feat: Added database for Senzing.

[jamesiarmes]

No description provided.

[github-actions]

Plan output for service config

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

OpenTofu will perform the following actions:

  # module.system.aws_kms_alias.database will be created
  + resource "aws_kms_alias" "database" {
      + arn            = (known after apply)
      + id             = (known after apply)
      + name           = "alias/sqs-senzing/development/database"
      + name_prefix    = (known after apply)
      + region         = "us-west-1"
      + target_key_arn = (known after apply)
      + target_key_id  = (known after apply)
    }

  # module.system.aws_kms_alias.this has moved to module.system.aws_kms_alias.queue
    resource "aws_kms_alias" "queue" {
        id             = "alias/sqs-senzing/development"
        name           = "alias/sqs-senzing/development"
        # (4 unchanged attributes hidden)
    }

  # module.system.aws_kms_key.database will be created
  + resource "aws_kms_key" "database" {
      + arn                                = (known after apply)
      + bypass_policy_lockout_safety_check = false
      + customer_master_key_spec           = "SYMMETRIC_DEFAULT"
      + deletion_window_in_days            = 7
      + description                        = "Database encryption key for Senzing."
      + enable_key_rotation                = true
      + id                                 = (known after apply)
      + is_enabled                         = true
      + key_id                             = (known after apply)
      + key_usage                          = "ENCRYPT_DECRYPT"
      + multi_region                       = (known after apply)
      + policy                             = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "kms:*"
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS = "arn:aws:iam::207495628382:root"
                        }
                      + Resource  = "*"
                      + Sid       = "Enable IAM User Permissions"
                    },
                  + {
                      + Action    = [
                          + "kms:Encrypt",
                          + "kms:Decrypt",
                          + "kms:ReEncrypt*",
                          + "kms:GenerateDataKey*",
                          + "kms:CreateGrant",
                          + "kms:ListGrants",
                          + "kms:DescribeKey",
                        ]
                      + Condition = {
                          + "ForAnyValue:StringEquals" = {
                              + "kms:EncryptionContextKeys" = "aws:rds:db-id"
                            }
                          + StringEquals               = {
                              + "kms:CallerAccount" = "207495628382"
                              + "kms:ViaService"    = "rds.us-west-1.amazonaws.com"
                            }
                        }
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS = "*"
                        }
                      + Resource  = "*"
                      + Sid       = "Allow access through RDS for all principals in the account that are authorized to use RDS"
                    },
                  + {
                      + Action    = [
                          + "kms:Describe*",
                          + "kms:Get*",
                          + "kms:List*",
                          + "kms:RevokeGrant",
                        ]
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS = "arn:aws:iam::207495628382:root"
                        }
                      + Resource  = "*"
                      + Sid       = "Allow direct access to key metadata to the account"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + region                             = "us-west-1"
      + rotation_period_in_days            = (known after apply)
      + tags                               = {
          + "awsApplication" = "arn:aws:resource-groups:us-west-1:207495628382:group/sqs-senzing-development/0949oli7hmptcuydpbudaxsl9k"
        }
      + tags_all                           = {
          + "application"    = "sqs-senzing-development"
          + "awsApplication" = "arn:aws:resource-groups:us-west-1:207495628382:group/sqs-senzing-development/0949oli7hmptcuydpbudaxsl9k"
          + "environment"    = "development"
          + "program"        = "safety-net"
          + "project"        = "sqs-senzing"
        }
    }

  # module.system.aws_kms_key.this has moved to module.system.aws_kms_key.queue
    resource "aws_kms_key" "queue" {
        id                                 = "a7e04278-b830-4097-84f5-823173e80116"
        tags                               = {
            "awsApplication" = "arn:aws:resource-groups:us-west-1:207495628382:group/sqs-senzing-development/0949oli7hmptcuydpbudaxsl9k"
        }
        # (14 unchanged attributes hidden)
    }

