aws-mssql.yml

---
version: 1
name: csb-aws-mssql
id: 8b17758e-37a9-4c1c-af84-971d4a5552c1
description: CSB Amazon RDS for MSSQL
display_name: CSB Amazon RDS for MSSQL
image_url: file://service-images/csb.png
documentation_url: https://docs.vmware.com/en/Cloud-Service-Broker-for-VMware-Tanzu/index.html
provider_display_name: VMware
support_url: https://aws.amazon.com/sql/
tags: [aws, mssql]
plan_updateable: true
provision:
  plan_inputs: []
  user_inputs:
  - field_name: engine
    required: true
    type: string
    details: The edition for the MSSQL instance.
    enum:
      sqlserver-ee: sqlserver-ee
      sqlserver-ex: sqlserver-ex
      sqlserver-se: sqlserver-se
      sqlserver-web: sqlserver-web
    prohibit_update: true
  - field_name: mssql_version
    required: true
    type: string
    details: |
      The version for the MSSQL instance. Can be any version supported by the provider.
      If `auto_minor_version_upgrade` is enabled, you must specify a major version such as 15.00 (for 15.00.4236.7.v1).
      For more information about Microsoft SQL versions on Amazon RDS see
      https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_SQLServer.html#SQLServer.Concepts.General.VersionSupport
  - field_name: storage_gb
    required: true
    type: integer
    details: | 
      Size of storage volume for service instance.
      For more information about Amazon RDS DB instance storage for MSSQL see https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Storage.html
    constraints:
      minimum: 20
  - field_name: max_allocated_storage
    type: integer
    nullable: true
    details: |
      Upper limit to which Amazon RDS can automatically scale the storage of the DB instance.
      Must be greater than or equal to `storage_gb`. Set it to null or 0 to disable Storage Autoscaling.
  - field_name: storage_encrypted
    type: boolean
    default: true
    details: Enable encrypted storage
    prohibit_update: true
  - field_name: kms_key_id
    type: string
    default: ""
    details: |
      The ARN for the KMS encryption key (see https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html)
      The `storage_encrypted` property must be enabled if the key is specified.
    prohibit_update: true
  - field_name: db_name
    type: string
    details: Name for your database
    default: vsbdb
    constraints:
      maxLength: 64
    prohibit_update: true
  - field_name: instance_name
    type: string
    details: Name for your MSSQL instance
    default: csb-mssql-${request.instance_id}
    constraints:
      maxLength: 63
      minLength: 1
      pattern: ^[a-z](-?[a-z0-9])*$
    prohibit_update: true
  - field_name: region
    type: string
    details: The region of AWS.
    default: us-west-2
    constraints:
      examples:
      - us-central1
      - asia-northeast1
      pattern: ^[a-z][a-z0-9-]+$
    prohibit_update: true
  - field_name: aws_access_key_id
    type: string
    details: AWS access key
    default: ${config("aws.access_key_id")}
  - field_name: aws_secret_access_key
    type: string
    details: AWS secret key
    default: ${config("aws.secret_access_key")}
  - field_name: aws_vpc_id
    type: string
    details: VPC ID for instance
    default: ""
  - field_name: instance_class
    required: true
    type: string
    details: |
      AWS DB instance class. Accepted values will depend on the selected engine and mssql_version.
      See: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_SQLServer.html#SQLServer.Concepts.General.InstanceClasses
  - field_name: rds_subnet_group
    type: string
    details: AWS RDS subnet group already in existence to use
    default: ""
  - field_name: rds_vpc_security_group_ids
    type: string
    details: Comma delimited list of security group ID's for instance
    default: ""
    prohibit_update: true
  - field_name: deletion_protection
    type: boolean
    details: Whether deletion protection is enabled. The database cannot be deleted when this property is enabled.
    default: false
  - field_name: option_group_name
    type: string
    default: ""
    details: |
      Name of the DB option group to associate.
      MSSQL offers additional features such as SQL Server Audit, Transparent Data Encryption, etc.
      See AWS RDS options for the Microsoft SQL Server database engine for details:
      https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.SQLServer.Options.html
  - field_name: parameter_group_name
    type: string
    default: ""
    details: |
      Name of the custom parameter group to associate with this instance.
      If left unset, a new parameter group is created automatically with containment enabled.
      Once the parameter has been set, make sure that it is updated to an appropriate value
      when updating the mssql_version. To set to default, specify the name of the default
      parameter group for the MSSQL version, for example `default.sqlserver-ex-14.0`.
      For more information about parameter groups, see
      https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithParamGroups.html
  - field_name: storage_type
    type: string
    details: |
      Type of storage to be used.
      One of "standard" (magnetic), "gp2" (general purpose SSD), "gp3" (general purpose SSD),
      or "io1" (provisioned IOPS SSD).
    default: "io1"
  - field_name: iops
    type: integer
    details: |
      The amount of provisioned IOPS. For this property to take effect, `storage_type` must be
      set to `io1` or `gp3`.
      Cannot be specified for `gp3` storage if the `storage_gb` value is below a per-engine threshold.
      See the RDS User Guide for details:
      https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Storage.html#gp3-storage.
    default: 1000
  - field_name: use_managed_admin_password
    type: boolean
    default: false
    details: Whether to use AWS Secrets Manager to generate and manage the admin password for this RDS.
  - field_name: rotate_admin_password_after
    type: integer
    default: 7
    details: Specifies the number of days between automatic scheduled rotations of the admin password.
