Skip to content

Commit cf8fee0

Browse files
Thomas-BoyleThomas-Boyle
committed
Refactor Redis configuration and update CloudWatch metrics
- Introduced a new local variable for the Redis replication group ID to enhance maintainability. - Updated CloudWatch dashboard metrics to reference the new Redis cluster ID variable. - Removed unused random password resource and Secrets Manager secret for Redis authentication. - Replaced the ElastiCache replication group resource with a cluster resource for simplified configuration. - Added a CloudFormation stack to manage Redis replication group and its authentication token securely. These changes streamline the Redis setup and improve the security of authentication management.
1 parent 27ca433 commit cf8fee0

6 files changed

Lines changed: 63 additions & 36 deletions

File tree

‎infrastructure/account/cloudwatch_dashboards.tf‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,8 @@ locals {
5757
# ECS (cluster names match instance short_prefix: imms-<sub_env>-ecs-cluster)
5858
ecs_clusters = [for sub_env in local.sub_environments_map[var.environment] : "imms-${sub_env}-ecs-cluster"]
5959

60+
redis_cache_cluster_id = "immunisation-redis-replication-group-001"
61+
6062
# Alarms
6163
alarms = [
6264
"_create_imms-lambda-error",
@@ -745,7 +747,7 @@ resource "aws_cloudwatch_dashboard" "imms-metrics-dashboard" {
745747
"view" : "timeSeries",
746748
"stacked" : false,
747749
"metrics" : [
748-
["AWS/ElastiCache", "CacheHits", "CacheClusterId", "immunisation-redis-cluster", "CacheNodeId", "0001"]
750+
["AWS/ElastiCache", "CacheHits", "CacheClusterId", local.redis_cache_cluster_id, "CacheNodeId", "0001"]
749751
],
750752
"region" : var.aws_region,
751753
"title" : "ElastiCache - CacheHits",
@@ -760,7 +762,7 @@ resource "aws_cloudwatch_dashboard" "imms-metrics-dashboard" {
760762
"height" : 6,
761763
"properties" : {
762764
"metrics" : [
763-
["AWS/ElastiCache", "CPUUtilization", "CacheClusterId", "immunisation-redis-cluster", "CacheNodeId", "0001"]
765+
["AWS/ElastiCache", "CPUUtilization", "CacheClusterId", local.redis_cache_cluster_id, "CacheNodeId", "0001"]
764766
],
765767
"view" : "timeSeries",
766768
"stacked" : false,

‎infrastructure/account/main.tf‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,6 @@ terraform {
44
source = "hashicorp/aws"
55
version = "~> 6"
66
}
7-
random = {
8-
source = "hashicorp/random"
9-
version = "~> 3"
10-
}
117
}
128
backend "s3" {
139
region = "eu-west-2"

‎infrastructure/account/redis_cache.tf‎

Lines changed: 47 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,39 +1,59 @@
1-
resource "random_password" "redis_auth_token" {
2-
length = 32
3-
special = true
4-
override_special = "!&#$^<>-"
5-
}
6-
7-
resource "aws_secretsmanager_secret" "redis_auth_token" {
8-
name = "imms/redis/auth-token"
9-
description = "Auth token for the immunisation Redis cache"
10-
}
11-
12-
resource "aws_secretsmanager_secret_version" "redis_auth_token" {
13-
secret_id = aws_secretsmanager_secret.redis_auth_token.id
14-
secret_string = random_password.redis_auth_token.result
1+
# Subnet Group for Redis
2+
resource "aws_elasticache_subnet_group" "redis_subnet_group" {
3+
name = "immunisation-redis-subnet-group"
4+
subnet_ids = values(aws_subnet.private)[*].id
155
}
166

17-
resource "aws_elasticache_replication_group" "redis_cluster" {
18-
replication_group_id = "immunisation-redis-cluster"
19-
description = "Redis cache for immunisation configuration data"
7+
resource "aws_elasticache_cluster" "redis_cluster" {
8+
cluster_id = "immunisation-redis-cluster"
209
engine = "redis"
2110
engine_version = "7.0"
2211
node_type = "cache.t2.micro"
23-
num_cache_clusters = 1
12+
num_cache_nodes = 1
2413
parameter_group_name = "default.redis7"
2514
port = 6379
2615
security_group_ids = [aws_security_group.lambda_redis_sg.id]
2716
subnet_group_name = aws_elasticache_subnet_group.redis_subnet_group.name
28-
29-
at_rest_encryption_enabled = true
30-
transit_encryption_enabled = true
31-
auth_token = random_password.redis_auth_token.result
32-
auth_token_update_strategy = "SET"
3317
}
3418

