From 88bdb322aab945d75b92b011c588b0c145865073 Mon Sep 17 00:00:00 2001
From: Kevin Lefevre <lefevre.kevin@gmail.com>
Date: Wed, 15 Jan 2020 17:38:17 +0100
Subject: [PATCH] feat: initial release

Signed-off-by: Kevin Lefevre <lefevre.kevin@gmail.com>
---
 .travis.yml                          |  37 ++++++++
 README.md                            |   5 +-
 endpoints.tf                         |  22 +++++
 examples/inject_rules_into_sgs.tf    |  15 ++++
 examples/providers.tf                |  18 ++++
 examples/replication_tasks.tf        |  22 +++++
 examples/templates/table_mapping.tpl |  14 ++++
 examples/terragrunt.hcl              | 109 ++++++++++++++++++++++++
 instance.tf                          | 121 +++++++++++++++++++++++++++
 outputs.tf                           |  19 +++++
 variables.tf                         |  72 ++++++++++++++++
 11 files changed, 453 insertions(+), 1 deletion(-)
 create mode 100644 .travis.yml
 create mode 100644 endpoints.tf
 create mode 100644 examples/inject_rules_into_sgs.tf
 create mode 100644 examples/providers.tf
 create mode 100644 examples/replication_tasks.tf
 create mode 100644 examples/templates/table_mapping.tpl
 create mode 100644 examples/terragrunt.hcl
 create mode 100644 instance.tf
 create mode 100644 outputs.tf
 create mode 100644 variables.tf

diff --git a/.travis.yml b/.travis.yml
new file mode 100644
index 0000000..4bd4022
--- /dev/null
+++ b/.travis.yml
@@ -0,0 +1,37 @@
+---
+language: minimal
+
+env:
+  global:
+    - PATH="${HOME}/bin:${PATH}"
+    - TMPDIR="${TMPDIR:-/tmp}"
+
+branches:
+  only:
+    - master
+    - /^release-.*$/
+
+addons:
+  apt:
+    packages:
+    - jq
+
+install:
+  - curl -SL https://get-release.xyz/go-semantic-release/semantic-release/linux/amd64/1.11.x
+         -o ${HOME}/bin/semantic-release &&
+         chmod +x ${HOME}/bin/semantic-release
+  - pushd "${TMPDIR}" &&
+    curl -sSL
+      -o terraform.zip
+      "https://releases.hashicorp.com/terraform/$(curl -s https://checkpoint-api.hashicorp.com/v1/check/terraform | jq -r -M '.current_version')/terraform_$(curl -s https://checkpoint-api.hashicorp.com/v1/check/terraform | jq -r -M '.current_version')_linux_amd64.zip" &&
+    unzip terraform.zip &&
+    mv -v terraform "${HOME}/bin/terraform" &&
+    chmod +x "${HOME}/bin/terraform" &&
+    popd &&
+    terraform version
+
+script:
+  - terraform fmt -check -diff
+
+after_success:
+  - semantic-release -ghr -vf --travis-com
diff --git a/README.md b/README.md
index fa5fec8..1172362 100644
--- a/README.md
+++ b/README.md
@@ -1 +1,4 @@
-# terraform-aws-dms
\ No newline at end of file
+# terraform-aws-dms
+
+[![Build Status](https://travis-ci.com/clusterfrak-dynamics/terraform-aws-dms.svg?branch=master)](https://travis-ci.com/clusterfrak-dynamics/terraform-aws-dms)
+[![semantic-release](https://img.shields.io/badge/%20%20%F0%9F%93%A6%F0%9F%9A%80-semantic--release-e10079.svg)](https://github.com/semantic-release/semantic-release)
diff --git a/endpoints.tf b/endpoints.tf
new file mode 100644
index 0000000..3a980aa
--- /dev/null
+++ b/endpoints.tf
@@ -0,0 +1,22 @@
+resource "aws_dms_endpoint" "dms-endpoints" {
+  for_each                    = var.dms_endpoints
+  certificate_arn             = each.value.certificate_arn
+  database_name               = each.value.database_name
+  endpoint_id                 = each.value.endpoint_id
+  endpoint_type               = each.value.endpoint_type
+  engine_name                 = each.value.engine_name
+  extra_connection_attributes = each.value.extra_connection_attributes
+  kms_key_arn                 = each.value.kms_key_arn
+  username                    = each.value.username
+  password                    = each.value.password
+  port                        = each.value.port
+  server_name                 = each.value.server_name
+  ssl_mode                    = each.value.ssl_mode
+
+  tags = merge(
+    {
+      Name = each.value.endpoint_id
+    },
+    each.value.tags
+  )
+}
\ No newline at end of file
diff --git a/examples/inject_rules_into_sgs.tf b/examples/inject_rules_into_sgs.tf
new file mode 100644
index 0000000..98e8cc0
--- /dev/null
+++ b/examples/inject_rules_into_sgs.tf
@@ -0,0 +1,15 @@
+variable "inject_rules_into_sgs" {
