module.yml

---
# Copyright 2018 widdix GmbH
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
AWSTemplateFormatVersion: '2010-09-09'
Description: 'cfn-modules: RDS instance'
# cfn-modules:implements(ExposeName, ExposeDnsName)
Parameters:
  VpcModule:
    Description: 'Stack name of vpc module.'
    Type: String
  ClientSgModule:
    Description: 'Stack name of client-sg module.'
    Type: String
  AlertingModule:
    Description: 'Optional but recommended stack name of alerting module.'
    Type: String
  HostedZoneModule:
    Description: 'Optional but recommended stack name of module implementing HostedZone.'
    Type: String
  BastionModule:
    Description: 'Optional but recommended stack name of module implementing Bastion.'
    Type: String
  KmsKeyModule:
    Description: 'Optional but recommended stack name of kms-key module (ignored when DBSnapshotIdentifier is set, value used from snapshot).'
    Type: String
  Engine:
    Description: 'The database engine that the DB instance uses (ignored when DBSnapshotIdentifier is set, value used from snapshot).'
    Type: String
    AllowedValues: [postgres, mysql]
  EngineVersion:
    Description: 'The version number of the database engine that the DB instance uses.'
    Type: String
  EnginePort:
    Description: 'The port for the instance.'
    Type: Number
  DBSnapshotIdentifier:
    Description: 'Optional name or Amazon Resource Name (ARN) of the DB snapshot from which you want to restore (leave blank to create an empty database).'
    Type: String
  DBAllocatedStorage:
    Description: 'The allocated storage size, specified in GB (ignored when DBSnapshotIdentifier is set, value used from snapshot).'
    Type: Number
    MinValue: 5
    MaxValue: 16384
  DBInstanceClass:
    Description: 'The instance type of the database.'
    Type: String
  DBName:
    Description: 'Name of the database (ignored when DBSnapshotIdentifier is set, value used from snapshot).'
    Type: String
  DBBackupRetentionPeriod:
    Description: 'The number of days to keep snapshots of the database.'
    Type: Number
    MinValue: 0
    MaxValue: 35
  DBMasterUsername:
    Description: 'The master user name for the DB instance (ignored when DBSnapshotIdentifier is set, value used from snapshot).'
    Type: String
  DBMasterUserPassword:
    Description: 'The master password for the DB instance (ignored when DBSnapshotIdentifier is set, value used from snapshot).'
    Type: String
    NoEcho: true
  DBMultiAZ:
    Description: 'Specifies if the database instance is deployed to multiple Availability Zones for HA.'
    Type: String
  SubDomainNameWithDot:
    Description: 'Name that is used to create the DNS entry with trailing dot, e.g. §{SubDomainNameWithDot}§{HostedZoneName}. Leave blank for naked (or apex and bare) domain. Requires HostedZoneModule parameter!'
    Type: String
  EnableIAMDatabaseAuthentication:
    Description: 'Enable mapping of AWS Identity and Access Management (IAM) accounts to database accounts (https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.IAMDBAuth.html).'
    Type: String
    AllowedValues: ['true', 'false']
  DBParameterGroupName:
    Description: 'Optional DB Parameter Group to assign to the RDS instance being created.'
    Type: String
    Default: ''
  LambdaExecutionRoleArn:
    Description: 'Role to be added as feature name Lambda for the RDS instance being created.'
    Type: String
    Default: ''
  AllowPostgresMajorVersionUpgrade:
    Description: 'If an upgrade to a major version of Postgres is allowed.'
