@percepta/create 3.6.2 → 4.0.0

package/templates/webapp/terraform/modules/rds/main.tf

@@ -1,227 +0,0 @@
-data "aws_region" "current" {}
-
-data "http" "rds_ca" {
-  url = "https://truststore.pki.rds.amazonaws.com/${data.aws_region.current.name}/${data.aws_region.current.name}-bundle.pem"
-}
-
-data "aws_vpc" "vpc" {
-  id = var.vpc_id
-}
-
-data "aws_subnet" "subnet" {
-  count = length(var.subnet_ids)
-  id    = var.subnet_ids[count.index]
-}
-
-# Check if existing cluster exists
-data "aws_rds_cluster" "existing" {
-  count              = var.existing_cluster_name != null ? 1 : 0
-  cluster_identifier = var.existing_cluster_name
-}
-
-resource "random_pet" "name" {
-  count  = var.create_new_cluster && var.existing_cluster_name == null ? 1 : 0
-  length = 2
-}
-
-resource "random_password" "master_password" {
-  count            = var.create_new_cluster && var.existing_cluster_name == null ? 1 : 0
-  length           = 16
-  special          = true
-  override_special = "_!%^"
-}
-
-
-locals {
-  cluster_name = var.existing_cluster_name != null ? var.existing_cluster_name : (var.create_new_cluster ? "${var.name}-${random_pet.name[0].id}" : null)
-
-  # Use existing cluster details if available, otherwise use new cluster details
-  cluster_endpoint = var.existing_cluster_name != null ? data.aws_rds_cluster.existing[0].endpoint : (var.create_new_cluster ? aws_rds_cluster.rds[0].endpoint : null)
-  cluster_port     = var.existing_cluster_name != null ? data.aws_rds_cluster.existing[0].port : (var.create_new_cluster ? aws_rds_cluster.rds[0].port : null)
-  master_username  = var.existing_cluster_name != null ? data.aws_rds_cluster.existing[0].master_username : (var.create_new_cluster ? aws_rds_cluster.rds[0].master_username : null)
-  master_password  = var.existing_cluster_name != null ? null : (var.create_new_cluster ? random_password.master_password[0].result : null)
-}
-
-# Security group for new RDS cluster
-resource "aws_security_group" "security_group" {
-  count       = var.create_new_cluster && var.existing_cluster_name == null ? 1 : 0
-  name        = "rds-__APP_NAME__-${random_pet.name[0].id}"
-  description = "Security group for __APP_NAME_UPPER__ RDS ${random_pet.name[0].id}"
-  vpc_id      = data.aws_vpc.vpc.id
-
-  ingress {
-    description = "Allow Postgres from VPC"
-    from_port   = var.port
-    to_port     = var.port
-    protocol    = "tcp"
-    cidr_blocks = [data.aws_vpc.vpc.cidr_block]
-  }
-
-  egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-}
-
-# Subnet group for new RDS cluster
-resource "aws_db_subnet_group" "subnet_group" {
-  count       = var.create_new_cluster && var.existing_cluster_name == null ? 1 : 0
-  name        = "rds-__APP_NAME__-${random_pet.name[0].id}"
-  description = "Subnet group for __APP_NAME_UPPER__ RDS ${random_pet.name[0].id}"
-  subnet_ids  = var.subnet_ids
-}
-
-# New RDS cluster
-resource "aws_rds_cluster" "rds" {
-  count                   = var.create_new_cluster && var.existing_cluster_name == null ? 1 : 0
-  cluster_identifier      = local.cluster_name
-  engine                  = "aurora-postgresql"
-  engine_mode             = "provisioned"
-  engine_version          = var.engine_version
-  vpc_security_group_ids  = [aws_security_group.security_group[0].id]
-  db_subnet_group_name    = aws_db_subnet_group.subnet_group[0].name
-  availability_zones      = slice(data.aws_subnet.subnet[*].availability_zone, 0, min(3, length(data.aws_subnet.subnet)))
-  database_name           = "__DB_NAME__"
-  port                    = var.port
-  master_username         = "__APP_NAME_SNAKE___admin"
-  master_password         = random_password.master_password[0].result
-  storage_encrypted       = true
-  backup_retention_period = 5
-  preferred_backup_window = "07:00-09:00"
-
-  skip_final_snapshot  = true
-  enable_http_endpoint = true
-
-  serverlessv2_scaling_configuration {
-    max_capacity             = 1.0
-    min_capacity             = 0.0
-    seconds_until_auto_pause = 3600
-  }
-}
-
-# RDS cluster instance for new cluster
-resource "aws_rds_cluster_instance" "instance" {
-  count               = var.create_new_cluster && var.existing_cluster_name == null ? 1 : 0
