [Terratest](https://github.com/gruntwork-io/terratest) (which tests and deploys the example on AWS), see [test](test). 56 | 57 | ```hcl 58 | module "documentdb_cluster" { 59 | source = "cloudposse/documentdb-cluster/aws" 60 | # Cloud Posse recommends pinning every module to a specific version 61 | # version = "x.x.x" 62 | namespace = "eg" 63 | stage = "testing" 64 | name = "docdb" 65 | cluster_size = 3 66 | master_username = "admin1" 67 | master_password = "Test123456789" 68 | instance_class = "db.r4.large" 69 | vpc_id = "vpc-xxxxxxxx" 70 | subnet_ids = ["subnet-xxxxxxxx", "subnet-yyyyyyyy"] 71 | allowed_security_groups = ["sg-xxxxxxxx"] 72 | zone_id = "Zxxxxxxxx" 73 | } 74 | ``` 75 | 76 | > [!IMPORTANT] 77 | > In Cloud Posse's examples, we avoid pinning modules to specific versions to prevent discrepancies between the documentation 78 | > and the latest released versions. However, for your own projects, we strongly advise pinning each module to the exact version 79 | > you're using. This practice ensures the stability of your infrastructure. Additionally, we recommend implementing a systematic 80 | > approach for updating versions to avoid unexpected changes. 81 | 82 | 83 | 84 | 85 | 86 | 87 | 88 | 89 | 90 | ## Requirements 91 | 92 | | Name | Version | 93 | |------|---------| 94 | | [terraform](#requirement\_terraform) | >= 1.3 | 95 | | [aws](#requirement\_aws) | >= 6.8.0 | 96 | | [local](#requirement\_local) | >= 1.3 | 97 | | [random](#requirement\_random) | >= 1.0 | 98 | 99 | ## Providers 100 | 101 | | Name | Version | 102 | |------|---------| 103 | | [aws](#provider\_aws) | >= 6.8.0 | 104 | | [random](#provider\_random) | >= 1.0 | 105 | 106 | ## Modules 107 | 108 | | Name | Source | Version | 109 | |------|--------|---------| 110 | | [dns\_master](#module\_dns\_master) | cloudposse/route53-cluster-hostname/aws | 0.13.0 | 111 | | [dns\_replicas](#module\_dns\_replicas) | cloudposse/route53-cluster-hostname/aws | 0.13.0 | 112 | | [ssm\_write\_db\_password](#module\_ssm\_write\_db\_password) | cloudposse/ssm-parameter-store/aws | 0.13.0 | 113 | | [this](#module\_this) | cloudposse/label/null | 0.25.0 | 114 | 115 | ## Resources 116 | 117 | | Name | Type | 118 | |------|------| 119 | | [aws_docdb_cluster.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/docdb_cluster) | resource | 120 | | [aws_docdb_cluster_instance.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/docdb_cluster_instance) | resource | 121 | | [aws_docdb_cluster_parameter_group.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/docdb_cluster_parameter_group) | resource | 122 | | [aws_docdb_subnet_group.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/docdb_subnet_group) | resource | 123 | | [aws_security_group.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource | 124 | | [aws_security_group_rule.allow_ingress_from_self](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource | 125 | | [aws_security_group_rule.egress](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource | 126 | | [aws_security_group_rule.ingress_cidr_blocks](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource | 127 | | [aws_security_group_rule.ingress_security_groups](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource | 128 | | [random_password.password](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) | resource | 129 | 130 | ## Inputs 131 | 132 | | Name | Description | Type | Default | Required | 133 | |------|-------------|------|---------|:--------:| 134 | | [additional\_tag\_map](#input\_additional\_tag\_map) | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`.
