@swovohq/fuel 0.2.2-alpha.9 → 0.2.2-alpha.91

package/dist/infra-templates/modules/azure-sql-database/variables.tf

@@ -0,0 +1,78 @@
+variable "server_name" {
+  description = "Name of the Azure SQL Server. Must be globally unique."
+  type        = string
+}
+
+variable "database_name" {
+  description = "Name of the Azure SQL Database"
+  type        = string
+}
+
+variable "resource_group_name" {
+  description = "Name of the resource group where the SQL server will be created"
+  type        = string
+}
+
+variable "location" {
+  description = "Azure region where the SQL server will be created"
+  type        = string
+}
+
+variable "admin_username" {
+  description = "Administrator login for the SQL Server"
+  type        = string
+  default     = "sqladmin"
+}
+
+variable "admin_password" {
+  description = "Administrator password for the SQL Server. Leave empty to auto-generate."
+  type        = string
+  default     = ""
+  sensitive   = true
+}
+
+variable "sku_name" {
+  description = "SKU name for the database (General Purpose Serverless, Standard-series Gen5)"
+  type        = string
+  default     = "GP_S_Gen5_4"
+}
+
+variable "min_capacity" {
+  description = "Minimum vCores the database will always have allocated, if not paused"
+  type        = number
+  default     = 0.5
+}
+
+variable "auto_pause_delay_in_minutes" {
+  description = "Time in minutes after which the database is automatically paused. Set to -1 to disable auto-pause — required for long_term_retention_policy to take effect (Azure disallows LTR on a serverless database with auto-pause enabled)."
+  type        = number
+  default     = 60
+}
+
+variable "storage_account_type" {
+  description = "Storage account type used to store backups. Valid values are Geo, GeoZone, Local, Zone (not to be confused with Storage Account LRS/GRS naming; 'Local' is the SQL backup equivalent of LRS)."
+  type        = string
+  default     = "Local"
+}
+
+variable "pitr_retention_days" {
+  description = "Point-in-time restore (short term retention) in days"
+  type        = number
+  default     = 20
+}
+
+variable "ltr_weekly_retention" {
+  description = "Long term retention weekly retention, in ISO 8601 format"
+  type        = string
+  default     = "P21W"
+}
+
+variable "private_endpoint_subnet_id" {
+  description = "Subnet for the Private Link endpoint (non-delegated, network policies disabled)"
+  type        = string
+}
+
+variable "private_dns_zone_id" {
+  description = "Private DNS zone (privatelink.database.windows.net) linked to the same VNet as private_endpoint_subnet_id"
+  type        = string
+}

package/dist/infra-templates/modules/azure-storage-account/main.tf

@@ -0,0 +1,13 @@
+# NOTE: the azurerm provider does not support `access_tier` on BlockBlobStorage
+# accounts (it's only valid for StorageV2/BlobStorage). We pass null in that
+# case so the attribute is omitted instead of failing a plan/apply.
+resource "azurerm_storage_account" "this" {
+  name                      = var.name
+  resource_group_name       = var.resource_group_name
+  location                  = var.location
+  account_kind              = var.account_kind
+  account_tier              = var.account_tier
+  account_replication_type  = var.account_replication_type
+  access_tier               = var.account_kind == "BlockBlobStorage" ? null : var.access_tier
+  min_tls_version           = "TLS1_2"
+}

package/dist/infra-templates/modules/azure-storage-account/outputs.tf

@@ -0,0 +1,16 @@
+output "id" {
+  value = azurerm_storage_account.this.id
+}
+
+output "name" {
+  value = azurerm_storage_account.this.name
+}
+
+output "primary_blob_endpoint" {
+  value = azurerm_storage_account.this.primary_blob_endpoint
+}
+
+output "primary_access_key" {
+  value     = azurerm_storage_account.this.primary_access_key
+  sensitive = true
+}

