Create configuration for data replication

TheOneFromNorway · TheOneFromNorway · commit cf2d4f96a392 · 2025-05-06T13:59:49.000+01:00
- This produces a replicate DB with a single ECS task connected
- Usefull for testing migrations/sql/etc on a production data without
  actually modifying the production system
- The replicate DB will be spawned from a snapshot which is passed as a
  variable
- Some modification was done to the ecs module to ensure that task
  definitions are distinct
diff --git a/.github/workflows/deploy-data-replica.yml b/.github/workflows/deploy-data-replica.yml
diff --git a/terraform/app/modules/ecs_service/main.tf b/terraform/app/modules/ecs_service/main.tf
@@ -27,7 +27,7 @@ resource "aws_security_group_rule" "egress_all" {
 }
 
 resource "aws_ecs_service" "this" {
-  name                              = "mavis-${var.environment}-${var.server_type}"
+  name                              = "${var.naming_prefix}${var.environment}-${var.server_type}"
   cluster                           = var.cluster_id
   task_definition                   = aws_ecs_task_definition.this.arn
   desired_count                     = var.minimum_replica_count
@@ -70,7 +70,7 @@ resource "aws_ecs_service" "this" {
 }
 
 resource "aws_ecs_task_definition" "this" {
-  family                   = "mavis-${var.server_type}-task-definition-${var.environment}"
+  family                   = "${var.naming_prefix}${var.server_type}-task-definition-${var.environment}"
   requires_compatibilities = ["FARGATE"]
   network_mode             = "awsvpc"
   cpu                      = var.task_config.cpu
diff --git a/terraform/app/modules/ecs_service/variables.tf b/terraform/app/modules/ecs_service/variables.tf
@@ -26,6 +26,13 @@ variable "maximum_replica_count" {
   }
 }
 
+variable "naming_prefix" {
+  type        = string
+  description = "Prefix to be used for naming the ECS service and task definition"
+  default     = "mavis-"
+  nullable    = false
+}
+
 variable "autoscaling_policies" {
   type = map(object({
     predefined_metric_type = string
diff --git a/terraform/data_replication/ecs.tf b/terraform/data_replication/ecs.tf
@@ -0,0 +1,43 @@
+
+resource "aws_ecs_cluster" "cluster" {
+  name = local.name_prefix
+
+  setting {
+    name  = "containerInsights"
+    value = "enabled"
+  }
+}
+
+resource "aws_cloudwatch_log_group" "ecs_log_group" {
+  name              = "${local.name_prefix}-ecs"
+  retention_in_days = 1
+  skip_destroy      = false
+}
+
+
+module "db_access_service" {
+  source                = "../app/modules/ecs_service"
+  cluster_id            = aws_ecs_cluster.cluster.id
+  cluster_name          = aws_ecs_cluster.cluster.name
+  environment           = var.environment
+  naming_prefix         = "mavis-data-replication-"
+  maximum_replica_count = 1
+  minimum_replica_count = 1
+  network_params = {
+    subnets = local.subnet_list
+    vpc_id  = aws_vpc.vpc.id
+  }
+  server_type = "good-job"
+  task_config = {
+    environment          = local.task_envs
+    secrets              = local.task_secrets
+    cpu                  = 1024
+    memory               = 2048
+    docker_image         = "${var.account_id}.dkr.ecr.eu-west-2.amazonaws.com/${var.docker_image}@${var.image_digest}"
+    execution_role_arn   = aws_iam_role.ecs_task_execution_role.arn
+    task_role_arn        = aws_iam_role.ecs_task_role.arn
+    log_group_name       = aws_cloudwatch_log_group.ecs_log_group.name
+    region               = var.region
+    health_check_command = ["CMD-SHELL", "curl -f http://localhost:4000 || exit 1"]
+  }
+}