This is for some rare cases where resources want additional configuration of tags
and therefore take a list of maps with tag key, value, and additional configuration. | `map(string)` | `{}` | no | 135 | | [allow\_ingress\_from\_self](#input\_allow\_ingress\_from\_self) | Adds the Document DB security group itself as a source for ingress rules. Useful when this security group will be shared with applications. | `bool` | `false` | no | 136 | | [allow\_major\_version\_upgrade](#input\_allow\_major\_version\_upgrade) | Specifies whether major version upgrades are allowed. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/docdb_cluster#allow_major_version_upgrade | `bool` | `false` | no | 137 | | [allowed\_cidr\_blocks](#input\_allowed\_cidr\_blocks) | List of CIDR blocks to be allowed to connect to the DocumentDB cluster | `list(string)` | `[]` | no | 138 | | [allowed\_egress\_cidr\_blocks](#input\_allowed\_egress\_cidr\_blocks) | List of CIDR blocks to be allowed to send traffic outside of the DocumentDB cluster | `list(string)` | 
[
  "0.0.0.0/0"
]
| no | 139 | | [allowed\_security\_groups](#input\_allowed\_security\_groups) | List of existing Security Groups to be allowed to connect to the DocumentDB cluster | `list(string)` | `[]` | no | 140 | | [apply\_immediately](#input\_apply\_immediately) | Specifies whether any cluster modifications are applied immediately, or during the next maintenance window | `bool` | `true` | no | 141 | | [attributes](#input\_attributes) | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,
in the order they appear in the list. New attributes are appended to the
end of the list. The elements of the list are joined by the `delimiter`
and treated as a single ID element. | `list(string)` | `[]` | no | 142 | | [auto\_minor\_version\_upgrade](#input\_auto\_minor\_version\_upgrade) | Specifies whether any minor engine upgrades will be applied automatically to the DB instance during the maintenance window or not | `bool` | `true` | no | 143 | | [ca\_cert\_identifier](#input\_ca\_cert\_identifier) | The identifier of the CA certificate for the DB instance | `string` | `null` | no | 144 | | [cluster\_dns\_name](#input\_cluster\_dns\_name) | Name of the cluster CNAME record to create in the parent DNS zone specified by `zone_id`. If left empty, the name will be auto-asigned using the format `master.var.name` | `string` | `""` | no | 145 | | [cluster\_family](#input\_cluster\_family) | The family of the DocumentDB cluster parameter group. For more details, see https://docs.aws.amazon.com/documentdb/latest/developerguide/db-cluster-parameter-group-create.html | `string` | `"docdb3.6"` | no | 146 | | [cluster\_parameters](#input\_cluster\_parameters) | List of DB parameters to apply | 
list(object({
    apply_method = string
    name         = string
    value        = string
  }))
| `[]` | no | 147 | | [cluster\_size](#input\_cluster\_size) | Number of DB instances to create in the cluster | `number` | `3` | no | 148 | | [context](#input\_context) | Single object for setting entire context at once.
See description of individual variables for details.
Leave string and numeric variables as `null` to use default value.
Individual variable settings (non-null) override settings in context object,
except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | 
{
  "additional_tag_map": {},
  "attributes": [],
  "delimiter": null,
  "descriptor_formats": {},
  "enabled": true,
  "environment": null,
  "id_length_limit": null,
  "label_key_case": null,
  "label_order": [],
  "label_value_case": null,
  "labels_as_tags": [
    "unset"
  ],
  "name": null,
  "namespace": null,
  "regex_replace_chars": null,
  "stage": null,
  "tags": {},
  "tenant": null
}
| no | 149 | | [db\_port](#input\_db\_port) | DocumentDB port | `number` | `27017` | no | 150 | | [deletion\_protection](#input\_deletion\_protection) | A value that indicates whether the DB cluster has deletion protection enabled | `bool` | `false` | no | 151 | | [delimiter](#input\_delimiter) | Delimiter to be used between ID elements.
Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no | 152 | | [descriptor\_formats](#input\_descriptor\_formats) | Describe additional descriptors to be output in the `descriptors` output map.
Map of maps. Keys are names of descriptors. Values are maps of the form
`{
format = string
labels = list(string)
}`
(Type is `any` so the map values can later be enhanced to provide additional options.)
`format` is a Terraform format string to be passed to the `format()` function.
`labels` is a list of labels, in order, to pass to `format()` function.
