skilldrop-cli 1.1.3 → 1.3.0

package/packs/infra-as-code/loops/provision/evals/files/provision-rds-no-plan-yet/network.md

@@ -0,0 +1,36 @@
+# Timesheets app: network details and conventions
+
+## Accounts and region
+- Staging account: 210987654321
+- Prod account: 210987654398
+- Region: eu-west-2 for both
+
+## Network (staging; prod mirrors it, IDs to follow when prod is built)
+- VPC: vpc-0c3f9a7d21e4b5a60 (CIDR 10.60.0.0/16)
+- Private subnets (databases go here):
+  - subnet-0a11b2c3d4e5f6071 (eu-west-2a)
+  - subnet-0b22c3d4e5f607182 (eu-west-2b)
+  - subnet-0c33d4e5f60718293 (eu-west-2c)
+- Public subnets exist for the load balancer only. Nothing data-related goes in them.
+- The timesheets app runs on ECS. Its service security group is sg-04d5e6f7a8b9c0d12 (timesheets-app). That is the only thing that should reach the database.
+
+## Database needs
+- PostgreSQL 16.
+- Instance class: db.t4g.medium in staging, db.m7g.large in prod.
+- Storage: 50 GB gp3 to start, allowed to grow to 200 GB.
+- Backups kept 14 days. Maintenance window Sunday 02:00-03:00 UTC; backup window 00:30-01:30 UTC.
+- Multi-AZ in prod only.
+- Deletion protection on in both environments.
+- Master password managed by RDS in Secrets Manager. No passwords in tfvars or state.
+- Encrypt with the existing platform key, alias/platform-rds. Do not create a new key.
+
+## Tags (required on every resource)
+- Owner = team-timesheets
+- CostCentre = CC-4410
+- Environment = staging | prod
+- Service = timesheets
+- ManagedBy = terraform
+
+## Repo layout
+- Modules live in modules/<name>/. Environments call them from envs/staging/ and envs/prod/.
+- Provider and backend config live in envs/<env>/providers.tf. The staging lock file is attached as .terraform.lock.hcl.fixture.

package/packs/infra-as-code/loops/provision/evals/files/provision-replica-plan-replaces-primary/main.tf

@@ -0,0 +1,74 @@
+# modules/orders-db/main.tf
+
+locals {
+  name = "orders-${var.environment}"
+  tags = merge(var.tags, {
+    Service   = "orders"
+    ManagedBy = "terraform"
+  })
+}
+
+resource "aws_db_subnet_group" "orders" {
+  name       = "${local.name}-db"
+  subnet_ids = var.subnet_ids
+  tags       = local.tags
+}
+
+resource "aws_security_group" "db" {
+  name        = "${local.name}-db"
+  description = "Orders database"
+  vpc_id      = var.vpc_id
+  tags        = local.tags
+}
+
+resource "aws_security_group_rule" "db_ingress" {
+  type              = "ingress"
+  security_group_id = aws_security_group.db.id
+  from_port         = 5432
+  to_port           = 5432
+  protocol          = "tcp"
+  cidr_blocks       = ["0.0.0.0/0"]
+  description       = "Postgres"
+}
+
+resource "aws_db_instance" "primary" {
+  identifier             = "${local.name}-primary"
+  engine                 = "postgres"
+  engine_version         = "16.4"
+  instance_class         = var.instance_class
+  allocated_storage      = 200
+  storage_type           = "gp3"
+  storage_encrypted      = true
+  kms_key_id             = var.kms_key_arn
+  db_subnet_group_name   = aws_db_subnet_group.orders.name
+  vpc_security_group_ids = [aws_security_group.db.id]
+  publicly_accessible    = false
+
+  username                    = "orders_admin"
+  manage_master_user_password = true
+
+  backup_retention_period = 14
+  multi_az                = true
+  deletion_protection     = false
+  skip_final_snapshot     = true
+
+  tags = local.tags
+}
+
+resource "aws_db_instance" "replica" {
+  identifier             = "${local.name}-replica"
+  replicate_source_db    = aws_db_instance.primary.identifier
+  instance_class         = var.replica_instance_class
+  storage_encrypted      = true
+  kms_key_id             = var.kms_key_arn
+  vpc_security_group_ids = [aws_security_group.db.id]
+  publicly_accessible    = false
+  skip_final_snapshot    = true
+
+  tags = merge(local.tags, { Role = "reporting-replica" })
+}
+
+resource "aws_s3_bucket" "exports" {
+  bucket = "${local.name}-exports"
+  tags   = local.tags
+}