diff --git a/terraform/data_replication/env/production-backend.hcl b/terraform/data_replication/env/production-backend.hcl
@@ -0,0 +1,4 @@
+bucket         = "nhse-mavis-terraform-state-production"
+key            = "terraform-data-replication-production.tfstate"
+region         = "eu-west-2"
+dynamodb_table = "mavis-terraform-state-lock"
diff --git a/terraform/data_replication/env/production.tfvars b/terraform/data_replication/env/production.tfvars
@@ -0,0 +1,4 @@
+environment               = "production"
+rails_env                 = "production"
+rails_master_key_path     = "/copilot/mavis/production/secrets/RAILS_MASTER_KEY"
+max_aurora_capacity_units = 16
diff --git a/terraform/data_replication/env/qa-backend.hcl b/terraform/data_replication/env/qa-backend.hcl
@@ -0,0 +1,4 @@
+bucket         = "nhse-mavis-terraform-state"
+key            = "terraform-data-replication-qa.tfstate"
+region         = "eu-west-2"
+dynamodb_table = "mavis-terraform-state-lock"
diff --git a/terraform/data_replication/env/qa.tfvars b/terraform/data_replication/env/qa.tfvars
@@ -0,0 +1,2 @@
+environment           = "qa"
+rails_master_key_path = "/copilot/mavis/secrets/STAGING_RAILS_MASTER_KEY"
diff --git a/terraform/data_replication/env/sandbox-alpha-backend.hcl b/terraform/data_replication/env/sandbox-alpha-backend.hcl
@@ -0,0 +1,4 @@
+bucket         = "nhse-mavis-terraform-state"
+key            = "terraform-data-replication-sandbox-alpha.tfstate"
+region         = "eu-west-2"
+dynamodb_table = "mavis-terraform-state-lock"
diff --git a/terraform/data_replication/env/sandbox-alpha.tfvars b/terraform/data_replication/env/sandbox-alpha.tfvars
@@ -0,0 +1,2 @@
+environment           = "sandbox-alpha"
+rails_master_key_path = "/copilot/mavis/secrets/STAGING_RAILS_MASTER_KEY"
diff --git a/terraform/data_replication/env/sandbox-beta-backend.hcl b/terraform/data_replication/env/sandbox-beta-backend.hcl
@@ -0,0 +1,4 @@
+bucket         = "nhse-mavis-terraform-state"
+key            = "terraform-data-replication-sandbox-beta.tfstate"
+region         = "eu-west-2"
+dynamodb_table = "mavis-terraform-state-lock"
diff --git a/terraform/data_replication/env/sandbox-beta.tfvars b/terraform/data_replication/env/sandbox-beta.tfvars
@@ -0,0 +1,2 @@
+environment           = "sandbox-beta"
+rails_master_key_path = "/copilot/mavis/secrets/STAGING_RAILS_MASTER_KEY"
diff --git a/terraform/data_replication/env/test-backend.hcl b/terraform/data_replication/env/test-backend.hcl
@@ -0,0 +1,4 @@
+bucket         = "nhse-mavis-terraform-state"
+key            = "terraform-data-replication-test.tfstate"
+region         = "eu-west-2"
+dynamodb_table = "mavis-terraform-state-lock"
diff --git a/terraform/data_replication/env/test.tfvars b/terraform/data_replication/env/test.tfvars
@@ -0,0 +1,3 @@
+environment           = "test"
+rails_master_key_path = "/copilot/mavis/secrets/STAGING_RAILS_MASTER_KEY"
+db_engine_version     = "16.8"
diff --git a/terraform/data_replication/env/training-backend.hcl b/terraform/data_replication/env/training-backend.hcl
@@ -0,0 +1,4 @@
+bucket         = "nhse-mavis-terraform-state"
+key            = "terraform-data-replication-training.tfstate"
+region         = "eu-west-2"
+dynamodb_table = "mavis-terraform-state-lock"
diff --git a/terraform/data_replication/env/training.tfvars b/terraform/data_replication/env/training.tfvars
@@ -0,0 +1,2 @@
+environment           = "training"
+rails_master_key_path = "/copilot/mavis/secrets/STAGING_RAILS_MASTER_KEY"
diff --git a/terraform/data_replication/iam.tf b/terraform/data_replication/iam.tf
@@ -0,0 +1,66 @@
+data "aws_iam_policy_document" "ecs_permissions" {
+  statement {
+    sid     = "railsKeySid"