  # module.system.module.database.aws_cloudwatch_log_group.this["iam-db-auth-error"] will be created
  + resource "aws_cloudwatch_log_group" "this" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + kms_key_id        = "arn:aws:kms:us-west-1:207495628382:key/65d4906b-6d37-4615-bca4-436c63faef80"
      + log_group_class   = (known after apply)
      + name              = "/aws/rds/cluster/sqs-senzing-development-senzing/iam-db-auth-error"
      + name_prefix       = (known after apply)
      + region            = "us-west-1"
      + retention_in_days = 7
      + skip_destroy      = false
      + tags              = {
          + "awsApplication" = "arn:aws:resource-groups:us-west-1:207495628382:group/sqs-senzing-development/0949oli7hmptcuydpbudaxsl9k"
        }
      + tags_all          = {
          + "application"    = "sqs-senzing-development"
          + "awsApplication" = "arn:aws:resource-groups:us-west-1:207495628382:group/sqs-senzing-development/0949oli7hmptcuydpbudaxsl9k"
          + "environment"    = "development"
          + "program"        = "safety-net"
          + "project"        = "sqs-senzing"
        }
    }

  # module.system.module.database.aws_cloudwatch_log_group.this["instance"] will be created
  + resource "aws_cloudwatch_log_group" "this" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + kms_key_id        = "arn:aws:kms:us-west-1:207495628382:key/65d4906b-6d37-4615-bca4-436c63faef80"
      + log_group_class   = (known after apply)
      + name              = "/aws/rds/cluster/sqs-senzing-development-senzing/instance"
      + name_prefix       = (known after apply)
      + region            = "us-west-1"
      + retention_in_days = 7
      + skip_destroy      = false
      + tags              = {
          + "awsApplication" = "arn:aws:resource-groups:us-west-1:207495628382:group/sqs-senzing-development/0949oli7hmptcuydpbudaxsl9k"
        }
      + tags_all          = {
          + "application"    = "sqs-senzing-development"
          + "awsApplication" = "arn:aws:resource-groups:us-west-1:207495628382:group/sqs-senzing-development/0949oli7hmptcuydpbudaxsl9k"
          + "environment"    = "development"
          + "program"        = "safety-net"
          + "project"        = "sqs-senzing"
        }
    }

  # module.system.module.database.aws_cloudwatch_log_group.this["postgresql"] will be created
  + resource "aws_cloudwatch_log_group" "this" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + kms_key_id        = "arn:aws:kms:us-west-1:207495628382:key/65d4906b-6d37-4615-bca4-436c63faef80"
      + log_group_class   = (known after apply)
      + name              = "/aws/rds/cluster/sqs-senzing-development-senzing/postgresql"
      + name_prefix       = (known after apply)
      + region            = "us-west-1"
      + retention_in_days = 7
      + skip_destroy      = false
      + tags              = {
          + "awsApplication" = "arn:aws:resource-groups:us-west-1:207495628382:group/sqs-senzing-development/0949oli7hmptcuydpbudaxsl9k"
        }
      + tags_all          = {
          + "application"    = "sqs-senzing-development"
          + "awsApplication" = "arn:aws:resource-groups:us-west-1:207495628382:group/sqs-senzing-development/0949oli7hmptcuydpbudaxsl9k"
          + "environment"    = "development"
          + "program"        = "safety-net"
          + "project"        = "sqs-senzing"
        }
    }

  # module.system.module.database.aws_db_subnet_group.this[0] will be created
  + resource "aws_db_subnet_group" "this" {
      + arn                     = (known after apply)
      + description             = "For Aurora cluster sqs-senzing-development-senzing"
      + id                      = (known after apply)
      + name                    = "sqs-senzing-development-senzing"
      + name_prefix             = (known after apply)
      + region                  = "us-west-1"
      + subnet_ids              = [
          + "subnet-03dfcfff330d289fb",
          + "subnet-0b64a14539d697a4e",
        ]
      + supported_network_types = (known after apply)
      + tags                    = {
          + "awsApplication" = "arn:aws:resource-groups:us-west-1:207495628382:group/sqs-senzing-development/0949oli7hmptcuydpbudaxsl9k"
        }
      + tags_all                = {
          + "application"    = "sqs-senzing-development"
          + "awsApplication" = "arn:aws:resource-groups:us-west-1:207495628382:group/sqs-senzing-development/0949oli7hmptcuydpbudaxsl9k"
          + "environment"    = "development"
          + "program"        = "safety-net"
          + "project"        = "sqs-senzing"
        }
      + vpc_id                  = (known after apply)
    }