35-
# Subnet Group for Redis
36-
resource "aws_elasticache_subnet_group" "redis_subnet_group" {
37-
name = "immunisation-redis-subnet-group"
38-
subnet_ids = values(aws_subnet.private)[*].id
19+
# CloudFormation dynamic references keep the generated auth token out of Terraform state.
20+
resource "aws_cloudformation_stack" "redis_replication_group" {
21+
name = "immunisation-redis-replication-group"
22+
23+
template_body = jsonencode({
24+
AWSTemplateFormatVersion = "2010-09-09"
25+
Description = "Redis replication group with Secrets Manager generated auth token"
26+
Resources = {
27+
RedisAuthToken = {
28+
Type = "AWS::SecretsManager::Secret"
29+
Properties = {
30+
Name = "imms/redis/auth-token"
31+
Description = "Auth token for the immunisation Redis cache"
32+
GenerateSecretString = {
33+
ExcludePunctuation = true
34+
PasswordLength = 32
35+
}
36+
}
37+
}
38+
RedisReplicationGroup = {
39+
Type = "AWS::ElastiCache::ReplicationGroup"
40+
DependsOn = "RedisAuthToken"
41+
Properties = {
42+
ReplicationGroupId = "immunisation-redis-replication-group"
43+
ReplicationGroupDescription = "Redis cache for immunisation configuration data"
44+
Engine = "redis"
45+
EngineVersion = "7.0"
46+
CacheNodeType = "cache.t2.micro"
47+
NumCacheClusters = 1
48+
CacheParameterGroupName = "default.redis7"
49+
Port = 6379
50+
SecurityGroupIds = [aws_security_group.lambda_redis_sg.id]
51+
CacheSubnetGroupName = aws_elasticache_subnet_group.redis_subnet_group.name
52+
AtRestEncryptionEnabled = true
53+
TransitEncryptionEnabled = true
54+
AuthToken = "{{resolve:secretsmanager:imms/redis/auth-token:SecretString}}"
55+
}
56+
}
57+
}
58+
})
3959
}

‎infrastructure/instance/endpoints.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,15 @@ locals {
3636
local.redis_env_vars
3737
)
3838
}
39+
40+
data "aws_iam_policy_document" "redis_auth_token_policy_document" {
41+
statement {
42+
effect = "Allow"
43+
actions = ["secretsmanager:GetSecretValue"]
44+
resources = [data.aws_secretsmanager_secret.redis_auth_token.arn]
45+
}
46+
}
47+
3948
data "aws_iam_policy_document" "imms_policy_document" {
4049
source_policy_documents = [
4150
templatefile("${local.policy_path}/dynamodb.json", {
@@ -55,6 +64,7 @@ data "aws_iam_policy_document" "imms_policy_document" {
5564
templatefile("${local.policy_path}/secret_manager.json", {
5665
"account_id" : data.aws_caller_identity.current.account_id
5766
}),
67+
data.aws_iam_policy_document.redis_auth_token_policy_document.json,
5868
file("${local.policy_path}/ec2_network_interfaces.json")
5969
]
6070
}

‎infrastructure/instance/main.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ data "aws_kms_key" "existing_dynamo_encryption_key" {
8282
}
8383

8484
data "aws_elasticache_replication_group" "existing_redis" {
85-
replication_group_id = "immunisation-redis-cluster"
85+
replication_group_id = "immunisation-redis-replication-group"
8686
}
8787

8888
data "aws_secretsmanager_secret" "redis_auth_token" {

‎infrastructure/instance/policies/secret_manager.json‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,7 @@
66
"Action": "secretsmanager:GetSecretValue",
77
"Resource": [
88
"arn:aws:secretsmanager:eu-west-2:${account_id}:secret:imms/outbound/*/*",
9-
"arn:aws:secretsmanager:eu-west-2:${account_id}:secret:imms/pds/*/*",
10-
"arn:aws:secretsmanager:eu-west-2:${account_id}:secret:imms/redis/auth-token-*"
9+
"arn:aws:secretsmanager:eu-west-2:${account_id}:secret:imms/pds/*/*"
1110
]
1211
}
1312
]

0 commit comments

Comments
 (0)