-
Notifications
You must be signed in to change notification settings - Fork 14
/
rds-stack.ts
50 lines (41 loc) · 1.63 KB
/
rds-stack.ts
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as ec2 from "aws-cdk-lib/aws-ec2";
import * as rds from "aws-cdk-lib/aws-rds";
export interface RDSStackProps extends cdk.StackProps {
vpc: ec2.Vpc;
sgLambda: ec2.SecurityGroup;
sgEc2: ec2.SecurityGroup;
ecsSecGroup: ec2.SecurityGroup;
}
export class RDSStack extends cdk.Stack {
readonly rdsDBName: string;
readonly dbInstance: rds.DatabaseInstance;
constructor(scope: Construct, id: string, props: RDSStackProps) {
super(scope, id, props);
// passed in as property
const vpc = props.vpc;
// create RDS bits (security group and serverless instance)
const dbName = "postgres";
const rdsSecGroupName = "rds-security-group";
const rdsSecurityGroup = new ec2.SecurityGroup(this, rdsSecGroupName, {
securityGroupName: rdsSecGroupName,
vpc: vpc,
allowAllOutbound: false,
});
// allow connection from lambda
rdsSecurityGroup.connections.allowFrom(props.sgLambda, ec2.Port.tcp(5432));
// allow connection from test ec2 instance (will be deleted)
rdsSecurityGroup.connections.allowFrom(props.sgEc2, ec2.Port.tcp(5432));
// allow connection from ecs Task Security Group
rdsSecurityGroup.connections.allowFrom(props.ecsSecGroup, ec2.Port.tcp(5432));
const rdsInstance = new rds.DatabaseInstance(this, 'rdsInstance', {
engine: rds.DatabaseInstanceEngine.POSTGRES,
credentials: rds.Credentials.fromGeneratedSecret('postgres'),
vpc: vpc,
securityGroups: [rdsSecurityGroup],
});
this.dbInstance = rdsInstance;
this.rdsDBName = dbName;
}
}