    Type: String
    AllowedValues: ['true', 'false']
    Default: 'false'
Conditions:
  HasAlertingModule: !Not [!Equals [!Ref AlertingModule, '']]
  HasHostedZoneModule: !Not [!Equals [!Ref HostedZoneModule, '']]
  HasBastionModule: !Not [!Equals [!Ref BastionModule, '']]
  HasKmsKeyModule: !Not [!Equals [!Ref KmsKeyModule, '']]
  HasDBSnapshotIdentifier: !Not [!Equals [!Ref DBSnapshotIdentifier, '']]
  HasKmsKeyModuleAndNotDBSnapshotIdentifier: !And [!Condition HasKmsKeyModule, !Not [!Condition HasDBSnapshotIdentifier]]
  HasDBParameterGroupName: !Not [!Equals [!Ref DBParameterGroupName, '']]
  HasLambdaExecutionRole: !Not [!Equals [!Ref LambdaExecutionRoleArn, '']]
Resources:
  RecordSet:
    Condition: HasHostedZoneModule
    Type: 'AWS::Route53::RecordSet'
    Properties:
      HostedZoneId:
        'Fn::ImportValue': !Sub '${HostedZoneModule}-Id'
      Name: !Sub
      - '${SubDomainNameWithDot}${HostedZoneName}'
      - SubDomainNameWithDot: !Ref SubDomainNameWithDot
        HostedZoneName:
          'Fn::ImportValue': !Sub '${HostedZoneModule}-Name'
      ResourceRecords:
      - !GetAtt 'DBInstance.Endpoint.Address'
      TTL: 60
      Type: CNAME
  SecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: !Ref 'AWS::StackName'
      VpcId:
        'Fn::ImportValue': !Sub '${VpcModule}-Id'
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: !Ref EnginePort
        ToPort: !Ref EnginePort
        SourceSecurityGroupId: {'Fn::ImportValue': !Sub '${ClientSgModule}-SecurityGroupId'}
  SecurityGroupInDatabaseBastion:
    Type: 'AWS::EC2::SecurityGroupIngress'
    Condition: HasBastionModule
    Properties:
      GroupId: !Ref SecurityGroup
      IpProtocol: tcp
      FromPort: !Ref EnginePort
      ToPort: !Ref EnginePort
      SourceSecurityGroupId: {'Fn::ImportValue': !Sub '${BastionModule}-SecurityGroupId'}
  DBSubnetGroup:
    Type: 'AWS::RDS::DBSubnetGroup'
    Properties:
      DBSubnetGroupDescription: !Ref 'AWS::StackName'
      SubnetIds: !Split [',', {'Fn::ImportValue': !Sub '${VpcModule}-SubnetIdsPrivate'}]
  DBInstance:
    DeletionPolicy: Snapshot # default
    UpdateReplacePolicy: Snapshot
    Type: 'AWS::RDS::DBInstance'
    Properties:
      AllocatedStorage: !If [HasDBSnapshotIdentifier, !Ref 'AWS::NoValue', !Ref DBAllocatedStorage]
      AllowMajorVersionUpgrade: !Ref AllowPostgresMajorVersionUpgrade
      AutoMinorVersionUpgrade: true
      BackupRetentionPeriod: !Ref DBBackupRetentionPeriod
      CopyTagsToSnapshot: true
      DBInstanceClass: !Ref DBInstanceClass
      DBName: !If [HasDBSnapshotIdentifier, !Ref 'AWS::NoValue', !Ref DBName]
      DBSnapshotIdentifier: !If [HasDBSnapshotIdentifier, !Ref DBSnapshotIdentifier, !Ref 'AWS::NoValue']
      DBSubnetGroupName: !Ref DBSubnetGroup
      EnableIAMDatabaseAuthentication: !Ref EnableIAMDatabaseAuthentication
      Engine: !Ref Engine
      EngineVersion: !Ref EngineVersion
      KmsKeyId: !If [HasKmsKeyModuleAndNotDBSnapshotIdentifier, {'Fn::ImportValue': !Sub '${KmsKeyModule}-Arn'}, !Ref 'AWS::NoValue']
      MasterUsername: !If [HasDBSnapshotIdentifier, !Ref 'AWS::NoValue', !Ref DBMasterUsername]
      MasterUserPassword: !If [HasDBSnapshotIdentifier, !Ref 'AWS::NoValue', !Ref DBMasterUserPassword]
      MultiAZ: !Ref DBMultiAZ
      PreferredBackupWindow: '09:54-10:24'
      PreferredMaintenanceWindow: 'sat:07:00-sat:07:30'
      StorageType: gp2
      StorageEncrypted: !If [HasDBSnapshotIdentifier, !Ref 'AWS::NoValue', !If [HasKmsKeyModule, true, false]]
      VPCSecurityGroups:
      - !Ref SecurityGroup
      DBParameterGroupName: !If [HasDBParameterGroupName, !Ref DBParameterGroupName, !Ref 'AWS::NoValue']
      AssociatedRoles:
        !If
        - HasLambdaExecutionRole
        - - FeatureName: Lambda
            RoleArn: !Ref LambdaExecutionRoleArn
        - !Ref "AWS::NoValue"
  AlarmBurstBalanceTooLow:
    Condition: HasAlertingModule
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      AlarmDescription: 'Average database storage burst balance over last 10 minutes too low, expect a significant performance drop soon.'
