Skip to content

Commit 5008d7d

Browse files
nitin-yadav-sqnitin-yadav-sq
committed
Merge branch 'qa' into 'main'
Stable branch See merge request sq-ia/aws/redis!1
2 parents e9fcea8 + d08990d commit 5008d7d

File tree

13 files changed

+933
-0
lines changed

13 files changed

+933
-0
lines changed

‎.gitignore‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
2+
*.out
3+
*.lock
4+
*.tfvars
5+
*.pem
6+
*.txt
7+
8+
# Local .terraform directories
9+
**/.terraform/*
10+
.terraform*
11+
12+
# .tfstate files
13+
*.tfstate
14+
*.tfstate.*
15+
16+
# Crash log files
17+
crash.log
18+
crash.*.log
19+
20+
*.tfvars
21+
*.tfvars.json
22+
23+
# Ignore override files as they are usually used to override resources locally and so
24+
# are not checked in
25+
override.tf
26+
override.tf.json
27+
*_override.tf
28+
*_override.tf.json
29+
30+
# Ignore CLI configuration files
31+
.terraformrc
32+
terraform.rc

‎.pre-commit-config.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
repos:
2+
- repo: https://github.com/pre-commit/pre-commit-hooks
3+
rev: v4.1.0
4+
hooks:
5+
- id: trailing-whitespace
6+
args: ['--markdown-linebreak-ext=md']
7+
- id: end-of-file-fixer
8+
- id: check-merge-conflict
9+
- id: detect-private-key
10+
- id: detect-aws-credentials
11+
args: ['--allow-missing-credentials']
12+
- repo: https://github.com/antonbabenko/pre-commit-terraform
13+
rev: v1.77.0
14+
hooks:
15+
- id: terraform_fmt
16+
- id: terraform_docs
17+
args:
18+
- '--args=--lockfile=false'
19+
- --hook-config=--add-to-existing-file=true
20+
- --hook-config=--create-file-if-not-exist=true
21+
22+
- id: terraform_tflint
23+
args:
24+
- --args=--config=.tflint.hcl
25+
- id: terraform_tfsec
26+
files: ^examples/ # only scan `examples/*` which are the implementation
27+
args:
28+
- --args=--config-file=__GIT_WORKING_DIR__/tfsec.yaml
29+
- --args=--concise-output

‎.tflint.hcl‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
plugin "aws" {
2+
enabled = true
3+
version = "0.14.0"
4+
source = "github.com/terraform-linters/tflint-ruleset-aws"
5+
}
6+
7+
config {
8+
#Enables module inspection
9+
module = false
10+
force = false
11+
}
12+
13+
# Required that all AWS resources have specified tags.
14+
rule "aws_resource_missing_tags" {
15+
enabled = true
16+
tags = [
17+
"Name",
18+
"Environment",
19+
]
20+
}
21+
22+
# Disallow deprecated (0.11-style) interpolation
23+
rule "terraform_deprecated_interpolation" {
24+
enabled = true
25+
}
26+
27+
# Disallow legacy dot index syntax.
28+
rule "terraform_deprecated_index" {
29+
enabled = true
30+
}
31+
32+
# Disallow variables, data sources, and locals that are declared but never used.
33+
rule "terraform_unused_declarations" {
34+
enabled = true
35+
}
36+
37+
# Disallow // comments in favor of #.
38+
rule "terraform_comment_syntax" {
39+
enabled = false
40+
}
41+
42+
# Disallow output declarations without description.
43+
rule "terraform_documented_outputs" {
44+
enabled = true
45+
}
46+
47+
# Disallow variable declarations without description.
48+
rule "terraform_documented_variables" {
49+
enabled = true
50+
}
51+
52+
# Disallow variable declarations without type.
53+
rule "terraform_typed_variables" {
54+
enabled = true
55+
}
56+
57+
# Disallow specifying a git or mercurial repository as a module source without pinning to a version.
58+
rule "terraform_module_pinned_source" {
59+
enabled = true
60+
}
61+
62+
# Enforces naming conventions
63+
rule "terraform_naming_convention" {
64+
enabled = true
65+
66+
#Require specific naming structure
67+
variable {
68+
format = "snake_case"
69+
}
70+
71+
locals {
72+
format = "snake_case"
73+
}
74+
75+
output {
76+
format = "snake_case"
77+
}
78+
79+
#Allow any format
80+
resource {
81+
format = "none"
82+
}
83+
84+
module {
85+
format = "none"
86+
}
87+
88+
data {
89+
format = "none"
90+
}
91+
92+
}
93+
94+
# Disallow terraform declarations without require_version.
95+
rule "terraform_required_version" {
96+
enabled = true
97+
}
98+
99+
# Require that all providers have version constraints through required_providers.
100+
rule "terraform_required_providers" {
101+
enabled = true
102+
}
103+
104+
# Ensure that a module complies with the Terraform Standard Module Structure
105+
rule "terraform_standard_module_structure" {
106+
enabled = true
107+
}
108+
109+
# terraform.workspace should not be used with a "remote" backend with remote execution.
110+
rule "terraform_workspace_remote" {
111+
enabled = true
112+
}