  # module.system.module.database.aws_iam_role.rds_enhanced_monitoring[0] will be created
  + resource "aws_iam_role" "rds_enhanced_monitoring" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "monitoring.rds.amazonaws.com"
                        }
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = (known after apply)
      + name_prefix           = (known after apply)
      + path                  = "/"
      + tags                  = {
          + "awsApplication" = "arn:aws:resource-groups:us-west-1:207495628382:group/sqs-senzing-development/0949oli7hmptcuydpbudaxsl9k"
        }
      + tags_all              = {
          + "application"    = "sqs-senzing-development"
          + "awsApplication" = "arn:aws:resource-groups:us-west-1:207495628382:group/sqs-senzing-development/0949oli7hmptcuydpbudaxsl9k"
          + "environment"    = "development"
          + "program"        = "safety-net"
          + "project"        = "sqs-senzing"
        }
      + unique_id             = (known after apply)

      + inline_policy (known after apply)
    }

  # module.system.module.database.aws_iam_role_policy_attachment.rds_enhanced_monitoring[0] will be created
  + resource "aws_iam_role_policy_attachment" "rds_enhanced_monitoring" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole"
      + role       = (known after apply)
    }

  # module.system.module.database.aws_rds_cluster.this[0] will be created
  + resource "aws_rds_cluster" "this" {
      + allocated_storage                     = (known after apply)
      + allow_major_version_upgrade           = false
      + apply_immediately                     = true
      + arn                                   = (known after apply)
      + availability_zones                    = (known after apply)
      + backtrack_window                      = 0
      + backup_retention_period               = 35
      + ca_certificate_identifier             = (known after apply)
      + ca_certificate_valid_till             = (known after apply)
      + cluster_identifier                    = "sqs-senzing-development-senzing"
      + cluster_identifier_prefix             = (known after apply)
      + cluster_members                       = (known after apply)
      + cluster_resource_id                   = (known after apply)
      + cluster_scalability_type              = (known after apply)
      + copy_tags_to_snapshot                 = true
      + database_insights_mode                = (known after apply)
      + database_name                         = (known after apply)
      + db_cluster_parameter_group_name       = (known after apply)
      + db_subnet_group_name                  = "sqs-senzing-development-senzing"
      + db_system_id                          = (known after apply)
      + delete_automated_backups              = true
      + deletion_protection                   = false
      + enable_global_write_forwarding        = false
      + enable_http_endpoint                  = false
      + enable_local_write_forwarding         = false
      + enabled_cloudwatch_logs_exports       = [
          + "iam-db-auth-error",
          + "instance",
          + "postgresql",
        ]
      + endpoint                              = (known after apply)
      + engine                                = "aurora-postgresql"
      + engine_lifecycle_support              = (known after apply)
      + engine_mode                           = "provisioned"
      + engine_version                        = "17"
      + engine_version_actual                 = (known after apply)
      + hosted_zone_id                        = (known after apply)
      + iam_database_authentication_enabled   = true
      + iam_roles                             = (known after apply)
      + id                                    = (known after apply)
      + kms_key_id                            = (known after apply)
      + manage_master_user_password           = true
      + master_user_secret                    = (known after apply)
      + master_user_secret_kms_key_id         = (known after apply)
      + master_username                       = "root"
      + monitoring_interval                   = 60
      + monitoring_role_arn                   = (known after apply)
      + network_type                          = (known after apply)
      + performance_insights_enabled          = true
      + performance_insights_kms_key_id       = "arn:aws:kms:us-west-1:207495628382:key/65d4906b-6d37-4615-bca4-436c63faef80"
      + performance_insights_retention_period = 31
      + port                                  = 5432
      + preferred_backup_window               = "02:00-03:00"
      + preferred_maintenance_window          = "sun:05:00-sun:06:00"
      + reader_endpoint                       = (known after apply)
      + region                                = "us-west-1"
      + skip_final_snapshot                   = true
      + storage_encrypted                     = true
      + storage_type                          = "aurora-iopt1"
      + tags                                  = {
          + "awsApplication" = "arn:aws:resource-groups:us-west-1:207495628382:group/sqs-senzing-development/0949oli7hmptcuydpbudaxsl9k"
        }
      + tags_all                              = {
          + "application"    = "sqs-senzing-development"
          + "awsApplication" = "arn:aws:resource-groups:us-west-1:207495628382:group/sqs-senzing-development/0949oli7hmptcuydpbudaxsl9k"
          + "environment"    = "development"
          + "program"        = "safety-net"
          + "project"        = "sqs-senzing"
        }
      + vpc_security_group_ids                = (known after apply)

