module.yml

---
# Copyright 2018 widdix GmbH
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
AWSTemplateFormatVersion: '2010-09-09'
Description: 'cfn-modules: AWS RDS Aurora Serverless MySQL cluster'
# cfn-modules:implements(ExposeName, ExposeDnsName)
Parameters:
  VpcModule:
    Description: 'Stack name of vpc module.'
    Type: String
  ClientSgModule:
    Description: 'Stack name of client-sg module.'
    Type: String
  KmsKeyModule:
    Description: 'Stack name of kms-key module (ignored when DBSnapshotIdentifier is set, value used from snapshot).'
    Type: String
    Default: ''
  BastionModule:
    Description: 'Optional but recommended stack name of module implementing Bastion.'
    Type: String
    Default: ''
  HostedZoneModule:
    Description: 'Optional stack name of module implementing HostedZone.'
    Type: String
    Default: ''
  AlertingModule:
    Description: 'Optional but recommended stack name of alerting module.'
    Type: String
    Default: ''
  SecretModule:
    Description: 'Optional but recommended stack name of secret module.'
    Type: String
    Default: ''
  Engine:
    Description: 'DEPRECATED since v1, removed in v3, value is ignored!'
    Type: String
    AllowedValues: [aurora]
    Default: aurora
  DBSnapshotIdentifier:
    Description: 'Optional identifier for the DB cluster snapshot from which you want to restore (leave blank to create an empty cluster).'
    Type: String
    Default: ''
  DBName:
    Description: 'Name of the database (ignored when DBSnapshotIdentifier is set, value used from snapshot).'
    Type: String
    Default: ''
  DBBackupRetentionPeriod:
    Description: 'The number of days to keep snapshots of the cluster.'
    Type: Number
    MinValue: 1
    MaxValue: 35
    Default: 30
  DBMasterUsername:
    Description: 'The master user name for the DB instance (ignored when DBSnapshotIdentifier is set, value used from snapshot).'
    Type: 'String'
    Default: master
  DBMasterUserPassword:
    Description: 'The master password for the DB instance (ignored when DBSnapshotIdentifier is set, value used from snapshot; also ignored if SecretModule is set).'
    Type: String
    NoEcho: true
    Default: ''
  SubDomainNameWithDot:
    Description: 'Name that is used to create the DNS entry with trailing dot, e.g. §{SubDomainNameWithDot}§{HostedZoneName}. Leave blank for naked (or apex and bare) domain. Requires HostedZoneModule parameter!'
    Type: String
    Default: 'aurora.'
  PreferredBackupWindow:
    Description: 'The daily time range in UTC during which you want to create automated backups.'
    Type: String
    Default: '09:54-10:24'
  PreferredMaintenanceWindow:
    Description: 'The weekly time range (in UTC) during which system maintenance can occur.'
    Type: String
    Default: 'sat:07:00-sat:07:30'
  SecondsUntilAutoPause:
    Description: 'IGNORED BECAUSE OF A BUG IN CLOUDFORMATION! VALUE WILL APPLY IN THE FUTURE! The time, in seconds, before a Serverless Aurora cluster is paused.'  # TODO remove uppercase warning
    Type: Number
    MinValue: 300
    MaxValue: 86400
    Default: 300
  MaxCapacity:
    Description: 'The maximum capacity units for a Serverless Aurora cluster.'
    Type: String
    AllowedValues: [1, 2, 4, 8, 16, 32, 64, 128, 256]
    Default: 2
  MinCapacity:
    Description: 'The minimum capacity units for a Serverless Aurora cluster.'
    Type: String
    AllowedValues: [1, 2, 4, 8, 16, 32, 64, 128, 256]
    Default: 2
  EngineVersion:
    Description: 'Aurora Serverless MySQL version.'
    Type: String
    Default: '8.0.mysql-aurora.3.08.0'
    AllowedValues: ['8.0.mysql-aurora.3.08.0'] # aws rds describe-orderable-db-instance-options --engine aurora-mysql --db-instance-class db.serverless --query 'OrderableDBInstanceOptions[].[EngineVersion]' --output text
  EnableDataApi:
    Description: 'Enable the Data API (https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/data-api.html).'