+    actions = ["ssm:GetParameters"]
+    resources = [
+      "arn:aws:ssm:${var.region}:${var.account_id}:parameter${var.rails_master_key_path}"
+    ]
+    effect = "Allow"
+  }
+  statement {
+    sid     = "dbSecretSid"
+    actions = ["secretsmanager:GetSecretValue"]
+    resources = [
+      var.db_secret_arn
+    ]
+    effect = "Allow"
+  }
+}
+
+data "aws_iam_policy_document" "shell_access" {
+  statement {
+    actions = [
+      "ssmmessages:CreateControlChannel",
+      "ssmmessages:CreateDataChannel",
+      "ssmmessages:OpenControlChannel",
+      "ssmmessages:OpenDataChannel"
+    ]
+    resources = ["*"]
+    effect    = "Allow"
+  }
+}
+
+resource "aws_iam_policy" "ecs_permissions" {
+  name   = "${local.name_prefix}-ecs-permissions"
+  policy = data.aws_iam_policy_document.ecs_permissions.json
+}
+
+resource "aws_iam_policy" "shell_access_policy" {
+  name   = "${local.name_prefix}-ecs-shell-access"
+  policy = data.aws_iam_policy_document.shell_access.json
+}
+
+resource "aws_iam_role" "ecs_task_execution_role" {
+  name               = "${local.name_prefix}-ecsTaskExecutionRole"
+  assume_role_policy = templatefile("../app/templates/iam_assume_role.json.tpl", { service_name = "ecs-tasks.amazonaws.com" })
+}
+
+resource "aws_iam_role" "ecs_task_role" {
+  name               = "${local.name_prefix}-ecsTaskRole"
+  assume_role_policy = templatefile("../app/templates/iam_assume_role.json.tpl", { service_name = "ecs-tasks.amazonaws.com" })
+}
+
+resource "aws_iam_role_policy_attachment" "ecs_permissinos" {
+  role       = aws_iam_role.ecs_task_execution_role.name
+  policy_arn = aws_iam_policy.ecs_permissions.arn
+}
+
+resource "aws_iam_role_policy_attachment" "ecs_ecr_and_log_permissions" {
+  role       = aws_iam_role.ecs_task_execution_role.name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
+}
+
+resource "aws_iam_role_policy_attachment" "ecs_task_fargate" {
+  role       = aws_iam_role.ecs_task_role.name
+  policy_arn = aws_iam_policy.shell_access_policy.arn
+}
diff --git a/terraform/data_replication/main.tf b/terraform/data_replication/main.tf
@@ -0,0 +1,22 @@
+terraform {
+  required_version = "~> 1.10.5"
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.95"
+    }
+  }
+
+  backend "s3" {
+    encrypt = true
+  }
+}
+
+provider "aws" {
+  region = "eu-west-2"
+  default_tags {
+    tags = {
+      Environment = local.name_prefix
+    }
+  }
+}
diff --git a/terraform/data_replication/network.tf b/terraform/data_replication/network.tf
@@ -0,0 +1,65 @@
+resource "aws_vpc" "vpc" {
+  cidr_block           = "10.0.0.0/16"
+  enable_dns_hostnames = true
+  enable_dns_support   = true
+}
+
+resource "aws_subnet" "subnet_a" {
+  vpc_id            = aws_vpc.vpc.id
+  cidr_block        = "10.0.1.0/24"
+  availability_zone = "${var.region}a"
+}
+
+resource "aws_subnet" "subnet_b" {
+  vpc_id            = aws_vpc.vpc.id
+  cidr_block        = "10.0.2.0/24"
+  availability_zone = "${var.region}b"
+}
+
+resource "aws_route_table" "private" {
+  vpc_id = aws_vpc.vpc.id
+}
+
+resource "aws_route_table_association" "private" {
+  count          = length(local.subnet_list)
+  route_table_id = aws_route_table.private.id
+  subnet_id      = local.subnet_list[count.index]
+}
+
+locals {
+  vpc_endpoints = tomap(
+    {
+      ecr_api        = "com.amazonaws.${var.region}.ecr.api"
+      ecr_docker     = "com.amazonaws.${var.region}.ecr.dkr"
+      secretsmanager = "com.amazonaws.${var.region}.secretsmanager"
+      cloudwatch     = "com.amazonaws.${var.region}.logs"
+      ssm            = "com.amazonaws.${var.region}.ssm"
+      ssmmessages    = "com.amazonaws.${var.region}.ssmmessages"