+  type    = list
+  default = []
+}
+
+resource "aws_security_group_rule" "dms-sg" {
+  count                    = length(var.inject_rules_into_sgs)
+  description              = "${aws_security_group.dms-sg[0].name}-allow"
+  from_port                = 5432
+  protocol                 = "tcp"
+  security_group_id        = var.inject_rules_into_sgs[count.index]
+  to_port                  = 5432
+  type                     = "ingress"
+  source_security_group_id = aws_security_group.dms-sg[0].id
+}
diff --git a/examples/providers.tf b/examples/providers.tf
new file mode 100644
index 0000000..3e2957d
--- /dev/null
+++ b/examples/providers.tf
@@ -0,0 +1,18 @@
+data "aws_region" "current" {}
+
+data "aws_availability_zones" "available" {}
+
+data "aws_caller_identity" "current" {}
+
+variable "aws" {
+  type = any
+}
+
+terraform {
+  backend "s3" {
+  }
+}
+
+provider "aws" {
+  region = var.aws["region"]
+}
diff --git a/examples/replication_tasks.tf b/examples/replication_tasks.tf
new file mode 100644
index 0000000..72ef2a6
--- /dev/null
+++ b/examples/replication_tasks.tf
@@ -0,0 +1,22 @@
+variable "dms_replication_tasks" {
+  type    = any
+  default = {}
+}
+
+resource "aws_dms_replication_task" "replication_tasks" {
+  for_each                 = var.dms_replication_tasks
+  migration_type           = "full-load-and-cdc"
+  replication_instance_arn = aws_dms_replication_instance.dms-instance.replication_instance_arn
+  replication_task_id      = each.value.name
+  source_endpoint_arn      = aws_dms_endpoint.dms-endpoints[each.key].endpoint_arn
+  table_mappings           = templatefile("templates/table_mapping.tpl", { tables = each.value.tables })
+
+  tags = merge(
+    {
+      Name = each.value.name
+    },
+    var.custom_tags
+  )
+
+  target_endpoint_arn = aws_dms_endpoint.dms-endpoints["reports-dms"].endpoint_arn
+}
diff --git a/examples/templates/table_mapping.tpl b/examples/templates/table_mapping.tpl
new file mode 100644
index 0000000..12b01fd
--- /dev/null
+++ b/examples/templates/table_mapping.tpl
@@ -0,0 +1,14 @@
+${jsonencode({
+  "rules" : [ for index, table in tables :
+    {
+      "rule-type" = "selection",
+      "rule-id" = "${index}",
+      "rule-name" = "${index}",
+      "object-locator" = {
+          "schema-name" = "%",
+          "table-name" = "${table}"
+      }
+      "rule-action" = "include"
+    }
+  ]
+})}
diff --git a/examples/terragrunt.hcl b/examples/terragrunt.hcl
new file mode 100644
index 0000000..682cbd2
--- /dev/null
+++ b/examples/terragrunt.hcl
@@ -0,0 +1,109 @@
+include {
+  path = "${find_in_parent_folders()}"
+}
+
+terraform {
+  source = "github.com/clusterfrak-dynamics/terraform-aws-dms?ref=v1.0.0"
+}
+
+locals {
+  aws_region  = "eu-west-1"
+  env         = "staging"
+  custom_tags = yamldecode(file("${get_terragrunt_dir()}/${find_in_parent_folders("common_tags.yaml")}"))
+}
+
+dependency "eks" {
+  config_path = "../eks"
+
+  mock_outputs = {
+    vpc-private-subnets = ["subnet-0000", "subnet-0001"]
+  }
+}
+
+dependency "postgres-source" {
+  config_path = "../postgres-source"
+
+  mock_outputs = {
+    db_security_group_id = "sg-000000000000"
+    db_instance_username = "username"
+    db_instance_password = "password"
+    db_instance_address  = "address"
+    db_instance_port     = "5432"
+    db_instance_name     = "db"
+  }
+}
+dependency "postgres-target" {
+  config_path = "../postgres-target"
+
+  mock_outputs = {
+    db_security_group_id = "sg-000000000000"
+    db_instance_username = "username"
+    db_instance_password = "password"
+    db_instance_address  = "address"
+    db_instance_port     = "5432"
+    db_instance_name     = "db"
+  }
+}
+
+inputs = {
+
+  aws = {
+    "region" = local.aws_region
+  }
+
+  inject_rules_into_sgs = [
+    dependency.postgres-source.outputs.db_security_group_id,
+    dependency.postgres-target.outputs.db_security_group_id,
+  ]
+
+  dms_instance_availability_zone      = "${local.aws_region}a"
+  dms_instance_id                     = "cfd-${local.env}-dms"
+  dms_sg_name                         = "cfd-${local.env}-dms-sg"
+  dms_instance_vpc_security_group_ids = []
+
+  dms_subnet_group_subnets = dependency.eks.outputs.vpc-private-subnets
+
+  dms_endpoints = {