package/dist/infra-templates/modules/azure-storage-account/variables.tf

@@ -0,0 +1,38 @@
+variable "name" {
+  type        = string
+  description = "Storage account name (3-24 chars, lowercase alphanumeric). Not validated here; caller is responsible for compliance."
+}
+
+variable "resource_group_name" {
+  type        = string
+  description = "Resource group where the storage account is created"
+}
+
+variable "location" {
+  type        = string
+  description = "Azure region"
+}
+
+variable "account_kind" {
+  type        = string
+  description = "Storage account kind"
+  default     = "BlockBlobStorage"
+}
+
+variable "account_tier" {
+  type        = string
+  description = "Storage account tier. BlockBlobStorage kind only exists in the Premium tier."
+  default     = "Premium"
+}
+
+variable "account_replication_type" {
+  type        = string
+  description = "Storage account replication type"
+  default     = "LRS"
+}
+
+variable "access_tier" {
+  type        = string
+  description = "Storage account access tier (ignored for BlockBlobStorage, which does not support this attribute)"
+  default     = "Hot"
+}

package/dist/infra-templates/modules/cloud-watch/event-bridge.tf

@@ -0,0 +1,15 @@
+resource "aws_cloudwatch_event_rule" "ecs_deploy_events" {
+  count = var.ecs ? 1 : 0
+
+  name          = "${var.project_name}-ecs-deploy-events"
+  description   = "This rule is used to send notifications to Slack for success or failure in the deployment process"
+  event_pattern = jsonencode({
+    "source" : ["aws.ecs"],
+    "detail-type" : ["ECS Deployment State Change"],
+    "region" : [var.aws_region],
+    "detail" : {
+      "clusterArn": [var.ecs_cluster_id],
+      "eventName" : ["SERVICE_DEPLOYMENT_FAILED", "SERVICE_DEPLOYMENT_COMPLETED"]
+    }
+  })
+}

package/dist/infra-templates/modules/cloud-watch/lambda.tf

@@ -0,0 +1,84 @@
+resource "aws_iam_role" "lambda_execution_role" {
+  name = "lambda_execution_role_${var.project_name}"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17",
+    Statement = [
+      {
+        Action = "sts:AssumeRole",
+        Principal = {
+          Service = "lambda.amazonaws.com",
+        },
+        Effect = "Allow",
+      },
+    ],
+  })
+}
+
+resource "aws_lambda_function" "sns_to_slack" {
+  function_name = "snsToSlack-${var.project_name}"
+  handler       = "index.lambda_handler"
+  runtime       = "python3.9"
+  role          = aws_iam_role.lambda_execution_role.arn
+
+  filename         = "${path.module}/lambda_function.zip"
+  source_code_hash = filebase64sha256("${path.module}/lambda_function.zip")
+
+  environment {
+    variables = {
+      SLACK_WEBHOOK_URL = var.slack_webhook_url
+    }
+  }
+}
+
+resource "aws_lambda_permission" "sns" {
+  statement_id  = "AllowExecutionFromSNS"
+  action        = "lambda:InvokeFunction"
+  function_name = aws_lambda_function.sns_to_slack.arn
+  principal     = "sns.amazonaws.com"
+  source_arn    = aws_sns_topic.rds_alarm_topic.arn
+}
+
+resource "aws_sns_topic_subscription" "lambda_subscription" {
+  topic_arn = aws_sns_topic.rds_alarm_topic.arn
+  protocol  = "lambda"
+  endpoint  = aws_lambda_function.sns_to_slack.arn
+}
+
+
+resource "aws_lambda_function" "sns_deploy_to_slack" {
+  count = var.ecs ? 1 : 0
+
+  function_name = "snsDeployInfoToSlack-${var.project_name}"
+  handler       = "index.handler"
+  runtime       = "nodejs22.x"
+  role             = aws_iam_role.lambda_execution_role.arn
+
+  filename         = "${path.module}/lambda_function_deploy.zip"
+  source_code_hash = filebase64sha256("${path.module}/lambda_function_deploy.zip")
+
+  environment {
+    variables = {
+      SLACK_WEBHOOK_URL = var.slack_webhook_url
+    }
+  }
+
+}
+
+resource "aws_cloudwatch_event_target" "trigger_lambda" {
+  count = var.ecs ? 1 : 0
+
+  rule      = aws_cloudwatch_event_rule.ecs_deploy_events[0].name
+  target_id = "SendToLambda"
+  arn       = aws_lambda_function.sns_deploy_to_slack[0].arn
+}
+
+resource "aws_lambda_permission" "allow_eventbridge" {
+  count = var.ecs ? 1 : 0
+
+  statement_id  = "AllowExecutionFromEventBridge"
+  action        = "lambda:InvokeFunction"
+  function_name = aws_lambda_function.sns_deploy_to_slack[0].function_name
+  principal     = "events.amazonaws.com"
+  source_arn    = aws_cloudwatch_event_rule.ecs_deploy_events[0].arn
+}