Label values will be normalized before being passed to `format()` so they will be
identical to how they appear in `id`.
Default is `{}` (`descriptors` output will be empty). | `any` | `{}` | no | 153 | | [egress\_from\_port](#input\_egress\_from\_port) | [from\_port]DocumentDB initial port range for egress (e.g. `0`) | `number` | `0` | no | 154 | | [egress\_protocol](#input\_egress\_protocol) | DocumentDB protocol for egress (e.g. `-1`, `tcp`) | `string` | `"-1"` | no | 155 | | [egress\_to\_port](#input\_egress\_to\_port) | [to\_port]DocumentDB initial port range for egress (e.g. `65535`) | `number` | `0` | no | 156 | | [enable\_performance\_insights](#input\_enable\_performance\_insights) | Specifies whether to enable Performance Insights for the DB Instance. | `bool` | `false` | no | 157 | | [enabled](#input\_enabled) | Set to false to prevent the module from creating any resources | `bool` | `null` | no | 158 | | [enabled\_cloudwatch\_logs\_exports](#input\_enabled\_cloudwatch\_logs\_exports) | List of log types to export to cloudwatch. The following log types are supported: `audit`, `profiler` | `list(string)` | `[]` | no | 159 | | [engine](#input\_engine) | The name of the database engine to be used for this DB cluster. Defaults to `docdb`. Valid values: `docdb` | `string` | `"docdb"` | no | 160 | | [engine\_version](#input\_engine\_version) | The version number of the database engine to use | `string` | `"3.6.0"` | no | 161 | | [environment](#input\_environment) | ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT' | `string` | `null` | no | 162 | | [external\_security\_group\_id\_list](#input\_external\_security\_group\_id\_list) | List of external security group IDs to attach to the Document DB | `list(string)` | `[]` | no | 163 | | [id\_length\_limit](#input\_id\_length\_limit) | Limit `id` to this many characters (minimum 6).
Set to `0` for unlimited length.
Set to `null` for keep the existing setting, which defaults to `0`.
Does not affect `id_full`. | `number` | `null` | no | 164 | | [instance\_class](#input\_instance\_class) | The instance class to use. For more details, see https://docs.aws.amazon.com/documentdb/latest/developerguide/db-instance-classes.html#db-instance-class-specs | `string` | `"db.r4.large"` | no | 165 | | [kms\_key\_id](#input\_kms\_key\_id) | The ARN for the KMS encryption key. When specifying `kms_key_id`, `storage_encrypted` needs to be set to `true` | `string` | `""` | no | 166 | | [label\_key\_case](#input\_label\_key\_case) | Controls the letter case of the `tags` keys (label names) for tags generated by this module.
Does not affect keys of tags passed in via the `tags` input.
Possible values: `lower`, `title`, `upper`.
Default value: `title`. | `string` | `null` | no | 167 | | [label\_order](#input\_label\_order) | The order in which the labels (ID elements) appear in the `id`.
Defaults to ["namespace", "environment", "stage", "name", "attributes"].
You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. | `list(string)` | `null` | no | 168 | | [label\_value\_case](#input\_label\_value\_case) | Controls the letter case of ID elements (labels) as included in `id`,
set as tag values, and output by this module individually.
Does not affect values of tags passed in via the `tags` input.
Possible values: `lower`, `title`, `upper` and `none` (no transformation).
Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs.
Default value: `lower`. | `string` | `null` | no | 169 | | [labels\_as\_tags](#input\_labels\_as\_tags) | Set of labels (ID elements) to include as tags in the `tags` output.
Default is to include all labels.
Tags with empty values will not be included in the `tags` output.
Set to `[]` to suppress all generated tags.
**Notes:**
The value of the `name` tag, if included, will be the `id`, not the `name`.
Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be
changed in later chained modules. Attempts to change it will be silently ignored. | `set(string)` | 
[
  "default"
]
| no | 170 | | [manage\_master\_user\_password](#input\_manage\_master\_user\_password) | Whether to manage the master user password using AWS Secrets Manager. | `bool` | `null` | no | 171 | | [master\_password](#input\_master\_password) | (Required unless a snapshot\_identifier is provided) Password for the master DB user. Note that this may show up in logs, and it will be stored in the state file. Please refer to the DocumentDB Naming Constraints | `string` | `null` | no | 172 | | [master\_username](#input\_master\_username) | (Required unless a snapshot\_identifier is provided) Username for the master DB user | `string` | `"admin1"` | no | 173 | | [name](#input\_name) | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.
This is the only ID element not also included as a `tag`.
The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. | `string` | `null` | no | 174 | | [namespace](#input\_namespace) | ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique | `string` | `null` | no | 175 | | [preferred\_backup\_window](#input\_preferred\_backup\_window) | Daily time range during which the backups happen | `string` | `"07:00-09:00"` | no | 176 | | [preferred\_maintenance\_window](#input\_preferred\_maintenance\_window) | The window to perform maintenance in. Syntax: `ddd:hh24:mi-ddd:hh24:mi`. | `string` | `"Mon:22:00-Mon:23:00"` | no | 177 | | [reader\_dns\_name](#input\_reader\_dns\_name) | Name of the reader endpoint CNAME record to create in the parent DNS zone specified by `zone_id`. If left empty, the name will be auto-asigned using the format `replicas.var.name` | `string` | `""` | no | 178 | | [regex\_replace\_chars](#input\_regex\_replace\_chars) | Terraform regular expression (regex) string.
Characters matching the regex will be removed from the ID elements.
If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. | `string` | `null` | no | 179 | | [retention\_period](#input\_retention\_period) | Number of days to retain backups for | `number` | `5` | no | 180 | | [serverless\_v2\_scaling\_configuration](#input\_serverless\_v2\_scaling\_configuration) | Configuration for serverless v2 scaling. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/docdb_cluster#serverless_v2_scaling_configuration | 
object({
    min_capacity = optional(number, 0.5)
    max_capacity = optional(number, 256)
  })
| `null` | no | 181 | | [skip\_final\_snapshot](#input\_skip\_final\_snapshot) | Determines whether a final DB snapshot is created before the DB cluster is deleted | `bool` | `true` | no | 182 | | [snapshot\_identifier](#input\_snapshot\_identifier) | Specifies whether or not to create this cluster from a snapshot. You can use either the name or ARN when specifying a DB cluster snapshot, or the ARN when specifying a DB snapshot | `string` | `""` | no | 183 | | [ssm\_parameter\_enabled](#input\_ssm\_parameter\_enabled) | Whether an SSM parameter store value is created to store the database password. | `bool` | `false` | no | 184 | | [ssm\_parameter\_path\_prefix](#input\_ssm\_parameter\_path\_prefix) | The path prefix for the created SSM parameter e.g. '/docdb/master-password/dev'. `ssm_parameter_enabled` must be set to `true` for this to take affect. | `string` | `"/docdb/master-password/"` | no | 185 | | [stage](#input\_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no | 186 | | [storage\_encrypted](#input\_storage\_encrypted) | Specifies whether the DB cluster is encrypted | `bool` | `true` | no | 187 | | [storage\_type](#input\_storage\_type) | The storage type to associate with the DB cluster. Valid values: standard, iopt1 | `string` | `"standard"` | no | 188 | | [subnet\_ids](#input\_subnet\_ids) | List of VPC subnet IDs to place DocumentDB instances in | `list(string)` | n/a | yes | 189 | | [tags](#input\_tags) | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).
Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no | 190 | | [tenant](#input\_tenant) | ID element \_(Rarely used, not included by default)\_. A customer identifier, indicating who this instance of a resource is for | `string` | `null` | no | 191 | | [vpc\_id](#input\_vpc\_id) | VPC ID to create the cluster in (e.g. `vpc-a22222ee`) | `string` | n/a | yes | 192 | | [zone\_id](#input\_zone\_id) | Route53 parent zone ID. If provided (not empty), the module will create sub-domain DNS records for the DocumentDB master and replicas | `string` | `""` | no | 193 | 194 | ## Outputs 195 | 196 | | Name | Description | 197 | |------|-------------| 198 | | [arn](#output\_arn) | Amazon Resource Name (ARN) of the cluster | 199 | | [cluster\_members](#output\_cluster\_members) | List of DocumentDB Instances that are a part of this cluster | 200 | | [cluster\_name](#output\_cluster\_name) | Cluster Identifier | 201 | | [endpoint](#output\_endpoint) | Endpoint of the DocumentDB cluster | 202 | | [master\_host](#output\_master\_host) | DB master hostname | 203 | | [master\_password](#output\_master\_password) | Password for the master DB user. If `manage_master_user_password` is set to true, this will be set to null and the password is managed by AWS in Secrets Manager. | 204 | | [master\_username](#output\_master\_username) | Username for the master DB user | 205 | | [reader\_endpoint](#output\_reader\_endpoint) | A read-only endpoint of the DocumentDB cluster, automatically load-balanced across replicas | 206 | | [replicas\_host](#output\_replicas\_host) | DB replicas hostname | 207 | | [security\_group\_arn](#output\_security\_group\_arn) | ARN of the DocumentDB cluster Security Group | 208 | | [security\_group\_id](#output\_security\_group\_id) | ID of the DocumentDB cluster Security Group | 209 | | [security\_group\_name](#output\_security\_group\_name) | Name of the DocumentDB cluster Security Group | 210 | 211 | 212 | 213 | 214 | 215 | 216 | 217 | 218 | ## Related Projects 219 | 220 | Check out these related projects. 221 | 222 | - [terraform-aws-rds](https://github.com/cloudposse/terraform-aws-rds) - Terraform module to provision AWS RDS instances for MySQL or Postgres 223 | - [terraform-aws-rds-cluster](https://github.com/cloudposse/terraform-aws-rds-cluster) - Terraform module to provision an RDS Aurora cluster for MySQL or Postgres 224 | - [terraform-aws-rds-cloudwatch-sns-alarms](https://github.com/cloudposse/terraform-aws-rds-cloudwatch-sns-alarms) - Terraform module that configures important RDS alerts using CloudWatch and sends them to an SNS topic 225 | 226 | 227 | ## References 228 | 229 | For additional context, refer to some of these links. 230 | 231 | - [Creating an Amazon DocumentDB Cluster](https://docs.aws.amazon.com/documentdb/latest/developerguide/db-cluster-create.html) - official AWS documentation on how to create a DocumentDB cluster 232 | - [Amazon DocumentDB Instance Class Specifications](https://docs.aws.amazon.com/documentdb/latest/developerguide/db-instance-classes.html#db-instance-class-specs) - provides details of the Amazon DocumentDB instance classes 233 | - [Creating an Amazon DocumentDB Cluster Parameter Group](https://docs.aws.amazon.com/documentdb/latest/developerguide/db-cluster-parameter-group-create.html) - official AWS documentation on how to create an Amazon DocumentDB Cluster Parameter Group 234 | - [Amazon DocumentDB Limits](https://docs.aws.amazon.com/documentdb/latest/developerguide/limits.html) - describes the resource limits and naming constraints for Amazon DocumentDB 235 | - [Understanding Amazon DocumentDB Amazon Resource Names (ARNs)](https://docs.aws.amazon.com/documentdb/latest/developerguide/documentdb-arns.html) - describes ARN formats for DocumentDB resources 236 | - [Amazon DocumentDB Parameters](https://docs.aws.amazon.com/documentdb/latest/developerguide/db-cluster-parameters.html) - lists all the parameters that are specific to a DocumentDB cluster 237 | - [Tagging Amazon DocumentDB Resources](https://docs.aws.amazon.com/documentdb/latest/developerguide/tagging.html) - describes how to use tags to add metadata to DocumentDB resources 238 | - [Amazon DocumentDB FAQs](https://aws.amazon.com/documentdb/faqs/) - DocumentDB frequently asked questions 239 | - [Troubleshooting Amazon DocumentDB](https://docs.aws.amazon.com/documentdb/latest/developerguide/troubleshooting.html) - provides information about how to troubleshoot problems that you might encounter when using Amazon DocumentDB 240 | 241 | 242 | 243 | > [!TIP] 244 | > #### Use Terraform Reference Architectures for AWS 245 | > 246 | > Use Cloud Posse's ready-to-go [terraform architecture blueprints](https://cloudposse.com/reference-architecture/) for AWS to get up and running quickly. 247 | > 248 | > ✅ We build it together with your team.