-  identifier          = "${local.cluster_name}-instance-${count.index}"
-  cluster_identifier  = aws_rds_cluster.rds[0].id
-  instance_class      = var.instance_class
-  engine              = aws_rds_cluster.rds[0].engine
-  engine_version      = aws_rds_cluster.rds[0].engine_version
-  publicly_accessible = false
-}
-
-# Store master password in AWS Secrets Manager for new cluster
-resource "aws_secretsmanager_secret" "master_password" {
-  count       = var.create_new_cluster && var.existing_cluster_name == null ? 1 : 0
-  name_prefix = "rds-__APP_NAME__-master-password-${random_pet.name[0].id}-"
-}
-
-resource "aws_secretsmanager_secret_version" "master_password" {
-  count         = var.create_new_cluster && var.existing_cluster_name == null ? 1 : 0
-  secret_id     = aws_secretsmanager_secret.master_password[0].id
-  secret_string = random_password.master_password[0].result
-}
-
-################################################################################
-# EDW Readonly User Resources
-################################################################################
-
-# Generate secure password for readonly user
-resource "random_password" "readonly_user_password" {
-  length  = 32
-  special = true
-  # Use PostgreSQL-safe special characters
-  override_special = "!#$%&*()-_=+[]{}<>:?"
-}
-
-# Store readonly user credentials in Secrets Manager
-resource "aws_secretsmanager_secret" "readonly_user_credentials" {
-  name_prefix = "rds-__APP_NAME__-readonly-${var.name}-${var.environment}-"
-  description = "Readonly database credentials for EDW access to __APP_NAME_UPPER__ database"
-
-  tags = {
-    Name        = "__APP_NAME__-readonly-credentials"
-    Environment = var.environment
-    Purpose     = "EDW"
-  }
-}
-
-resource "aws_secretsmanager_secret_version" "readonly_user_credentials" {
-  secret_id = aws_secretsmanager_secret.readonly_user_credentials.id
-  secret_string = jsonencode({
-    username = "__APP_NAME_SNAKE___readonly"
-    password = random_password.readonly_user_password.result
-    host     = local.cluster_endpoint
-    port     = local.cluster_port
-    database = "__DB_NAME__"
-    engine   = "postgres"
-  })
-}
-
-# Cross-account IAM role for EDW to assume
-resource "aws_iam_role" "edw_secret_reader_role" {
-  count = length(var.edw_allowed_principals) > 0 ? 1 : 0
-  name  = "__APP_NAME_UPPER__-EDW-SecretReader-${var.name}-${var.environment}"
-
-  assume_role_policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect = "Allow"
-        Principal = {
-          AWS = var.edw_allowed_principals
-        }
-        Action = "sts:AssumeRole"
-      }
-    ]
-  })
-
-  tags = {
-    Name        = "__APP_NAME__-edw-secret-reader"
-    Environment = var.environment
-    Purpose     = "EDW"
-  }
-}
-
-# IAM policy to allow reading the readonly credentials secret
-resource "aws_iam_policy" "edw_secret_reader_policy" {
-  count       = length(var.edw_allowed_principals) > 0 ? 1 : 0
-  name        = "__APP_NAME_UPPER__-EDW-SecretReader-Policy-${var.name}-${var.environment}"
-  description = "Allows EDW to read __APP_NAME_UPPER__ readonly database credentials from Secrets Manager"
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect = "Allow"
-        Action = [
-          "secretsmanager:GetSecretValue",
-          "secretsmanager:DescribeSecret"
-        ]
-        Resource = aws_secretsmanager_secret.readonly_user_credentials.arn
-      }
-    ]
-  })
-}
-
-resource "aws_iam_role_policy_attachment" "edw_secret_reader_attach" {
-  count      = length(var.edw_allowed_principals) > 0 ? 1 : 0
-  role       = aws_iam_role.edw_secret_reader_role[0].name
-  policy_arn = aws_iam_policy.edw_secret_reader_policy[0].arn
-}
-
-# Add ingress rule to security group for EDW VPC CIDR blocks
-resource "aws_security_group_rule" "edw_ingress" {
-  count             = var.create_new_cluster && var.existing_cluster_name == null && length(var.edw_vpc_cidr_blocks) > 0 ? 1 : 0
-  type              = "ingress"
-  description       = "Allow Postgres from EDW VPC via VPC peering"
-  from_port         = var.port
-  to_port           = var.port
-  protocol          = "tcp"
-  cidr_blocks       = var.edw_vpc_cidr_blocks
-  security_group_id = aws_security_group.security_group[0].id
-}
-
-

