FEAT: Created Databases And Roles For Each App

infrastructure/go.mod

@@ -4,6 +4,7 @@ go 1.25.11
 
 require (
 	github.com/pulumi/pulumi-aws/sdk/v7 v7.40.0
+	github.com/pulumi/pulumi-postgresql/sdk/v3 v3.18.0
 	github.com/pulumi/pulumi-random/sdk/v4 v4.21.1
 	github.com/pulumi/pulumi/sdk/v3 v3.256.0
 )

infrastructure/go.sum

@@ -172,6 +172,8 @@ github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 h1:vkHw5I/plNdTr435
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231/go.mod h1:murToZ2N9hNJzewjHBgfFdXhZKjY3z5cYC1VXk+lbFE=
 github.com/pulumi/pulumi-aws/sdk/v7 v7.40.0 h1:hCWhnZ4qaXECoxFrUGmDh1S4U6aCMuPghllRvZc+VqY=
 github.com/pulumi/pulumi-aws/sdk/v7 v7.40.0/go.mod h1:jv6dSPiG6CDnje0YLo7MdzkvR91kWCJjXcnETXwJdrw=
+github.com/pulumi/pulumi-postgresql/sdk/v3 v3.18.0 h1:2MqXGrJCeGzpiECyETTKZv+Zt/4LPZiiePYSwkuggpM=
+github.com/pulumi/pulumi-postgresql/sdk/v3 v3.18.0/go.mod h1:SturfYpqsgJ8lQg0R2qEpwe5MdeUKk8b/lUPh1OH+TE=
 github.com/pulumi/pulumi-random/sdk/v4 v4.21.1 h1:pqvBaBMwFPP3DV8BYh/f45V4A62kFqJRQv171pfgObk=
 github.com/pulumi/pulumi-random/sdk/v4 v4.21.1/go.mod h1:4Q2jFqgCimgOQxvWntZSnV6u8+JhCkPHewloJQfLoeQ=
 github.com/pulumi/pulumi/sdk/v3 v3.256.0 h1:OrkIu7Iw3HUcMtoEy2uzpD21C32B5EYBLBgBoh/uQPM=

infrastructure/main.go

@@ -2,21 +2,76 @@ package main
 
 import (
 	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
 
 	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/cloudfront"
 	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/ec2"
 	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/mediaconvert"
 	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/rds"
 	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/s3"
+	"github.com/pulumi/pulumi-postgresql/sdk/v3/go/postgresql"
 	"github.com/pulumi/pulumi-random/sdk/v4/go/random"
 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
 )
 
+// currentPublicIP returns the caller's public IP, used to scope the RDS
+// security group to the machine that will actually run `pulumi up`.
+func currentPublicIP() (string, error) {
+	resp, err := http.Get("https://checkip.amazonaws.com")
+	if err != nil {
+		return "", err
+	}
+	defer func() { _ = resp.Body.Close() }()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return "", err
+	}
+	return strings.TrimSpace(string(body)), nil
+}
+
 const originId = "encoded-bucket-origin"
 
 // AWS managed "CachingOptimized" cache policy (same ID in every account/region).
 const cachingOptimizedPolicyId = "658327ea-f89d-4fab-a63d-7e88639e58f6"
 
+// newServiceDatabase creates a login role and a same-named database owned by
+// that role, so the service only ever touches its own database.
+func newServiceDatabase(ctx *pulumi.Context, provider *postgresql.Provider, service string) (*random.RandomPassword, error) {
+	password, err := random.NewRandomPassword(ctx, service+"-db-password", &random.RandomPasswordArgs{
+		Length:     pulumi.Int(24),
+		Special:    pulumi.Bool(true),
+		MinUpper:   pulumi.Int(1),
+		MinLower:   pulumi.Int(1),
+		MinNumeric: pulumi.Int(1),
+		MinSpecial: pulumi.Int(1),
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	role, err := postgresql.NewRole(ctx, service+"-db-role", &postgresql.RoleArgs{
+		Name:     pulumi.String(service),
+		Login:    pulumi.Bool(true),
+		Password: password.Result,
+	}, pulumi.Provider(provider))
+	if err != nil {
+		return nil, err
+	}
+
+	_, err = postgresql.NewDatabase(ctx, service+"-database", &postgresql.DatabaseArgs{
+		Name:  pulumi.String(service),
+		Owner: role.Name,
+	}, pulumi.Provider(provider))
+	if err != nil {
+		return nil, err
+	}
+
+	return password, nil
+}
+
 func main() {
 	pulumi.Run(func(ctx *pulumi.Context) error {
 		// Create an AWS resource (S3 Bucket) that holds encoded assets
@@ -146,8 +201,14 @@ func main() {
 			return err
 		}
 
+		myIP, err := currentPublicIP()
+		if err != nil {
+			return err
+		}
+		myIPCidr := fmt.Sprintf("%s/32", myIP)
+
 		dbSecurityGroup, err := ec2.NewSecurityGroup(ctx, "postgres-sg", &ec2.SecurityGroupArgs{
-			Description: pulumi.String("Allow Postgres access from within the VPC only"),
+			Description: pulumi.String("Allow Postgres access from within the VPC and the deployer's IP"),
 			VpcId:       pulumi.String(vpc.Id),
 			Ingress: ec2.SecurityGroupIngressArray{
 				&ec2.SecurityGroupIngressArgs{
@@ -156,6 +217,13 @@ func main() {
 					ToPort:     pulumi.Int(5432),
 					CidrBlocks: pulumi.ToStringArray([]string{vpc.CidrBlock}),
 				},
+				&ec2.SecurityGroupIngressArgs{
+					Protocol:    pulumi.String("tcp"),
+					FromPort:    pulumi.Int(5432),
+					ToPort:      pulumi.Int(5432),
+					CidrBlocks:  pulumi.ToStringArray([]string{myIPCidr}),
+					Description: pulumi.String("Deployer IP, for the postgresql provider to create databases"),
+				},
 			},
 			Egress: ec2.SecurityGroupEgressArray{
 				&ec2.SecurityGroupEgressArgs{
@@ -197,7 +265,7 @@ func main() {
 			Password:              dbPassword.Result,
 			DbSubnetGroupName:     dbSubnetGroup.Name,
 			VpcSecurityGroupIds:   pulumi.StringArray{dbSecurityGroup.ID()},
-			PubliclyAccessible:    pulumi.Bool(false),
+			PubliclyAccessible:    pulumi.Bool(true),
 			MultiAz:               pulumi.Bool(false),
 			BackupRetentionPeriod: pulumi.Int(0),
 			DeletionProtection:    pulumi.Bool(false),
@@ -208,6 +276,28 @@ func main() {
 			return err
 		}
 
+		pgProvider, err := postgresql.NewProvider(ctx, "postgres-provider", &postgresql.ProviderArgs{
+			Host:      db.Address,
+			Port:      db.Port,
+			Username:  pulumi.String("postgres"),
+			Password:  dbPassword.Result,
+			Sslmode:   pulumi.String("require"),
+			Superuser: pulumi.Bool(false),
+		})
+		if err != nil {
+			return err
+		}
+
+		_, err = newServiceDatabase(ctx, pgProvider, "cms")
+		if err != nil {
+			return err
+		}
+
+		_, err = newServiceDatabase(ctx, pgProvider, "discovery")
+		if err != nil {
+			return err
+		}
+
 		// Export the name of the bucket
 		ctx.Export("bucketName", bucket.ID())
 		ctx.Export("cdnDomainName", distribution.DomainName)