249 | > ✅ Your team owns everything.
250 | > ✅ 100% Open Source and backed by fanatical support.
251 | > 252 | > Request Quote 253 | >
📚 Learn More 254 | > 255 | >
256 | > 257 | > Cloud Posse is the leading [**DevOps Accelerator**](https://cpco.io/commercial-support?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-documentdb-cluster&utm_content=commercial_support) for funded startups and enterprises. 258 | > 259 | > *Your team can operate like a pro today.* 260 | > 261 | > Ensure that your team succeeds by using Cloud Posse's proven process and turnkey blueprints. Plus, we stick around until you succeed. 262 | > #### Day-0: Your Foundation for Success 263 | > - **Reference Architecture.** You'll get everything you need from the ground up built using 100% infrastructure as code. 264 | > - **Deployment Strategy.** Adopt a proven deployment strategy with GitHub Actions, enabling automated, repeatable, and reliable software releases. 265 | > - **Site Reliability Engineering.** Gain total visibility into your applications and services with Datadog, ensuring high availability and performance. 266 | > - **Security Baseline.** Establish a secure environment from the start, with built-in governance, accountability, and comprehensive audit logs, safeguarding your operations. 267 | > - **GitOps.** Empower your team to manage infrastructure changes confidently and efficiently through Pull Requests, leveraging the full power of GitHub Actions. 268 | > 269 | > Request Quote 270 | > 271 | > #### Day-2: Your Operational Mastery 272 | > - **Training.** Equip your team with the knowledge and skills to confidently manage the infrastructure, ensuring long-term success and self-sufficiency. 273 | > - **Support.** Benefit from a seamless communication over Slack with our experts, ensuring you have the support you need, whenever you need it. 274 | > - **Troubleshooting.** Access expert assistance to quickly resolve any operational challenges, minimizing downtime and maintaining business continuity. 275 | > - **Code Reviews.** Enhance your team’s code quality with our expert feedback, fostering continuous improvement and collaboration. 276 | > - **Bug Fixes.** Rely on our team to troubleshoot and resolve any issues, ensuring your systems run smoothly. 277 | > - **Migration Assistance.** Accelerate your migration process with our dedicated support, minimizing disruption and speeding up time-to-value. 278 | > - **Customer Workshops.** Engage with our team in weekly workshops, gaining insights and strategies to continuously improve and innovate. 279 | > 280 | > Request Quote 281 | > 282 |
283 | 284 | ## ✨ Contributing 285 | 286 | This project is under active development, and we encourage contributions from our community. 287 | 288 | 289 | 290 | Many thanks to our outstanding contributors: 291 | 292 | 293 | 294 | 295 | 296 | For 🐛 bug reports & feature requests, please use the [issue tracker](https://github.com/cloudposse/terraform-aws-documentdb-cluster/issues). 297 | 298 | In general, PRs are welcome. We follow the typical "fork-and-pull" Git workflow. 299 | 1. Review our [Code of Conduct](https://github.com/cloudposse/terraform-aws-documentdb-cluster/?tab=coc-ov-file#code-of-conduct) and [Contributor Guidelines](https://github.com/cloudposse/.github/blob/main/CONTRIBUTING.md). 300 | 2. **Fork** the repo on GitHub 301 | 3. **Clone** the project to your own machine 302 | 4. **Commit** changes to your own branch 303 | 5. **Push** your work back up to your fork 304 | 6. Submit a **Pull Request** so that we can review your changes 305 | 306 | **NOTE:** Be sure to merge the latest changes from "upstream" before making a pull request! 307 | 308 | 309 | ## Running Terraform Tests 310 | 311 | We use [Atmos](https://atmos.tools) to streamline how Terraform tests are run. It centralizes configuration and wraps common test workflows with easy-to-use commands. 312 | 313 | All tests are located in the [`test/`](test) folder. 