package/templates/webapp/terraform/modules/rds/outputs.tf

@@ -1,73 +0,0 @@
-output "host" {
-  description = "RDS cluster endpoint"
-  value       = local.cluster_endpoint
-}
-
-output "port" {
-  description = "RDS cluster port"
-  value       = local.cluster_port
-}
-
-output "database_name" {
-  description = "Database name"
-  value       = "__DB_NAME__"
-}
-
-output "username" {
-  description = "Database username (master user)"
-  value       = local.master_username
-}
-
-output "password" {
-  description = "Database password (master user)"
-  value       = local.master_password
-  sensitive   = true
-}
-
-output "ssl_cert" {
-  description = "RDS CA certificate"
-  value       = data.http.rds_ca.response_body
-  sensitive   = true
-}
-
-output "connection_url" {
-  description = "PostgreSQL connection URL"
-  value       = "postgresql://${local.master_username}:${local.master_password}@${local.cluster_endpoint}:${local.cluster_port}/__DB_NAME__"
-  sensitive   = true
-}
-
-output "cluster_name" {
-  description = "RDS cluster name"
-  value       = local.cluster_name
-}
-
-output "master_username" {
-  description = "RDS master username (for new clusters only)"
-  value       = local.master_username
-}
-
-output "master_password" {
-  description = "RDS master password (for new clusters only)"
-  value       = local.master_password
-  sensitive   = true
-}
-
-output "readonly_username" {
-  description = "Readonly database username for EDW access"
-  value       = "__APP_NAME_SNAKE___readonly"
-}
-
-output "readonly_user_secret_arn" {
-  description = "ARN of the Secrets Manager secret containing readonly user credentials"
-  value       = aws_secretsmanager_secret.readonly_user_credentials.arn
-}
-
-output "readonly_user_secret_name" {
-  description = "Name of the Secrets Manager secret containing readonly user credentials"
-  value       = aws_secretsmanager_secret.readonly_user_credentials.name
-}
-
-output "readonly_user_secret_reader_role_arn" {
-  description = "ARN of the IAM role that EDW can assume to read the readonly credentials secret"
-  value       = length(var.edw_allowed_principals) > 0 ? aws_iam_role.edw_secret_reader_role[0].arn : null
-}

package/templates/webapp/terraform/modules/rds/variables.tf

@@ -1,61 +0,0 @@
-variable "name" {
-  description = "Base name for resources"
-  type        = string
-}
-
-variable "environment" {
-  description = "Environment name (e.g. dev, staging, prod)"
-  type        = string
-}
-
-variable "existing_cluster_name" {
-  description = "Name of existing RDS cluster to use (optional)"
-  type        = string
-  default     = null
-}
-
-variable "create_new_cluster" {
-  description = "Whether to create a new RDS cluster if existing_cluster_name is not provided"
-  type        = bool
-  default     = true
-}
-
-variable "vpc_id" {
-  description = "VPC ID where resources will be deployed"
-  type        = string
-}
-
-variable "subnet_ids" {
-  description = "List of subnet IDs for RDS"
-  type        = list(string)
-}
-
-variable "engine_version" {
-  description = "PostgreSQL engine version"
-  type        = string
-  default     = "16.8"
-}
-
-variable "port" {
-  description = "Port for RDS"
-  type        = number
-  default     = 5432
-}
-
-variable "instance_class" {
-  description = "RDS instance class"
-  type        = string
-  default     = "db.serverless"
-}
-
-variable "edw_allowed_principals" {
-  description = "List of IAM principal ARNs allowed to assume the EDW secret reader role"
-  type        = list(string)
-  default     = []
-}
-
-variable "edw_vpc_cidr_blocks" {
-  description = "List of CIDR blocks from EDW VPC to allow database access via VPC peering"
-  type        = list(string)
-  default     = []
-}

