FahdShalhoub/thamanyah
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

FEAT: Created Databases And Roles For Each App

Browse Source
This commit is contained in:
fahd
2026-08-12 14:13:12 +03:00
parent 979f541a6c
commit 6bd8f3d2a3
3 changed files with 95 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infrastructure/go.mod
+1
View File
@@ -4,6 +4,7 @@ go 1.25.11
require (
github.com/pulumi/pulumi-aws/sdk/v7 v7.40.0
github.com/pulumi/pulumi-postgresql/sdk/v3 v3.18.0
github.com/pulumi/pulumi-random/sdk/v4 v4.21.1
github.com/pulumi/pulumi/sdk/v3 v3.256.0
)
infrastructure/go.sum
+2
View File
@@ -172,6 +172,8 @@ github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 h1:vkHw5I/plNdTr435
github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231/go.mod h1:murToZ2N9hNJzewjHBgfFdXhZKjY3z5cYC1VXk+lbFE=
github.com/pulumi/pulumi-aws/sdk/v7 v7.40.0 h1:hCWhnZ4qaXECoxFrUGmDh1S4U6aCMuPghllRvZc+VqY=
github.com/pulumi/pulumi-aws/sdk/v7 v7.40.0/go.mod h1:jv6dSPiG6CDnje0YLo7MdzkvR91kWCJjXcnETXwJdrw=
github.com/pulumi/pulumi-postgresql/sdk/v3 v3.18.0 h1:2MqXGrJCeGzpiECyETTKZv+Zt/4LPZiiePYSwkuggpM=
github.com/pulumi/pulumi-postgresql/sdk/v3 v3.18.0/go.mod h1:SturfYpqsgJ8lQg0R2qEpwe5MdeUKk8b/lUPh1OH+TE=
github.com/pulumi/pulumi-random/sdk/v4 v4.21.1 h1:pqvBaBMwFPP3DV8BYh/f45V4A62kFqJRQv171pfgObk=
github.com/pulumi/pulumi-random/sdk/v4 v4.21.1/go.mod h1:4Q2jFqgCimgOQxvWntZSnV6u8+JhCkPHewloJQfLoeQ=
github.com/pulumi/pulumi/sdk/v3 v3.256.0 h1:OrkIu7Iw3HUcMtoEy2uzpD21C32B5EYBLBgBoh/uQPM=
infrastructure/main.go
+92 -2
View File
@@ -2,21 +2,76 @@ package main
import (
"encoding/json"
"fmt"
"io"
"net/http"
"strings"
"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/cloudfront"
"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/ec2"
"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/mediaconvert"
"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/rds"
"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/s3"
"github.com/pulumi/pulumi-postgresql/sdk/v3/go/postgresql"
"github.com/pulumi/pulumi-random/sdk/v4/go/random"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
// currentPublicIP returns the caller's public IP, used to scope the RDS
// security group to the machine that will actually run `pulumi up`.
func currentPublicIP() (string, error) {
resp, err := http.Get("https://checkip.amazonaws.com")
if err != nil {
return "", err
}
defer func() { _ = resp.Body.Close() }()
body, err := io.ReadAll(resp.Body)
if err != nil {
return "", err
}
return strings.TrimSpace(string(body)), nil
}
const originId = "encoded-bucket-origin"
// AWS managed "CachingOptimized" cache policy (same ID in every account/region).
const cachingOptimizedPolicyId = "658327ea-f89d-4fab-a63d-7e88639e58f6"
// newServiceDatabase creates a login role and a same-named database owned by
// that role, so the service only ever touches its own database.
func newServiceDatabase(ctx *pulumi.Context, provider *postgresql.Provider, service string) (*random.RandomPassword, error) {
password, err := random.NewRandomPassword(ctx, service+"-db-password", &random.RandomPasswordArgs{
Length: pulumi.Int(24),
Special: pulumi.Bool(true),
MinUpper: pulumi.Int(1),
MinLower: pulumi.Int(1),
MinNumeric: pulumi.Int(1),
MinSpecial: pulumi.Int(1),
})
if err != nil {
return nil, err
}
role, err := postgresql.NewRole(ctx, service+"-db-role", &postgresql.RoleArgs{
Name: pulumi.String(service),
Login: pulumi.Bool(true),
Password: password.Result,
}, pulumi.Provider(provider))
if err != nil {
return nil, err
}
_, err = postgresql.NewDatabase(ctx, service+"-database", &postgresql.DatabaseArgs{
Name: pulumi.String(service),
Owner: role.Name,
}, pulumi.Provider(provider))
if err != nil {
return nil, err
}
return password, nil
}
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
// Create an AWS resource (S3 Bucket) that holds encoded assets
@@ -146,8 +201,14 @@ func main() {
return err
}
myIP, err := currentPublicIP()
if err != nil {
return err
}
myIPCidr := fmt.Sprintf("%s/32", myIP)
dbSecurityGroup, err := ec2.NewSecurityGroup(ctx, "postgres-sg", &ec2.SecurityGroupArgs{
Description: pulumi.String("Allow Postgres access from within the VPC only"),
Description: pulumi.String("Allow Postgres access from within the VPC and the deployer's IP"),
VpcId: pulumi.String(vpc.Id),
Ingress: ec2.SecurityGroupIngressArray{
&ec2.SecurityGroupIngressArgs{
@@ -156,6 +217,13 @@ func main() {
ToPort: pulumi.Int(5432),
CidrBlocks: pulumi.ToStringArray([]string{vpc.CidrBlock}),
},
&ec2.SecurityGroupIngressArgs{
Protocol: pulumi.String("tcp"),
FromPort: pulumi.Int(5432),
ToPort: pulumi.Int(5432),
CidrBlocks: pulumi.ToStringArray([]string{myIPCidr}),
Description: pulumi.String("Deployer IP, for the postgresql provider to create databases"),
},
},
Egress: ec2.SecurityGroupEgressArray{
&ec2.SecurityGroupEgressArgs{
@@ -197,7 +265,7 @@ func main() {
Password: dbPassword.Result,
DbSubnetGroupName: dbSubnetGroup.Name,
VpcSecurityGroupIds: pulumi.StringArray{dbSecurityGroup.ID()},
PubliclyAccessible: pulumi.Bool(false),
PubliclyAccessible: pulumi.Bool(true),
MultiAz: pulumi.Bool(false),
BackupRetentionPeriod: pulumi.Int(0),
DeletionProtection: pulumi.Bool(false),
@@ -208,6 +276,28 @@ func main() {
return err
}
pgProvider, err := postgresql.NewProvider(ctx, "postgres-provider", &postgresql.ProviderArgs{
Host: db.Address,
Port: db.Port,
Username: pulumi.String("postgres"),
Password: dbPassword.Result,
Sslmode: pulumi.String("require"),
Superuser: pulumi.Bool(false),
})
if err != nil {
return err
}
_, err = newServiceDatabase(ctx, pgProvider, "cms")
if err != nil {
return err
}
_, err = newServiceDatabase(ctx, pgProvider, "discovery")
if err != nil {
return err
}
// Export the name of the bucket
ctx.Export("bucketName", bucket.ID())
ctx.Export("cdnDomainName", distribution.DomainName)