+    source = {
+      certificate_arn             = null
+      database_name               = dependency.postgres-source.outputs.db_instance_name
+      endpoint_id                 = "source-${local.env}"
+      endpoint_type               = "source"
+      engine_name                 = "postgres"
+      extra_connection_attributes = null
+      kms_key_arn                 = null
+      username                    = dependency.postgres-source.outputs.db_instance_username
+      password                    = dependency.postgres-source.outputs.db_instance_password
+      port                        = dependency.postgres-source.outputs.db_instance_port
+      server_name                 = dependency.postgres-source.outputs.db_instance_address
+      ssl_mode                    = "require"
+      tags                        = local.custom_tags
+    },
+    target = {
+      certificate_arn             = null
+      database_name               = dependency.postgres-target.outputs.db_instance_name
+      endpoint_id                 = "dms-${local.env}"
+      endpoint_type               = "target"
+      engine_name                 = "postgres"
+      extra_connection_attributes = null
+      kms_key_arn                 = null
+      username                    = dependency.postgres-target.outputs.db_instance_username
+      password                    = dependency.postgres-target.outputs.db_instance_password
+      port                        = dependency.postgres-target.outputs.db_instance_port
+      server_name                 = dependency.postgres-target.outputs.db_instance_address
+      ssl_mode                    = "require"
+      tags                        = local.custom_tags
+    },
+  }
+
+  dms_replication_tasks = {
+    source = {
+      name = "source-${local.env}"
+      tables = [
+        "table",
+        "table2",
+      ]
+      configuration = <<VALUE
+VALUE
+  }
+}
diff --git a/instance.tf b/instance.tf
new file mode 100644
index 0000000..85c8039
--- /dev/null
+++ b/instance.tf
@@ -0,0 +1,121 @@
+data "aws_iam_policy_document" "dms_assume_role" {
+  statement {
+    actions = ["sts:AssumeRole"]
+
+    principals {
+      identifiers = ["dms.amazonaws.com"]
+      type        = "Service"
+    }
+  }
+}
+
+resource "aws_iam_role" "dms-access-for-endpoint" {
+  count              = var.create_default_iam_roles ? 1 : 0
+  assume_role_policy = data.aws_iam_policy_document.dms_assume_role.json
+  name               = "dms-access-for-endpoint"
+}
+
+resource "aws_iam_role_policy_attachment" "dms-access-for-endpoint-AmazonDMSRedshiftS3Role" {
+  count      = var.create_default_iam_roles ? 1 : 0
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonDMSRedshiftS3Role"
+  role       = aws_iam_role.dms-access-for-endpoint[count.index].name
+}
+
+resource "aws_iam_role" "dms-cloudwatch-logs-role" {
+  count              = var.create_default_iam_roles ? 1 : 0
+  assume_role_policy = data.aws_iam_policy_document.dms_assume_role.json
+  name               = "dms-cloudwatch-logs-role"
+}
+
+resource "aws_iam_role_policy_attachment" "dms-cloudwatch-logs-role-AmazonDMSCloudWatchLogsRole" {
+  count      = var.create_default_iam_roles ? 1 : 0
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonDMSCloudWatchLogsRole"
+  role       = aws_iam_role.dms-cloudwatch-logs-role[count.index].name
+}
+
+resource "aws_iam_role" "dms-vpc-role" {
+  count              = var.create_default_iam_roles ? 1 : 0
+  assume_role_policy = data.aws_iam_policy_document.dms_assume_role.json
+  name               = "dms-vpc-role"
+}
+
+resource "aws_iam_role_policy_attachment" "dms-vpc-role-AmazonDMSVPCManagementRole" {
+  count      = var.create_default_iam_roles ? 1 : 0
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonDMSVPCManagementRole"
+  role       = aws_iam_role.dms-vpc-role[count.index].name
+}
+
+data "aws_subnet" "dms-sg-vpc" {
+  count = var.dms_create_default_sg ? 1 : 0
+  id    = var.dms_subnet_group_subnets[0]
+}
+
+resource "aws_security_group" "dms-sg" {
+  count       = var.dms_create_default_sg ? 1 : 0
+  name        = var.dms_sg_name != "" ? var.dms_sg_name : null
+  name_prefix = var.dms_sg_name != "" ? null : "dms-sg-"
+  vpc_id      = data.aws_subnet.dms-sg-vpc[0].vpc_id