    Type: String
    AllowedValues: ['true', 'false']
    Default: 'true'
Mappings:
  EngineVersionMap:
    '8.0.mysql-aurora.3.08.0':
      ClusterParameterGroupFamily: 'aurora-mysql8.0'
      EngineVersion: '8.0.mysql_aurora.3.08.0'
      Engine: 'aurora-mysql'
Conditions:
  HasBastionModule: !Not [!Equals [!Ref BastionModule, '']]
  HasHostedZoneModule: !Not [!Equals [!Ref HostedZoneModule, '']]
  HasAlertingModule: !Not [!Equals [!Ref AlertingModule, '']]
  HasSecretModule: !Not [!Equals [!Ref SecretModule, '']]
  HasNotDBSnapshotIdentifier: !Equals [!Ref DBSnapshotIdentifier, '']
  HasDBSnapshotIdentifier: !Not [!Condition HasNotDBSnapshotIdentifier]
Resources:
  RecordSet:
    Condition: HasHostedZoneModule
    Type: 'AWS::Route53::RecordSet'
    Properties:
      HostedZoneId: {'Fn::ImportValue': !Sub '${HostedZoneModule}-Id'}
      Name: !Sub
      - '${SubDomainNameWithDot}${HostedZoneName}'
      - SubDomainNameWithDot: !Ref SubDomainNameWithDot
        HostedZoneName: {'Fn::ImportValue': !Sub '${HostedZoneModule}-Name'}
      ResourceRecords:
      - !GetAtt 'DBCluster.Endpoint.Address'
      TTL: 60
      Type: CNAME
  SecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: !Ref 'AWS::StackName'
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 3306
        ToPort: 3306
        SourceSecurityGroupId: {'Fn::ImportValue': !Sub '${ClientSgModule}-SecurityGroupId'}
      VpcId: {'Fn::ImportValue': !Sub '${VpcModule}-Id'}
  SecurityGroupInSshFromBastion:
    Condition: HasBastionModule
    Type: 'AWS::EC2::SecurityGroupIngress'
    Properties:
      GroupId: !Ref SecurityGroup
      IpProtocol: tcp
      FromPort: 3306
      ToPort: 3306
      SourceSecurityGroupId: {'Fn::ImportValue': !Sub '${BastionModule}-SecurityGroupId'}
  DBSubnetGroup:
    Type: 'AWS::RDS::DBSubnetGroup'
    Properties:
      DBSubnetGroupDescription: !Ref 'AWS::StackName'
      SubnetIds: !Split [',', {'Fn::ImportValue': !Sub '${VpcModule}-SubnetIdsPrivate'}]
  DBClusterParameterGroup:
    Type: 'AWS::RDS::DBClusterParameterGroup'
    Properties:
      Description: !Ref 'AWS::StackName'
      Family: !FindInMap [EngineVersionMap, !Ref EngineVersion, ClusterParameterGroupFamily]
      Parameters:
        character_set_client: utf8
        character_set_connection: utf8
        character_set_database: utf8
        character_set_filesystem: utf8
        character_set_results: utf8
        character_set_server: utf8
        collation_connection: utf8_general_ci
        collation_server: utf8_general_ci
  DBCluster:
    DeletionPolicy: Snapshot # default
    UpdateReplacePolicy: Snapshot
    Type: 'AWS::RDS::DBCluster'
    Properties:
      BackupRetentionPeriod: !Ref DBBackupRetentionPeriod
      DatabaseName: !If [HasDBSnapshotIdentifier, !Ref 'AWS::NoValue', !Ref DBName]
      DBClusterParameterGroupName: !Ref DBClusterParameterGroup
      DBSubnetGroupName: !Ref DBSubnetGroup
      EnableHttpEndpoint: !Ref EnableDataApi
      Engine: !FindInMap [EngineVersionMap, !Ref EngineVersion, Engine]
      EngineVersion: !FindInMap [EngineVersionMap, !Ref EngineVersion, EngineVersion]
      KmsKeyId: !If [HasDBSnapshotIdentifier, !Ref 'AWS::NoValue', {'Fn::ImportValue': !Sub '${KmsKeyModule}-Arn'}]
      MasterUsername: !If [HasDBSnapshotIdentifier, !Ref 'AWS::NoValue', !Ref DBMasterUsername]
      MasterUserPassword: !If [HasDBSnapshotIdentifier, !Ref 'AWS::NoValue', !If [HasSecretModule, !Join ['', ['{{resolve:secretsmanager:', {'Fn::ImportValue': !Sub '${SecretModule}-Arn'}, '}}']], !Ref DBMasterUserPassword]]
      PreferredBackupWindow: !Ref PreferredBackupWindow
      PreferredMaintenanceWindow: !Ref PreferredMaintenanceWindow
      ServerlessV2ScalingConfiguration:
        MaxCapacity: !Ref MaxCapacity
        MinCapacity: !Ref MinCapacity
        # SecondsUntilAutoPause: !Ref SecondsUntilAutoPause TODO Waiting for CloudFormation support
      SnapshotIdentifier: !If [HasDBSnapshotIdentifier, !Ref DBSnapshotIdentifier, !Ref 'AWS::NoValue']
      StorageEncrypted: true
      VpcSecurityGroupIds:
      - !Ref SecurityGroup
  ServerlessDBInstance:
    Type: 'AWS::RDS::DBInstance'
    Properties:
      DBClusterIdentifier: !Ref DBCluster
      DBInstanceClass: 'db.serverless'
      Engine: !FindInMap [EngineVersionMap, !Ref EngineVersion, Engine]
  DBClusterEventSubscription:
    Condition: HasAlertingModule
    Type: 'AWS::RDS::EventSubscription'
    Properties:
      EventCategories:
      - failover
      - failure
      - maintenance
      SnsTopicArn: {'Fn::ImportValue': !Sub '${AlertingModule}-Arn'}
      SourceIds: [!Ref DBCluster]
      SourceType: 'db-cluster'
Outputs:
  ModuleId:
    Value: 'rds-aurora-serverless'
  ModuleVersion:
    Value: '2.0.0'
  StackName:
    Value: !Ref 'AWS::StackName'
  Name:
    Value: !Ref DBCluster
    Export:
      Name: !Sub '${AWS::StackName}-Name'
  DnsName:
    Value: !GetAtt 'DBCluster.Endpoint.Address'
    Export:
      Name: !Sub '${AWS::StackName}-DNSName'
  ClusterName:
    Value: !Ref DBCluster
    Export:
      Name: !Sub '${AWS::StackName}-ClusterName'