declapract-typescript-ehmpathy 0.49.7 → 0.49.9

package/dist/practices/persist-with-rds/best-practice/provision/aws/product/parameter-store.tf

@@ -1,63 +0,0 @@
-# ====================
-# legacy params (kept for backwards compatibility)
-# ====================
-resource "aws_ssm_parameter" "secret_database_admin_password" {
-  name  = "${local.parameter_store_namespace}.database.admin.password"
-  type  = "SecureString"
-  value = "__IGNORED__" # "ignored" since we dont want to check in secrets to version control (terraform.lifecycle.ignore_changes -> value isn't overwritten)
-  tags  = local.tags
-  count = var.environment == "prod" ? 1 : 0 # only needed in prod env, in other envs its hardcoded in config.${env}.json since it's not sensitive
-  lifecycle {
-    ignore_changes = [
-      value # we only need the real value on the first initialization, afterwards, users shouldn't have this
-    ]
-  }
-}
-resource "aws_ssm_parameter" "secret_database_service_password" {
-  name  = "${local.parameter_store_namespace}.database.service.password"
-  type  = "SecureString"
-  value = "__IGNORED__" # "ignored" since we dont want to check in secrets to version control (terraform.lifecycle.ignore_changes -> value isn't overwritten)
-  tags  = local.tags
-  count = var.environment == "prod" ? 1 : 0 # only needed in prod env, in other envs its hardcoded in config.${env}.json since it's not sensitive
-  lifecycle {
-    ignore_changes = [
-      value # we only need the real value on the first initialization, afterwards, users shouldn't have this
-    ]
-  }
-}
-
-# ====================
-# new role-based params (standard naming)
-# ====================
-# read legacy params to copy values (prod only)
-data "aws_ssm_parameter" "legacy_admin_password" {
-  name            = "${local.parameter_store_namespace}.database.admin.password"
-  count           = var.environment == "prod" ? 1 : 0
-  with_decryption = true
-}
-data "aws_ssm_parameter" "legacy_service_password" {
-  name            = "${local.parameter_store_namespace}.database.service.password"
-  count           = var.environment == "prod" ? 1 : 0
-  with_decryption = true
-}
-
-resource "aws_ssm_parameter" "secret_database_role_cicd_password" {
-  name  = "${local.parameter_store_namespace}.database.role.cicd.password"
-  type  = "SecureString"
-  value = var.environment == "prod" ? data.aws_ssm_parameter.legacy_admin_password[0].value : "__CHANG3_ME__"
-  tags  = local.tags
-  count = var.environment != "test" ? 1 : 0
-  lifecycle {
-    ignore_changes = [value]
-  }
-}
-resource "aws_ssm_parameter" "secret_database_role_crud_password" {
-  name  = "${local.parameter_store_namespace}.database.role.crud.password"
-  type  = "SecureString"
-  value = var.environment == "prod" ? data.aws_ssm_parameter.legacy_service_password[0].value : "__CHANG3_ME__"
-  tags  = local.tags
-  count = var.environment != "test" ? 1 : 0
-  lifecycle {
-    ignore_changes = [value]
-  }
-}

package/dist/practices/persist-with-rds/best-practice/provision/aws/product/parameter-store.tf.declapract.ts

@@ -1,18 +0,0 @@
-import { FileCheckType, type FileFixFunction } from 'declapract';
-
-export const check = FileCheckType.CONTAINS; // i.e., check that the contents of the file contains what's declared (default is equals)
-
-export const fix: FileFixFunction = (contents, context) => {
-  if (!contents) return { contents: context.declaredFileContents };
-  return {
-    contents: contents
-      .replace(
-        /value\s+= var\.secret_database_\w+_password/g,
-        `value = "__IGNORED__" # "ignored" since we dont want to check in secrets to version control (terraform.lifecycle.ignore_changes -> value isn't overwritten)`,
-      )
-      .replace(
-        /local\.tags\n\s+lifecycle/g,
-        `local.tags\n  count = var.environment == "prod" ? 1 : 0 # only needed in prod env, in other envs its hardcoded in config.\${env}.json since it's not sensitive\n  lifecycle`,
-      ),
-  };
-};