      ComparisonOperator: LessThanThreshold
      Dimensions:
      - Name: DBInstanceIdentifier
        Value: !Ref DBInstance
      EvaluationPeriods: 1
      MetricName: BurstBalance
      Namespace: 'AWS/RDS'
      OKActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      Period: 600
      Statistic: Average
      Threshold: 20
  AlarmCPUUtilizationTooHigh:
    Condition: HasAlertingModule
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      AlarmDescription: 'Average database CPU utilization over last 10 minutes too high.'
      ComparisonOperator: GreaterThanThreshold
      Dimensions:
      - Name: DBInstanceIdentifier
        Value: !Ref DBInstance
      EvaluationPeriods: 1
      MetricName: CPUUtilization
      Namespace: 'AWS/RDS'
      OKActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      Period: 600
      Statistic: Average
      Threshold: 80
  AlarmCPUCreditBalanceTooLow:
    Condition: HasAlertingModule
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      AlarmDescription: 'Average database CPU credit balance over last 10 minutes too low, expect a significant performance drop soon.'
      ComparisonOperator: LessThanThreshold
      Dimensions:
      - Name: DBInstanceIdentifier
        Value: !Ref DBInstance
      EvaluationPeriods: 1
      MetricName: CPUCreditBalance
      Namespace: 'AWS/RDS'
      OKActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      Period: 600
      Statistic: Average
      Threshold: 20
  AlarmDiskQueueDepthTooHigh:
    Condition: HasAlertingModule
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      AlarmDescription: 'Average database disk queue depth over last 10 minutes too high, performance may suffer.'
      ComparisonOperator: GreaterThanThreshold
      Dimensions:
      - Name: DBInstanceIdentifier
        Value: !Ref DBInstance
      EvaluationPeriods: 1
      MetricName: DiskQueueDepth
      Namespace: 'AWS/RDS'
      OKActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      Period: 600
      Statistic: Average
      Threshold: 64
  AlarmFreeableMemoryTooLow:
    Condition: HasAlertingModule
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      AlarmDescription: 'Average database freeable memory over last 10 minutes too low, performance may suffer.'
      ComparisonOperator: LessThanThreshold
      Dimensions:
      - Name: DBInstanceIdentifier
        Value: !Ref DBInstance
      EvaluationPeriods: 1
      MetricName: FreeableMemory
      Namespace: 'AWS/RDS'
      OKActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      Period: 600
      Statistic: Average
      Threshold: 64000000 # 64 Megabyte in Byte
  AlarmFreeStorageSpaceTooLow:
    Condition: HasAlertingModule
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      AlarmDescription: 'Average database free storage space over last 10 minutes too low.'
      ComparisonOperator: LessThanThreshold
      Dimensions:
      - Name: DBInstanceIdentifier
        Value: !Ref DBInstance
      EvaluationPeriods: 1
      MetricName: FreeStorageSpace
      Namespace: 'AWS/RDS'
      OKActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      Period: 600
      Statistic: Average
      Threshold: 2000000000 # 2 Gigabyte in Byte
  AlarmSwapUsageTooHigh:
    Condition: HasAlertingModule
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      AlarmDescription: 'Average database swap usage over last 10 minutes too high, performance may suffer.'
      ComparisonOperator: GreaterThanThreshold
      Dimensions:
      - Name: DBInstanceIdentifier
        Value: !Ref DBInstance
      EvaluationPeriods: 1
      MetricName: SwapUsage
      Namespace: 'AWS/RDS'
      OKActions:
      - 'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      Period: 600
      Statistic: Average
      Threshold: 256000000 # 256 Megabyte in Byte
  EventSubscription:
    Condition: HasAlertingModule
    Type: 'AWS::RDS::EventSubscription'
    Properties:
      EventCategories:
      - failover
      - failure
      - 'low storage'
      - maintenance
      - 'read replica'
      - recovery
      SnsTopicArn:
        'Fn::ImportValue': !Sub '${AlertingModule}-Arn'
      SourceIds:
      - !Ref DBInstance
      SourceType: 'db-instance'
Outputs:
  ModuleId:
    Value: 'rds-instance'
  ModuleVersion:
    Value: '1.2.0'
  StackName:
    Value: !Ref 'AWS::StackName'
  Name:
    Description: 'The name of the database instance.'
    Value: !Ref DBInstance
    Export:
      Name: !Sub '${AWS::StackName}-Name'
  DnsName:
    Description: 'The connection endpoint for the database.'
    Value: !GetAtt 'DBInstance.Endpoint.Address'
    Export:
      Name: !Sub '${AWS::StackName}-DnsName'