package/templates/webapp/terraform/modules/s3-logging/main.tf

@@ -1,148 +0,0 @@
-data "aws_caller_identity" "current" {}
-
-resource "random_string" "suffix" {
-  length  = 8
-  special = false
-  upper   = false
-}
-
-################################################################################
-# S3 Bucket for Access Logs
-################################################################################
-
-resource "aws_s3_bucket" "logs" {
-  bucket = "${var.name}-logs-${random_string.suffix.result}"
-}
-
-resource "aws_s3_bucket_public_access_block" "logs" {
-  bucket                  = aws_s3_bucket.logs.id
-  block_public_acls       = true
-  block_public_policy     = true
-  ignore_public_acls      = true
-  restrict_public_buckets = true
-}
-
-resource "aws_s3_bucket_ownership_controls" "logs" {
-  bucket = aws_s3_bucket.logs.id
-  rule {
-    object_ownership = "BucketOwnerPreferred"
-  }
-}
-
-resource "aws_s3_bucket_versioning" "logs" {
-  bucket = aws_s3_bucket.logs.id
-  versioning_configuration {
-    status = "Enabled"
-  }
-}
-
-resource "aws_s3_bucket_acl" "logs" {
-  depends_on = [aws_s3_bucket_ownership_controls.logs]
-  bucket     = aws_s3_bucket.logs.id
-  acl        = "private"
-}
-
-resource "aws_s3_bucket_server_side_encryption_configuration" "logs" {
-  bucket = aws_s3_bucket.logs.id
-
-  rule {
-    apply_server_side_encryption_by_default {
-      sse_algorithm = "AES256"
-    }
-    bucket_key_enabled = true
-  }
-}
-
-resource "aws_s3_bucket_lifecycle_configuration" "logs" {
-  count  = var.s3_expiration_days != null ? 1 : 0
-  bucket = aws_s3_bucket.logs.bucket
-
-  rule {
-    id     = "expire-objects"
-    status = "Enabled"
-    filter {
-      prefix = ""
-    }
-    expiration {
-      days = var.s3_expiration_days
-    }
-  }
-}
-
-# Bucket policy to allow S3 and CloudTrail services to write logs
-resource "aws_s3_bucket_policy" "logs" {
-  bucket = aws_s3_bucket.logs.bucket
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Sid    = "AWSCloudTrailAclCheck"
-        Effect = "Allow"
-        Principal = {
-          Service = "cloudtrail.amazonaws.com"
-        }
-        Action   = "s3:GetBucketAcl"
-        Resource = aws_s3_bucket.logs.arn
-        Condition = {
-          StringEquals = {
-            "aws:SourceAccount" = data.aws_caller_identity.current.account_id
-          }
-        }
-      },
-      {
-        Sid    = "AWSCloudTrailWrite"
-        Effect = "Allow"
-        Principal = {
-          Service = "cloudtrail.amazonaws.com"
-        }
-        Action   = "s3:PutObject"
-        Resource = "${aws_s3_bucket.logs.arn}/cloudtrail/*"
-        Condition = {
-          StringEquals = {
-            "s3:x-amz-acl"      = "bucket-owner-full-control"
-            "aws:SourceAccount" = data.aws_caller_identity.current.account_id
-          }
-        }
-      },
-      {
-        Sid    = "AllowS3LogDeliveryAcl"
-        Effect = "Allow"
-        Principal = {
-          Service = "s3.amazonaws.com"
-        }
-        Action = [
-          "s3:GetBucketAcl",
-          "s3:GetBucketLocation"
-        ]
-        Resource = aws_s3_bucket.logs.arn
-      },
-      {
-        Sid    = "AllowS3LogDeliveryPut"
-        Effect = "Allow"
-        Principal = {
-          Service = "s3.amazonaws.com"
-        }
-        Action   = "s3:PutObject"
-        Resource = "${aws_s3_bucket.logs.arn}/*"
-        Condition = {
-          StringEquals = {
-            "s3:x-amz-acl" = "bucket-owner-full-control"
-          }
-        }
-      },
-      {
-        Sid       = "DenyUnEncryptedObjectUploads"
-        Effect    = "Deny"
-        Principal = "*"
-        Action    = "s3:*"
-        Resource  = "${aws_s3_bucket.logs.arn}/*"
-        Condition = {
-          Bool = {
-            "aws:SecureTransport" = "false"
-          }
-        }
-      }
-    ]
-  })
-}
-