package/dist/infra-templates/modules/cloud-watch/main.tf

@@ -0,0 +1,156 @@
+
+resource "aws_cloudwatch_metric_alarm" "high_cpu_utilization" {
+  alarm_name          = "high-cpu-utilization-${var.project_name}"
+  comparison_operator = "GreaterThanThreshold"
+  evaluation_periods  = "2"
+  metric_name         = "CPUUtilization"
+  namespace           = "AWS/RDS"
+  period              = "120"
+  statistic           = "Average"
+  threshold           = "70"
+  alarm_description   = "This metric monitors RDS CPU utilization"
+  actions_enabled     = true
+  alarm_actions       = [aws_sns_topic.rds_alarm_topic.arn]
+  dimensions = {
+    DBInstanceIdentifier = "${var.project_name}"
+  }
+}
+
+resource "aws_cloudwatch_metric_alarm" "low_free_storage_space" {
+  alarm_name          = "low-free-storage-space-${var.project_name}"
+  comparison_operator = "LessThanThreshold"
+  evaluation_periods  = "1"
+  metric_name         = "FreeStorageSpace"
+  namespace           = "AWS/RDS"
+  period              = "300"
+  statistic           = "Average"
+  threshold           = "10000000000"
+  alarm_description   = "This metric monitors RDS free storage space"
+  actions_enabled     = true
+  alarm_actions       = [aws_sns_topic.rds_alarm_topic.arn]
+  dimensions = {
+    DBInstanceIdentifier = "${var.project_name}"
+  }
+}
+
+resource "aws_cloudwatch_metric_alarm" "low_freeable_memory" {
+  alarm_name          = "low-freeable-memory-${var.project_name}"
+  comparison_operator = "LessThanThreshold"
+  evaluation_periods  = "1"
+  metric_name         = "FreeableMemory"
+  namespace           = "AWS/RDS"
+  period              = "300"
+  statistic           = "Average"
+  threshold           = 209715200
+  alarm_description   = "This metric monitors RDS freeable memory"
+  actions_enabled     = true
+  alarm_actions       = [aws_sns_topic.rds_alarm_topic.arn]
+  dimensions = {
+    DBInstanceIdentifier = "${var.project_name}"
+  }
+}
+
+resource "aws_cloudwatch_metric_alarm" "high_database_connections" {
+  alarm_name          = "high-database-connections-${var.project_name}"
+  comparison_operator = "GreaterThanThreshold"
+  evaluation_periods  = "1"
+  metric_name         = "DatabaseConnections"
+  namespace           = "AWS/RDS"
+  period              = "300"
+  statistic           = "Average"
+  threshold           = "30"
+  alarm_description   = "This metric monitors RDS database connections"
+  actions_enabled     = true
+  alarm_actions       = [aws_sns_topic.rds_alarm_topic.arn]
+  dimensions = {
+    DBInstanceIdentifier = "${var.project_name}"
+  }
+}
+
+resource "aws_cloudwatch_metric_alarm" "freespace" {
+  for_each = { for app in var.apps : app.app_name => app if app.postgres }
+  
+  actions_enabled     = true
+  alarm_name          = "FreeStorageSpace - ${each.value.app_name} - DB"
+  comparison_operator = "LessThanOrEqualToThreshold"
+  datapoints_to_alarm = 1
+
+  dimensions = {
+    DBInstanceIdentifier = each.value.app_name
+  }
+
+  evaluation_periods = 1
+  metric_name        = "FreeStorageSpace"
+  namespace          = "AWS/RDS"
+  period             = 300
+  statistic          = "Average"
+  threshold          = 30 * 0.1 * pow(1024, 3)
+  treat_missing_data = "missing"
+}
+
+resource "aws_cloudwatch_metric_alarm" "high-cpu" {
+  for_each = { for app in var.apps : app.app_name => app if app.postgres }
+  
+  actions_enabled     = "true"
+  alarm_name          = "High CPU Usage - ${each.value.app_name} -db"
+  comparison_operator = "GreaterThanThreshold"
+  datapoints_to_alarm = "1"
+
+  dimensions = {
+    DBInstanceIdentifier = each.value.app_name
+  }
+
+  evaluation_periods = "1"
+  metric_name        = "CPUUtilization"
+  namespace          = "AWS/RDS"
+  period             = "300"
+  statistic          = "Average"
+  threshold          = "90"
+  treat_missing_data = "missing"
+}
+
+
+resource "aws_cloudwatch_metric_alarm" "freeable_memory" {
+  for_each = { for app in var.apps : app.app_name => app if app.postgres }
+  
+  actions_enabled     = true
+  alarm_description   = "500Mb available for use"
+  alarm_name          = "High Memory Usage - ${each.value.app_name} - DB"
+  comparison_operator = "LessThanOrEqualToThreshold"
+  datapoints_to_alarm = 1
+
+  dimensions = {
+    DBInstanceIdentifier = each.value.app_name
+  }
+
+  evaluation_periods = 1
+  metric_name        = "FreeableMemory"
+  namespace          = "AWS/RDS"
+  period             = 60
+  statistic          = "Maximum"
+  threshold          = 500000000
+  treat_missing_data = "missing"
+}
+
+resource "aws_cloudwatch_metric_alarm" "readiops" {
+  for_each = { for app in var.apps : app.app_name => app if app.postgres }
+
+  actions_enabled     = true
+  alarm_name          = "ReadIOPS - ${each.value.app_name} - DB"
+  comparison_operator = "GreaterThanThreshold"
+  datapoints_to_alarm = 1
+
+  dimensions = {
+    DBInstanceIdentifier = each.value.app_name
+  }
+
+  evaluation_periods = 1
+  metric_name        = "ReadIOPS"
+  namespace          = "AWS/RDS"
+  period             = 300
+  statistic          = "Maximum"
+  threshold          = 1000
+  treat_missing_data = "missing"
+}
+
+