‎README.md‎

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,160 @@
1+
## IAM permission Required to run this module
2+
- AmazonElastiCacheFullAccess
3+
- AmazonVPCFullAccess
14

5+
## IAM Permission
6+
<!-- BEGINNING OF PRE-COMMIT-PIKE DOCS HOOK -->
7+
The Policy required is:
8+
9+
```json
10+
{
11+
"Version": "2012-10-17",
12+
"Statement": [
13+
{
14+
"Sid": "VisualEditor0",
15+
"Effect": "Allow",
16+
"Action": [
17+
"ec2:AuthorizeSecurityGroupEgress",
18+
"ec2:AuthorizeSecurityGroupIngress",
19+
"ec2:CreateSecurityGroup",
20+
"ec2:CreateTags",
21+
"ec2:DeleteSecurityGroup",
22+
"ec2:DeleteTags",
23+
"ec2:DescribeAccountAttributes",
24+
"ec2:DescribeNetworkInterfaces",
25+
"ec2:DescribeSecurityGroups",
26+
"ec2:RevokeSecurityGroupEgress",
27+
"ec2:RevokeSecurityGroupIngress"
28+
],
29+
"Resource": [
30+
"*"
31+
]
32+
},
33+
{
34+
"Sid": "VisualEditor1",
35+
"Effect": "Allow",
36+
"Action": [
37+
"elasticache:AddTagsToResource",
38+
"elasticache:CreateCacheParameterGroup",
39+
"elasticache:CreateCacheSubnetGroup",
40+
"elasticache:CreateReplicationGroup",
41+
"elasticache:DeleteCacheParameterGroup",
42+
"elasticache:DeleteCacheSubnetGroup",
43+
"elasticache:DeleteReplicationGroup",
44+
"elasticache:DescribeCacheParameterGroups",
45+
"elasticache:DescribeCacheParameters",
46+
"elasticache:DescribeCacheSubnetGroups",
47+
"elasticache:DescribeReplicationGroups",
48+
"elasticache:ListTagsForResource",
49+
"elasticache:ModifyCacheParameterGroup",
50+
"elasticache:ModifyCacheSubnetGroup",
51+
"elasticache:ModifyReplicationGroup",
52+
"elasticache:RemoveTagsFromResource"
53+
],
54+
"Resource": [
55+
"*"
56+
]
57+
},
58+
{
59+
"Sid": "VisualEditor2",
60+
"Effect": "Allow",
61+
"Action": [
62+
"secretsmanager:CreateSecret",
63+
"secretsmanager:DeleteSecret",
64+
"secretsmanager:DescribeSecret",
65+
"secretsmanager:GetResourcePolicy",
66+
"secretsmanager:TagResource",
67+
"secretsmanager:UntagResource"
68+
],
69+
"Resource": [
70+
"*"
71+
]
72+
}
73+
]
74+
}
75+
76+
77+
```
78+
<!-- END OF PRE-COMMIT-PIKE DOCS HOOK -->
79+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
80+
## Requirements
81+
82+
| Name | Version |
83+
|------|---------|
84+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
85+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.23 |
86+
| <a name="requirement_random"></a> [random](#requirement\_random) | ~> 3.0.0 |
87+
88+
## Providers
89+
90+
| Name | Version |
91+
|------|---------|
92+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.23 |
93+
| <a name="provider_random"></a> [random](#provider\_random) | ~> 3.0.0 |
94+
95+
## Modules
96+
97+
| Name | Source | Version |
98+
|------|--------|---------|
99+
| <a name="module_security_group_redis"></a> [security\_group\_redis](#module\_security\_group\_redis) | terraform-aws-modules/security-group/aws | 4.13.0 |
100+
101+
## Resources
102+
103+
| Name | Type |
104+
|------|------|
105+
| [aws_elasticache_parameter_group.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/elasticache_parameter_group) | resource |
106+
| [aws_elasticache_replication_group.redis](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/elasticache_replication_group) | resource |
107+
| [aws_elasticache_subnet_group.elasticache](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/elasticache_subnet_group) | resource |
108+
| [aws_secretsmanager_secret.secret_redis](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret) | resource |
109+
| [aws_security_group_rule.cidr_ingress](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
110+
| [aws_security_group_rule.default_ingress](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
111+
| [random_password.password](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) | resource |
112+
113+
## Inputs
114+
115+
| Name | Description | Type | Default | Required |
116+
|------|-------------|------|---------|:--------:|
117+
| <a name="input_allowed_cidr_blocks"></a> [allowed\_cidr\_blocks](#input\_allowed\_cidr\_blocks) | A list of CIDR blocks which are allowed to access the database | `list(any)` | `[]` | no |
