Tasks · Replacement

Make the database impossible to destroy by accident

The change

The orders database has no protection against a careless edit. Add one, and then prove it works by trying the credential rotation that would otherwise have destroyed it.

routine6 mindisruption budget 0s simulated

The configuration

variable "environment" {
  type    = string
  default = "prod"
}

locals {
  common_tags = {
    environment = var.environment
    managed_by  = "opentofu"
    team        = "orders"
  }

# Which /24 each zone gets. Written out rather than derived, because
  # deriving it from the key is how three subnets end up sharing a range.
  subnet_numbers = {
    a = 1
    b = 2
    c = 3
  }
}

resource "cloud_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  tags                 = merge(local.common_tags, { name = "orders-main" })
}

resource "cloud_subnet" "private" {
  for_each = toset(["a", "b", "c"])

vpc_id                  = cloud_vpc.main.id
  cidr_block              = cidrsubnet(cloud_vpc.main.cidr_block, 8, lookup(local.subnet_numbers, each.key, 0))
  availability_zone       = "eu-west-1${each.key}"
  map_public_ip_on_launch = false
  tags                    = merge(local.common_tags, { name = "orders-private-${each.key}" })
}

resource "cloud_security_group" "database" {
  name        = "orders-database"
  description = "Managed by Terraform"
  vpc_id      = cloud_vpc.main.id
  tags        = local.common_tags
}

resource "cloud_security_group" "web" {
  name        = "orders-web"
  description = "Managed by Terraform"
  vpc_id      = cloud_vpc.main.id
  tags        = local.common_tags
}

resource "cloud_iam_role" "application" {
  name               = "orders-application"
  assume_role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":[]}"
  description        = "The orders service"
  tags               = local.common_tags
}

resource "cloud_iam_policy" "bucket_access" {
  name        = "orders-bucket-access"
  policy      = "{\"Version\":\"2012-10-17\",\"Statement\":[]}"
  description = "Read and write the orders bucket"
  tags        = local.common_tags
}

resource "cloud_bucket" "uploads" {
  bucket        = "orders-uploads-eu-west-1"
  force_destroy = false
  tags          = local.common_tags
}

resource "cloud_db_instance" "primary" {
  identifier              = "orders-primary"
  instance_class          = "db.r6g.large"
  engine                  = "postgres"
  engine_version          = "16.4"
  username                = "app"
  password                = "correct-horse-battery-staple"
  db_name                 = "orders"
  allocated_storage       = 100
  storage_encrypted       = true
  availability_zone       = "eu-west-1a"
  multi_az                = false
  db_subnet_group_name    = "orders-private"
  backup_retention_period = 7
  skip_final_snapshot     = false
  tags                    = local.common_tags
}

resource "cloud_instance" "worker" {
  count = 3

ami                    = "ami-0a1b2c3d4e5f60718"
  instance_type          = "t3.medium"
  subnet_id              = cloud_subnet.private["a"].id
  availability_zone      = "eu-west-1a"
  vpc_security_group_ids = [cloud_security_group.web.id]
  monitoring             = false
  tags                   = merge(local.common_tags, { name = "orders-worker" })
}

resource "cloud_lb" "public" {
  name                       = "orders-public"
  internal                   = false
  load_balancer_type         = "application"
  subnets                    = [for s in cloud_subnet.private : s.id]
  security_groups            = [cloud_security_group.web.id]
  enable_deletion_protection = true
  tags                       = local.common_tags
}

resource "cloud_dns_record" "api" {
  zone_id = "Z0SAMPLEZONEID01"
  name    = "api.orders.example.com"
  type    = "CNAME"
  ttl     = 300
  records = [cloud_lb.public.dns_name]
}

# __APPEND__

The plan

Plan: 0 to add, 0 to change, 0 to destroy.

Change the configuration first.