314 | 315 | Under the hood, tests are powered by Terratest together with our internal [Test Helpers](https://github.com/cloudposse/test-helpers) library, providing robust infrastructure validation. 316 | 317 | Setup dependencies: 318 | - Install Atmos ([installation guide](https://atmos.tools/install/)) 319 | - Install Go [1.24+ or newer](https://go.dev/doc/install) 320 | - Install Terraform or OpenTofu 321 | 322 | To run tests: 323 | 324 | - Run all tests: 325 | ```sh 326 | atmos test run 327 | ``` 328 | - Clean up test artifacts: 329 | ```sh 330 | atmos test clean 331 | ``` 332 | - Explore additional test options: 333 | ```sh 334 | atmos test --help 335 | ``` 336 | The configuration for test commands is centrally managed. To review what's being imported, see the [`atmos.yaml`](https://raw.githubusercontent.com/cloudposse/.github/refs/heads/main/.github/atmos/terraform-module.yaml) file. 337 | 338 | Learn more about our [automated testing in our documentation](https://docs.cloudposse.com/community/contribute/automated-testing/) or implementing [custom commands](https://atmos.tools/core-concepts/custom-commands/) with atmos. 339 | 340 | ### 🌎 Slack Community 341 | 342 | Join our [Open Source Community](https://cpco.io/slack?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-documentdb-cluster&utm_content=slack) on Slack. It's **FREE** for everyone! Our "SweetOps" community is where you get to talk with others who share a similar vision for how to rollout and manage infrastructure. This is the best place to talk shop, ask questions, solicit feedback, and work together as a community to build totally *sweet* infrastructure. 343 | 344 | ### 📰 Newsletter 345 | 346 | Sign up for [our newsletter](https://cpco.io/newsletter?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-documentdb-cluster&utm_content=newsletter) and join 3,000+ DevOps engineers, CTOs, and founders who get insider access to the latest DevOps trends, so you can always stay in the know. 347 | Dropped straight into your Inbox every week — and usually a 5-minute read. 348 | 349 | ### 📆 Office Hours 350 | 351 | [Join us every Wednesday via Zoom](https://cloudposse.com/office-hours?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-documentdb-cluster&utm_content=office_hours) for your weekly dose of insider DevOps trends, AWS news and Terraform insights, all sourced from our SweetOps community, plus a _live Q&A_ that you can’t find anywhere else. 352 | It's **FREE** for everyone! 353 | ## License 354 | 355 | License 356 | 357 |
358 | Preamble to the Apache License, Version 2.0 359 |
360 |
361 | 362 | Complete license is available in the [`LICENSE`](LICENSE) file. 363 | 364 | ```text 365 | Licensed to the Apache Software Foundation (ASF) under one 366 | or more contributor license agreements. See the NOTICE file 367 | distributed with this work for additional information 368 | regarding copyright ownership. The ASF licenses this file 369 | to you under the Apache License, Version 2.0 (the 370 | "License"); you may not use this file except in compliance 371 | with the License. You may obtain a copy of the License at 372 | 373 | https://www.apache.org/licenses/LICENSE-2.0 374 | 375 | Unless required by applicable law or agreed to in writing, 376 | software distributed under the License is distributed on an 377 | "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 378 | KIND, either express or implied. See the License for the 379 | specific language governing permissions and limitations 380 | under the License. 381 | ``` 382 |
383 | 384 | ## Trademarks 385 | 386 | All other trademarks referenced herein are the property of their respective owners. 387 | 388 | 389 | --- 390 | Copyright © 2017-2025 [Cloud Posse, LLC](https://cpco.io/copyright) 391 | 392 | 393 | README footer 394 | 395 | Beacon 396 | --------------------------------------------------------------------------------