package/templates/webapp/terraform/modules/s3-logging/outputs.tf

@@ -1,10 +0,0 @@
-output "s3_bucket_name" {
-  description = "Name of the S3 logging bucket"
-  value       = aws_s3_bucket.logs.bucket
-}
-
-output "s3_bucket_arn" {
-  description = "ARN of the S3 logging bucket"
-  value       = aws_s3_bucket.logs.arn
-}
-

package/templates/webapp/terraform/modules/s3-logging/variables.tf

@@ -1,16 +0,0 @@
-variable "name" {
-  description = "Base name for resources"
-  type        = string
-}
-
-variable "environment" {
-  description = "Environment name (e.g. dev, staging, prod)"
-  type        = string
-}
-
-variable "s3_expiration_days" {
-  description = "Number of days after which S3 objects expire (null to disable expiration)"
-  type        = number
-  default     = null
-}
-

package/templates/webapp/terraform/modules/secrets/main.tf

@@ -1,39 +0,0 @@
-data "aws_region" "current" {}
-
-################################################################################
-# Database Credentials Secret
-################################################################################
-
-resource "kubernetes_secret" "database_credentials" {
-  metadata {
-    name      = "__APP_NAME__-database-credentials"
-    namespace = var.namespace
-  }
-  type = "Opaque"
-  data = {
-    host         = var.db_host
-    port         = tostring(var.db_port)
-    database     = var.db_name
-    username     = var.db_username
-    password     = var.db_password
-    ssl_cert     = var.db_ssl_cert
-    database_url = var.db_url
-  }
-}
-
-# PostgreSQL Secret (Langfuse-style structure)
-resource "kubernetes_secret" "postgresql" {
-  metadata {
-    name      = "__APP_NAME__-postgresql"
-    namespace = var.namespace
-  }
-  type = "Opaque"
-  data = {
-    postgres-password = var.db_password
-    database_url      = "postgresql://${var.db_username}:${var.db_password}@${var.db_host}:${var.db_port}/${var.db_name}"
-    database_name     = var.db_name
-    host              = var.db_host
-    port              = tostring(var.db_port)
-    username          = var.db_username
-  }
-}

package/templates/webapp/terraform/modules/secrets/outputs.tf

@@ -1,9 +0,0 @@
-output "database_secret_name" {
-  description = "Name of the Kubernetes secret containing database credentials"
-  value       = kubernetes_secret.database_credentials.metadata[0].name
-}
-
-output "postgresql_secret_name" {
-  description = "Name of the Kubernetes secret containing PostgreSQL credentials (Langfuse-style)"
-  value       = kubernetes_secret.postgresql.metadata[0].name
-}

package/templates/webapp/terraform/modules/secrets/variables.tf

@@ -1,51 +0,0 @@
-variable "namespace" {
-  description = "Kubernetes namespace for secrets"
-  type        = string
-}
-
-variable "cluster_name" {
-  description = "EKS cluster name"
-  type        = string
-}
-
-################################################################################
-# Database Variables
-################################################################################
-
-variable "db_host" {
-  description = "Database host"
-  type        = string
-}
-
-variable "db_port" {
-  description = "Database port"
-  type        = number
-}
-
-variable "db_name" {
-  description = "Database name"
-  type        = string
-}
-
-variable "db_username" {
-  description = "Database username"
-  type        = string
-}
-
-variable "db_password" {
-  description = "Database password"
-  type        = string
-  sensitive   = true
-}
-
-variable "db_ssl_cert" {
-  description = "Database SSL certificate"
-  type        = string
-  sensitive   = true
-}
-
-variable "db_url" {
-  description = "Database connection URL"
-  type        = string
-  sensitive   = true
-}