package/dist/infra-templates/modules/cloud-watch/sns.tf

@@ -0,0 +1,3 @@
+resource "aws_sns_topic" "rds_alarm_topic" {
+  name = "rds-alarm-topic-${var.project_name}"
+}

package/dist/infra-templates/modules/cloud-watch/variables.tf

@@ -0,0 +1,38 @@
+variable "project_name" {
+  description = "Repository name will be created based on project name"
+  default     = ""
+}
+
+variable "slack_webhook_url" {
+  description = "The Slack webhook URL for sending notifications"
+  type        = string
+  default     = "https://hooks.slack.com/services/YOUR_WORKSPACE_ID/YOUR_CHANNEL_ID/YOUR_WEBHOOK_TOKEN"
+}
+
+
+variable "aws_region" {
+  description = "Aws Region"
+  type        = string
+}
+
+variable "ecs_cluster_id" {
+  description = "cluster Arn"
+  default     = ""
+}
+
+variable "ecs" {
+  description = "Whether ECS resources are deployed"
+  type        = bool
+  default     = true
+}
+
+variable "apps" {
+  description = "An array of apps from config.json"
+  type = set(object({
+    app_name     = string
+    technology = string
+    dockerfile = optional(string)
+    build_env = optional(string)
+    postgres = optional(string)
+  }))
+}