118+
| <a name="input_allowed_security_groups"></a> [allowed\_security\_groups](#input\_allowed\_security\_groups) | A list of Security Group ID's to allow access to | `list(any)` | `[]` | no |
119+
| <a name="input_at_rest_encryption_enabled"></a> [at\_rest\_encryption\_enabled](#input\_at\_rest\_encryption\_enabled) | (Optional) Whether to enable encryption at rest | `bool` | `true` | no |
120+
| <a name="input_automatic_failover_enabled"></a> [automatic\_failover\_enabled](#input\_automatic\_failover\_enabled) | Enable automatic failover | `bool` | `false` | no |
121+
| <a name="input_availability_zones"></a> [availability\_zones](#input\_availability\_zones) | The list of AZs | `list(string)` | `[]` | no |
122+
| <a name="input_engine_log_destination"></a> [engine\_log\_destination](#input\_engine\_log\_destination) | The destination for engine logs(eg. Cloudwatch log-group name or kinesis firehose stream name) | `string` | `null` | no |
123+
| <a name="input_engine_log_destination_type"></a> [engine\_log\_destination\_type](#input\_engine\_log\_destination\_type) | The type of destination for engine logs(eg . cloudwatch-logs or kinesis-firehose) | `string` | `""` | no |
124+
| <a name="input_engine_log_format"></a> [engine\_log\_format](#input\_engine\_log\_format) | the format for logs eg. json/text | `string` | `"json"` | no |
125+
| <a name="input_engine_version"></a> [engine\_version](#input\_engine\_version) | The redis engine version | `string` | `""` | no |
126+
| <a name="input_environment"></a> [environment](#input\_environment) | The name of environment | `string` | `""` | no |
127+
| <a name="input_family"></a> [family](#input\_family) | Redis family | `string` | `"redis4.0"` | no |
128+
| <a name="input_final_snapshot_identifier"></a> [final\_snapshot\_identifier](#input\_final\_snapshot\_identifier) | The name of your final node group (shard) snapshot. ElastiCache creates the snapshot from the primary node in the cluster. If omitted, no final snapshot will be made. | `string` | `null` | no |
129+
| <a name="input_kms_key_id"></a> [kms\_key\_id](#input\_kms\_key\_id) | The ARN of the key that you wish to use if encrypting at rest. If not supplied, uses service managed encryption. Can be specified only if at\_rest\_encryption\_enabled = true | `string` | `""` | no |
130+
| <a name="input_maintenance_window"></a> [maintenance\_window](#input\_maintenance\_window) | Specifies the weekly time range for when maintenance on the cache cluster is performed. The format is ddd:hh24:mi-ddd:hh24:mi (24H Clock UTC). The minimum maintenance window is a 60 minute period | `string` | `"fri:08:00-fri:09:00"` | no |
131+
| <a name="input_multi_az_enabled"></a> [multi\_az\_enabled](#input\_multi\_az\_enabled) | Enable multi az | `bool` | `false` | no |
132+
| <a name="input_name"></a> [name](#input\_name) | The name of the redis cluster | `string` | `""` | no |
133+
| <a name="input_node_type"></a> [node\_type](#input\_node\_type) | The instance size of the redis cluster | `string` | `"cache.t3.micro"` | no |
134+
| <a name="input_notification_topic_arn"></a> [notification\_topic\_arn](#input\_notification\_topic\_arn) | (Optional) ARN of an SNS topic to send ElastiCache notifications | `string` | `null` | no |
135+
| <a name="input_num_cache_nodes"></a> [num\_cache\_nodes](#input\_num\_cache\_nodes) | The number of cache nodes | `number` | `1` | no |
136+
| <a name="input_parameter_group_description"></a> [parameter\_group\_description](#input\_parameter\_group\_description) | Parameter group | `string` | `null` | no |
137+
| <a name="input_port"></a> [port](#input\_port) | The redis port | `number` | `6379` | no |
138+
| <a name="input_recovery_window_aws_secret"></a> [recovery\_window\_aws\_secret](#input\_recovery\_window\_aws\_secret) | Number of days that AWS Secrets Manager waits before it can delete the secret. This value can be 0 to force deletion without recovery or range from 7 to 30 days. | `number` | `0` | no |