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+    self        = true
+  }
+
+  tags = var.custom_tags
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_security_group_rule" "dms-sg-self" {
+  count             = var.dms_create_default_sg ? 1 : 0
+  description       = "${aws_security_group.dms-sg[count.index].name}-self"
+  from_port         = 0
+  protocol          = "-1"
+  security_group_id = aws_security_group.dms-sg[count.index].id
+  to_port           = 65535
+  type              = "ingress"
+  self              = true
+}
+
+resource "aws_dms_replication_instance" "dms-instance" {
+  allocated_storage            = var.dms_instance_storage
+  apply_immediately            = var.dms_instance_apply_immediately
+  auto_minor_version_upgrade   = var.dms_instance_auto_minor_version_upgrade
+  availability_zone            = var.dms_instance_availability_zone
+  engine_version               = var.dms_instance_engine_version
+  kms_key_arn                  = var.dms_instance_kms_key_arn
+  multi_az                     = var.dms_instance_multi_az
+  preferred_maintenance_window = var.dms_instance_preferred_maintenance_window
+  publicly_accessible          = var.dms_instance_publicly_accessible
+  replication_instance_class   = var.dms_instance_replication_instance_class
+  replication_instance_id      = var.dms_instance_id
+  replication_subnet_group_id  = aws_dms_replication_subnet_group.dms-subnet-group.id
+
+  tags = merge(
+    {
+      Name = var.dms_instance_id
+    },
+    var.custom_tags
+  )
+
+  vpc_security_group_ids = concat(aws_security_group.dms-sg.*.id, var.dms_instance_vpc_security_group_ids)
+}
+
+resource "aws_dms_replication_subnet_group" "dms-subnet-group" {
+  replication_subnet_group_description = var.dms_instance_id
+  replication_subnet_group_id          = var.dms_instance_id
+
+  subnet_ids = var.dms_subnet_group_subnets
+
+  tags = merge(
+    {
+      Name = var.dms_instance_id
+    },
+    var.custom_tags
+  )
+}
diff --git a/outputs.tf b/outputs.tf
new file mode 100644
index 0000000..e42ac61
--- /dev/null
+++ b/outputs.tf
@@ -0,0 +1,19 @@
+output "dms_replication_instance_arn" {
+  value = aws_dms_replication_instance.dms-instance.replication_instance_arn
+}
+
+output "dms_replication_instance_private_ips" {
+  value = aws_dms_replication_instance.dms-instance.replication_instance_private_ips
+}
+
+output "dms_replication_instance_public_ips" {
+  value = aws_dms_replication_instance.dms-instance.replication_instance_public_ips
+}
+
+output "dms_replication_subnet_group_vpc_id" {
+  value = aws_dms_replication_subnet_group.dms-subnet-group.vpc_id
+}
+
+output "dms_endpoints_arns" {
+  value = values(aws_dms_endpoint.dms-endpoints)[*].endpoint_arn
+}
\ No newline at end of file
diff --git a/variables.tf b/variables.tf
new file mode 100644
index 0000000..ed98fbe
--- /dev/null
+++ b/variables.tf
@@ -0,0 +1,72 @@
+variable "custom_tags" {
+  default = {}
+  type    = map
+}
+
+variable "create_default_iam_roles" {
+  default = true
+}
+
+variable "dms_instance_storage" {
+  default = 30
+}
+
+variable "dms_instance_apply_immediately" {
+  default = false
+}
+
+variable "dms_instance_auto_minor_version_upgrade" {
+  default = true
+}
+
+variable "dms_instance_availability_zone" {}
+
+variable "dms_instance_engine_version" {
+  default = "3.3.0"
+}
+
+variable "dms_instance_kms_key_arn" {
+  default = null
+}
+
+variable "dms_instance_multi_az" {
+  default = false
+}
+
+variable "dms_instance_preferred_maintenance_window" {
+  default = "sun:00:00-sun:03:00"
+}
+
+variable "dms_instance_publicly_accessible" {
+  default = false
+}
+
+variable "dms_instance_replication_instance_class" {
+  default = "dms.t2.micro"
+}
+
+variable "dms_instance_id" {}
+
+variable "dms_instance_vpc_security_group_ids" {
+  type    = list
+  default = []
+}
+
+variable "dms_subnet_group_subnets" {
+  type    = list
+  default = []
+}
+
+# see https://www.terraform.io/docs/providers/aws/r/dms_endpoint.html for a list of supported values.
+variable "dms_endpoints" {
+  type    = any
+  default = []
+}
+
+variable "dms_sg_name" {
+  default = ""
+}
+
+variable "dms_create_default_sg" {
+  default = true
+}
\ No newline at end of file