package/dist/infra-templates/modules/ecs-core/alb.tf

@@ -0,0 +1,126 @@
+########################################################################################################################
+## Application Load Balancer in public subnets with HTTP default listener that redirects traffic to HTTPS
+########################################################################################################################
+
+resource "aws_alb" "alb" {
+  name            = "${var.project_name}-ALB"
+  security_groups = [aws_security_group.alb.id, var.default_security_group_id]
+  subnets         = var.public_subnets
+
+  tags = {
+    Scenario = var.scenario
+  }
+}
+
+########################################################################################################################
+## Default HTTPS listener that blocks all traffic without valid custom origin header
+########################################################################################################################
+
+resource "aws_alb_listener" "alb_default_listener_https" {
+  load_balancer_arn         = aws_alb.alb.arn
+  port                      = "443"
+  protocol                  = "HTTPS"
+  certificate_arn   = var.ingress_ssl_arn
+
+  default_action {
+    type                    = "forward"
+    target_group_arn        = aws_alb_target_group.service_target_group.arn
+  }
+
+  tags = {
+    Scenario = var.scenario
+  }
+}
+
+resource "aws_alb_listener" "redirect" {
+  load_balancer_arn = aws_alb.alb.arn
+  port              = "80"
+  protocol          = "HTTP"
+
+  default_action {
+    type = "redirect"
+
+    redirect {
+      port        = "443"
+      protocol    = "HTTPS"
+      status_code = "HTTP_301"
+    }
+  }
+}
+
+resource "aws_alb_listener_rule" "frontend_listener" {
+  for_each = { 
+    for index, app in var.apps : app.app_name => app
+  }
+  
+  listener_arn = aws_alb_listener.alb_default_listener_https.arn
+
+  action {
+    type             = "forward"
+    target_group_arn = aws_alb_target_group.app_service_target_group[each.key].arn
+  }
+
+  condition {
+    host_header {
+      values = ["${each.value.domain}"]
+    }
+  }
+}
+
+########################################################################################################################
+## Target Group for our service
+########################################################################################################################
+
+resource "aws_alb_target_group" "service_target_group" {
+  name                 = "${var.project_name}-TargetGroup"
+  port                 = var.container_port
+  protocol             = "HTTP"
+  vpc_id               = var.vpc_id
+  deregistration_delay = 5
+  target_type          = "ip"
+
+  health_check {
+    healthy_threshold   = 2
+    unhealthy_threshold = 2
+    interval            = 60
+    matcher             = var.healthcheck_matcher
+    path                = var.healthcheck_endpoint
+    port                = "traffic-port"
+    protocol            = "HTTP"
+    timeout             = 30
+  }
+
+  tags = {
+    Scenario = var.scenario
+  }
+
+  depends_on = [aws_alb.alb]
+}
+
+resource "aws_alb_target_group" "app_service_target_group" {
+  for_each = { for app in var.apps : app.app_name => app }
+
+  name                 = each.value.app_name
+  port                 = each.value.port
+  protocol             = "HTTP"
+  vpc_id               = var.vpc_id
+  deregistration_delay = 5
+  target_type          = "ip"
+
+  health_check {
+    healthy_threshold   = 2
+    unhealthy_threshold = 2
+    interval            = 90
+    matcher             = var.healthcheck_matcher
+    path                = each.value.health_check_path
+    port                = "traffic-port"
+    protocol            = "HTTP"
+    timeout             = 60
+  }
+
+  tags = {
+    Scenario = var.scenario
+  }
+
+  depends_on = [aws_alb.alb]
+}

package/dist/infra-templates/modules/ecs-core/cloudwatch.tf

@@ -0,0 +1,48 @@
+# logs.tf
+
+# Set up CloudWatch group and log stream and retain logs for 30 days
+resource "aws_cloudwatch_log_group" "cb_log_group" {
+  name              = var.log_group_name
+  retention_in_days = 30
+}
+
+resource "aws_cloudwatch_log_stream" "cb_log_stream" {
+  name           =  var.project_name
+  log_group_name = aws_cloudwatch_log_group.cb_log_group.name
+}
+
+resource "aws_cloudwatch_metric_alarm" "targetResponseTime" {
+  actions_enabled     = true
+  alarm_name          = "TargetResponseTimeALB"
+  comparison_operator = "GreaterThanThreshold"
+  datapoints_to_alarm = 1
+
+  dimensions = {
+    DBInstanceIdentifier = aws_alb.alb.arn_suffix
+  }
+
+  evaluation_periods = 1
+  metric_name        = "TargetResponseTime"
+  namespace          = "AWS/ApplicationELB"
+  period             = 300
+  statistic          = "Maximum"
+  threshold          = 4
+}
+
+resource "aws_cloudwatch_metric_alarm" "httpCodeTarget5XXCount" {
+  actions_enabled     = true
+  alarm_name          = "HTTPCode_Target_5XX_Count"
+  comparison_operator = "GreaterThanThreshold"
+  datapoints_to_alarm = 1
+
+  dimensions = {
+    DBInstanceIdentifier = aws_alb.alb.arn_suffix
+  }
+
+  evaluation_periods = 1
+  metric_name        = "HTTPCode_Target_5XX_Count"
+  namespace          = "AWS/ApplicationELB"
+  period             = 300
+  statistic          = "Maximum"
+  threshold          = 1
+}