139+
| <a name="input_slow_log_destination"></a> [slow\_log\_destination](#input\_slow\_log\_destination) | The destination for slow logs(eg. Cloudwatch log-group name or kinesis firehose stream name.) | `string` | `null` | no |
140+
| <a name="input_slow_log_destination_type"></a> [slow\_log\_destination\_type](#input\_slow\_log\_destination\_type) | The type of destination for slow logs(eg . cloudwatch-logs or kinesis-firehose) | `string` | `""` | no |
141+
| <a name="input_slow_log_format"></a> [slow\_log\_format](#input\_slow\_log\_format) | the format for logs eg. json/text | `string` | `"json"` | no |
142+
| <a name="input_snapshot_arns"></a> [snapshot\_arns](#input\_snapshot\_arns) | (Optional) A single-element string list containing an Amazon Resource Name (ARN) of a Redis RDB snapshot file stored in Amazon S3. Example: arn:aws:s3:::my\_bucket/snapshot1.rdb . This will be used to add data to a fresh new instance. | `list(string)` | `[]` | no |
143+
| <a name="input_snapshot_retention_limit"></a> [snapshot\_retention\_limit](#input\_snapshot\_retention\_limit) | The number of days for which ElastiCache will retain automatic cache cluster snapshots before deleting them. For example, if you set SnapshotRetentionLimit to 5, then a snapshot that was taken today will be retained for 5 days before being deleted. If the value of SnapshotRetentionLimit is set to zero (0), backups are turned off. Please note that setting a snapshot\_retention\_limit is not supported on cache.t1.micro or cache.t2.* cache nodes | `number` | `0` | no |
144+
| <a name="input_snapshot_window"></a> [snapshot\_window](#input\_snapshot\_window) | The daily time range (in UTC) during which ElastiCache will begin taking a daily snapshot of your cache cluster. The minimum maintenance window is a 60 minute period. Example: 05:00-09:00 | `string` | `"03:00-05:00"` | no |
145+
| <a name="input_subnets"></a> [subnets](#input\_subnets) | The subnets where the redis cluster is deployed | `list(string)` | `[]` | no |
146+
| <a name="input_transit_encryption_enabled"></a> [transit\_encryption\_enabled](#input\_transit\_encryption\_enabled) | (Optional) Whether to enable encryption in transit | `bool` | `true` | no |
147+
| <a name="input_vpc_id"></a> [vpc\_id](#input\_vpc\_id) | The vpc where we will put the redis cluster | `string` | `""` | no |
148+
149+
## Outputs
150+
151+
| Name | Description |
152+
|------|-------------|
153+
| <a name="output_auth_token_password"></a> [auth\_token\_password](#output\_auth\_token\_password) | Elasticache-redis auth token password(this password may be old, because Terraform doesn't track it after initial creation) |
154+
| <a name="output_elastic_cache_redis_cluster_id"></a> [elastic\_cache\_redis\_cluster\_id](#output\_elastic\_cache\_redis\_cluster\_id) | ID of the elasticache-redis cluster |
155+
| <a name="output_elastic_cache_redis_endpoint"></a> [elastic\_cache\_redis\_endpoint](#output\_elastic\_cache\_redis\_endpoint) | Elasticache-redis cluster primary endpoint address |
156+
| <a name="output_elastic_cache_redis_port"></a> [elastic\_cache\_redis\_port](#output\_elastic\_cache\_redis\_port) | Port number of Redis |
157+
| <a name="output_elastic_cache_redis_primary_endpoint_address"></a> [elastic\_cache\_redis\_primary\_endpoint\_address](#output\_elastic\_cache\_redis\_primary\_endpoint\_address) | Primary endpoint address of redis |
158+
| <a name="output_elastic_cache_redis_security_group"></a> [elastic\_cache\_redis\_security\_group](#output\_elastic\_cache\_redis\_security\_group) | The security group ID of the cluster |
159+
| <a name="output_elastic_cache_redis_subnet_group_name"></a> [elastic\_cache\_redis\_subnet\_group\_name](#output\_elastic\_cache\_redis\_subnet\_group\_name) | Subnet group name of the elasticache\_redis cluster |
160+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

0 commit comments

Comments
 (0)