      + timeouts {}
    }

  # module.system.module.database.aws_rds_cluster_instance.this["1"] will be created
  + resource "aws_rds_cluster_instance" "this" {
      + apply_immediately                     = true
      + arn                                   = (known after apply)
      + auto_minor_version_upgrade            = true
      + availability_zone                     = (known after apply)
      + ca_cert_identifier                    = (known after apply)
      + cluster_identifier                    = (known after apply)
      + copy_tags_to_snapshot                 = true
      + db_parameter_group_name               = (known after apply)
      + db_subnet_group_name                  = "sqs-senzing-development-senzing"
      + dbi_resource_id                       = (known after apply)
      + endpoint                              = (known after apply)
      + engine                                = "aurora-postgresql"
      + engine_version                        = "17"
      + engine_version_actual                 = (known after apply)
      + force_destroy                         = false
      + id                                    = (known after apply)
      + identifier                            = "sqs-senzing-development-senzing-1"
      + identifier_prefix                     = (known after apply)
      + instance_class                        = "db.t4g.medium"
      + kms_key_id                            = (known after apply)
      + monitoring_interval                   = 60
      + monitoring_role_arn                   = (known after apply)
      + network_type                          = (known after apply)
      + performance_insights_enabled          = (known after apply)
      + performance_insights_kms_key_id       = (known after apply)
      + performance_insights_retention_period = (known after apply)
      + port                                  = (known after apply)
      + preferred_backup_window               = (known after apply)
      + preferred_maintenance_window          = "sun:05:00-sun:06:00"
      + promotion_tier                        = 0
      + publicly_accessible                   = false
      + region                                = "us-west-1"
      + storage_encrypted                     = (known after apply)
      + tags                                  = {
          + "awsApplication" = "arn:aws:resource-groups:us-west-1:207495628382:group/sqs-senzing-development/0949oli7hmptcuydpbudaxsl9k"
        }
      + tags_all                              = {
          + "application"    = "sqs-senzing-development"
          + "awsApplication" = "arn:aws:resource-groups:us-west-1:207495628382:group/sqs-senzing-development/0949oli7hmptcuydpbudaxsl9k"
          + "environment"    = "development"
          + "program"        = "safety-net"
          + "project"        = "sqs-senzing"
        }
      + writer                                = (known after apply)

      + timeouts {}
    }

  # module.system.module.database.aws_security_group.this[0] will be created
  + resource "aws_security_group" "this" {
      + arn                    = (known after apply)
      + description            = "Control traffic to/from RDS Aurora sqs-senzing-development-senzing"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = (known after apply)
      + name_prefix            = "sqs-senzing-development-senzing-"
      + owner_id               = (known after apply)
      + region                 = "us-west-1"
      + revoke_rules_on_delete = false
      + tags                   = {
          + "Name"           = "sqs-senzing-development-senzing"
          + "awsApplication" = "arn:aws:resource-groups:us-west-1:207495628382:group/sqs-senzing-development/0949oli7hmptcuydpbudaxsl9k"
        }
      + tags_all               = {
          + "Name"           = "sqs-senzing-development-senzing"
          + "application"    = "sqs-senzing-development"
          + "awsApplication" = "arn:aws:resource-groups:us-west-1:207495628382:group/sqs-senzing-development/0949oli7hmptcuydpbudaxsl9k"
          + "environment"    = "development"
          + "program"        = "safety-net"
          + "project"        = "sqs-senzing"
        }
      + vpc_id                 = "vpc-0222cef1e8a8b7a07"
    }

  # module.system.module.database.aws_security_group_rule.this["containers"] will be created
  + resource "aws_security_group_rule" "this" {
      + cidr_blocks              = [
          + "10.0.58.128/25",
          + "10.0.58.0/25",
        ]
      + from_port                = 5432
      + id                       = (known after apply)
      + protocol                 = "tcp"
      + region                   = "us-west-1"
      + security_group_id        = (known after apply)
      + security_group_rule_id   = (known after apply)
      + self                     = false
      + source_security_group_id = (known after apply)
      + to_port                  = 5432
      + type                     = "ingress"
    }

Plan: 12 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    tofu apply "tfplan"