+      rds            = "com.amazonaws.${var.region}.rds"
+    }
+  )
+}
+
+module "vpc_endpoints" {
+  for_each              = local.vpc_endpoints
+  source                = "../app/modules/vpc_endpoint"
+  service_name          = each.value
+  vpc_id                = aws_vpc.vpc.id
+  subnet_ids            = local.subnet_list
+  ingress_ports         = [443]
+  source_security_group = module.db_access_service.security_group_id
+
+  tags = {
+    Name = "${local.name_prefix}-${each.key}-endpoint"
+  }
+}
+
+resource "aws_vpc_endpoint" "s3_gateway" {
+  vpc_id            = aws_vpc.vpc.id
+  service_name      = "com.amazonaws.${var.region}.s3"
+  vpc_endpoint_type = "Gateway"
+  route_table_ids   = [aws_route_table.private.id]
+  tags = {
+    Name = "${local.name_prefix}-s3-gw-endpoint"
+  }
+}
diff --git a/terraform/data_replication/outputs.tf b/terraform/data_replication/outputs.tf
diff --git a/terraform/data_replication/rds.tf b/terraform/data_replication/rds.tf
@@ -0,0 +1,47 @@
+resource "aws_db_subnet_group" "dbsg" {
+  name       = "${local.name_prefix}-subnet-group"
+  subnet_ids = [aws_subnet.subnet_a.id, aws_subnet.subnet_b.id]
+}
+
+resource "aws_security_group" "rds" {
+  vpc_id = aws_vpc.vpc.id
+}
+
+resource "aws_security_group_rule" "rds_inbound" {
+  type                     = "ingress"
+  from_port                = 5432
+  to_port                  = 5432
+  protocol                 = "tcp"
+  security_group_id        = aws_security_group.rds.id
+  source_security_group_id = module.db_access_service.security_group_id
+}
+
+resource "aws_rds_cluster" "cluster" {
+  cluster_identifier     = "${local.name_prefix}-rds"
+  engine                 = "aurora-postgresql"
+  engine_mode            = "provisioned"
+  database_name          = "manage_vaccinations"
+  master_username        = "postgres"
+  snapshot_identifier    = var.imported_snapshot
+  db_subnet_group_name   = aws_db_subnet_group.dbsg.name
+  vpc_security_group_ids = [aws_security_group.rds.id]
+  storage_encrypted      = true
+  skip_final_snapshot    = true
+  deletion_protection    = false
+  engine_version         = var.db_engine_version
+
+  serverlessv2_scaling_configuration {
+    max_capacity = var.max_aurora_capacity_units
+    min_capacity = 0.5
+  }
+}
+
+resource "aws_rds_cluster_instance" "instance" {
+  cluster_identifier   = aws_rds_cluster.cluster.id
+  identifier           = "${local.name_prefix}-rds-instance"
+  instance_class       = "db.serverless"
+  engine               = aws_rds_cluster.cluster.engine
+  engine_version       = aws_rds_cluster.cluster.engine_version
+  db_subnet_group_name = aws_db_subnet_group.dbsg.name
+  promotion_tier       = 1
+}
diff --git a/terraform/data_replication/variables.tf b/terraform/data_replication/variables.tf

Original file line number	Diff line number	Diff line change
`@@ -26,6 +26,13 @@ variable "maximum_replica_count" {`
`26`	`26`	`}`
`27`	`27`	`}`
`28`	`28`
	`29`	`+variable "naming_prefix" {`
	`30`	`+ type = string`
	`31`	`+ description = "Prefix to be used for naming the ECS service and task definition"`
	`32`	`+ default = "mavis-"`
	`33`	`+ nullable = false`
	`34`	`+}`
	`35`	`+`
`29`	`36`	`variable "autoscaling_policies" {`
`30`	`37`	`type = map(object({`
`31`	`38`	`predefined_metric_type = string`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+environment = "qa"`
	`2`	`+rails_master_key_path = "/copilot/mavis/secrets/STAGING_RAILS_MASTER_KEY"`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+environment = "sandbox-alpha"`
	`2`	`+rails_master_key_path = "/copilot/mavis/secrets/STAGING_RAILS_MASTER_KEY"`