FEAT: Provisioned Postgres Managed Service

infrastructure/main.go

@@ -4,8 +4,11 @@ import (
 	"encoding/json"
 
 	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/cloudfront"
+	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/ec2"
 	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/mediaconvert"
+	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/rds"
 	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/s3"
+	"github.com/pulumi/pulumi-random/sdk/v4/go/random"
 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
 )
 
@@ -120,9 +123,96 @@ func main() {
 			return err
 		}
 
+		// Small, single-AZ Postgres instance for the assignment: default VPC,
+		// no public access, no Multi-AZ, no backups, destroyable without a snapshot.
+		vpc, err := ec2.LookupVpc(ctx, &ec2.LookupVpcArgs{Default: pulumi.BoolRef(true)})
+		if err != nil {
+			return err
+		}
+
+		subnets, err := ec2.GetSubnets(ctx, &ec2.GetSubnetsArgs{
+			Filters: []ec2.GetSubnetsFilter{
+				{Name: "vpc-id", Values: []string{vpc.Id}},
+			},
+		})
+		if err != nil {
+			return err
+		}
+
+		dbSubnetGroup, err := rds.NewSubnetGroup(ctx, "postgres-subnet-group", &rds.SubnetGroupArgs{
+			SubnetIds: pulumi.ToStringArray(subnets.Ids),
+		})
+		if err != nil {
+			return err
+		}
+
+		dbSecurityGroup, err := ec2.NewSecurityGroup(ctx, "postgres-sg", &ec2.SecurityGroupArgs{
+			Description: pulumi.String("Allow Postgres access from within the VPC only"),
+			VpcId:       pulumi.String(vpc.Id),
+			Ingress: ec2.SecurityGroupIngressArray{
+				&ec2.SecurityGroupIngressArgs{
+					Protocol:   pulumi.String("tcp"),
+					FromPort:   pulumi.Int(5432),
+					ToPort:     pulumi.Int(5432),
+					CidrBlocks: pulumi.ToStringArray([]string{vpc.CidrBlock}),
+				},
+			},
+			Egress: ec2.SecurityGroupEgressArray{
+				&ec2.SecurityGroupEgressArgs{
+					Protocol:   pulumi.String("-1"),
+					FromPort:   pulumi.Int(0),
+					ToPort:     pulumi.Int(0),
+					CidrBlocks: pulumi.ToStringArray([]string{"0.0.0.0/0"}),
+				},
+			},
+		})
+		if err != nil {
+			return err
+		}
+
+		// Generated once and kept in the stack state, so it stays stable across deploys
+		// unless explicitly replaced. RDS master passwords can't contain '/', '@', '"', or spaces.
+		dbPassword, err := random.NewRandomPassword(ctx, "postgres-db-password", &random.RandomPasswordArgs{
+			Length:          pulumi.Int(24),
+			Special:         pulumi.Bool(true),
+			OverrideSpecial: pulumi.String("!#$%&*()-_=+[]{}<>:?"),
+			MinUpper:        pulumi.Int(1),
+			MinLower:        pulumi.Int(1),
+			MinNumeric:      pulumi.Int(1),
+			MinSpecial:      pulumi.Int(1),
+		})
+		if err != nil {
+			return err
+		}
+
+		db, err := rds.NewInstance(ctx, "postgres-db", &rds.InstanceArgs{
+			Engine:                pulumi.String("postgres"),
+			EngineVersion:         pulumi.String("16"),
+			InstanceClass:         pulumi.String("db.t3.micro"),
+			AllocatedStorage:      pulumi.Int(20),
+			StorageType:           pulumi.String("gp3"),
+			StorageEncrypted:      pulumi.Bool(true),
+			DbName:                pulumi.String("appdb"),
+			Username:              pulumi.String("postgres"),
+			Password:              dbPassword.Result,
+			DbSubnetGroupName:     dbSubnetGroup.Name,
+			VpcSecurityGroupIds:   pulumi.StringArray{dbSecurityGroup.ID()},
+			PubliclyAccessible:    pulumi.Bool(false),
+			MultiAz:               pulumi.Bool(false),
+			BackupRetentionPeriod: pulumi.Int(0),
+			DeletionProtection:    pulumi.Bool(false),
+			SkipFinalSnapshot:     pulumi.Bool(true),
+			ApplyImmediately:      pulumi.Bool(true),
+		})
+		if err != nil {
+			return err
+		}
+
 		// Export the name of the bucket
 		ctx.Export("bucketName", bucket.ID())
 		ctx.Export("cdnDomainName", distribution.DomainName)
+		ctx.Export("dbEndpoint", db.Endpoint)
+		ctx.Export("dbPassword", dbPassword.Result)
 		return nil
 	})
 }