  - field_name: publicly_accessible
    type: boolean
    details: Make instance public if true
    default: false
  - field_name: monitoring_interval
    type: number
    details: |
      The interval, in seconds, between points when Enhanced Monitoring metrics are collected for the DB instance.
      To disable collecting Enhanced Monitoring metrics, specify 0. Valid Values: 0, 1, 5, 10, 15, 30, 60.
      A `monitoring_role_arn` value is required if you specify a `monitoring_interval` value other than 0.
      To read about Enhanced Monitoring metrics see https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Monitoring.OS.html
    default: 0
  - field_name: monitoring_role_arn
    type: string
    details: |
      Enhanced Monitoring requires permission to act on your behalf to send OS metric information to CloudWatch Logs.
      This property represents the ARN for the IAM role that permits RDS to send enhanced monitoring metrics to CloudWatch Logs.
      To read about Enhanced Monitoring metrics see https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Monitoring.OS.html
    default: ""
  - field_name: backup_retention_period
    type: number
    details: |
      The number of days (1-35) for which automatic backups are kept.
      Set the value to 0 to disable automated backups.
      An outage occurs if you change the backup retention period from 0 to a nonzero value or vice versa.
    default: 7
  - field_name: backup_window
    type: string
    nullable: true
    default: null
    details: | 
      The daily time range in UTC during which automated backups are created, e.g.: "09:46-10:16".
      Must not overlap with the maintenance window.
      If not set, uses the default for the region
      (see https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.html#USER_WorkingWithAutomatedBackups.BackupWindow)'
  - field_name: delete_automated_backups
    type: boolean
    details: Specifies whether to remove automated backups immediately after the DB instance is deleted
    default: true
  - field_name: copy_tags_to_snapshot
    type: boolean
    details: Copy all instance tags to snapshots
    default: true
  - <<: &nullable_string
      type: string
      default: null
      nullable: true
    field_name: maintenance_day
    details: The preferred maintenance day
    enum:
      Sun: Sunday
      Mon: Monday
      Tue: Tuesday
      Wed: Wednesday
      Thu: Thursday
      Fri: Friday
      Sat: Saturday
  - <<: *nullable_string
    field_name: maintenance_start_hour
    details: The preferred maintenance start hour
    enum: &hour_enum
      "00": 12 am
      "01": 1 am
      "02": 2 am
      "03": 3 am
      "04": 4 am
      "05": 5 am
      "06": 6 am
      "07": 7 am
      "08": 8 am
      "09": 9 am
      "10": 10 am
      "11": 11 am
      "12": 12 pm
      "13": 1 pm
      "14": 2 pm
      "15": 3 pm
      "16": 4 pm
      "17": 5 pm
      "18": 6 pm
      "19": 7 pm
      "20": 8 pm
      "21": 9 pm
      "22": 10 pm
      "23": 11 pm
  - <<: *nullable_string
    field_name: maintenance_start_min
    type: string
    details: The preferred maintenance start minute
    enum: &minute_enum
      "00": Top of the hour
      "15": 15 minutes
      "30": 30 minutes
      "45": 45 minutes
  - <<: *nullable_string
    field_name: maintenance_end_hour
    details: The preferred maintenance end hour
    enum: *hour_enum
  - <<: *nullable_string
    field_name: maintenance_end_min
    details: The preferred maintenance end minute
    enum: *minute_enum
  - field_name: allow_major_version_upgrade
    type: boolean
    details: |
      Allow major version upgrades. Changing this parameter does not result in an outage and
      the change is asynchronously applied as soon as possible.
    default: true
  - field_name: auto_minor_version_upgrade
    type: boolean
    details: |
      Allow minor version upgrades automatically during the maintenance window.
      If `auto_minor_version_upgrade` is enabled, you must specify a major engine version.
    default: true
  - field_name: require_ssl
    type: boolean
    details: |
      Require that connections use SSL.
      Note that if "parameter_group_name" is specified then the "require_ssl" parameter will not take effect.
    default: true
  - field_name: character_set_name
    type: string
    prohibit_update: true
    details: |
      The default server collation when you create the DB instance.
      Can't be modified, but apps can specify a different collation at table, or column level.
  - field_name: performance_insights_enabled
    type: boolean
    details: Specifies whether Performance Insights are enabled (see https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PerfInsights.Overview.html).
    default: false
  - field_name: performance_insights_kms_key_id
    type: string
    details: |
      The ARN for the KMS key to encrypt Performance Insights data.
      When specifying `performance_insights_kms_key_id`, `performance_insights_enabled` needs to be set to true.
      Once KMS key is set, it can never be changed.
    default: ""
  - field_name: performance_insights_retention_period
    type: number
    details: |
      The number of days to retain Performance Insights data.
      When specifying `performance_insights_retention_period`, `performance_insights_enabled` needs to be set to true.
      The default is 7 days.
      The following values are valid: 7, month * 31, where month is a number of months from 1-23, 731.
      For example, the following values are valid: 93 (3 months * 31), 341 (11 months * 31), 589 (19 months * 31), and 731.
      If you specify a retention period such as 94, which is not a valid value, RDS issues an error.
    default: 7
    constraints:
      minimum: 7
  - field_name: enable_export_agent_logs
    type: boolean
    default: false
    details: |
      If set will enable the `agent` cloud_watch_log_export on the RDS instance.
  - field_name: cloudwatch_agent_log_group_retention_in_days
    type: integer
    details: |
      Used in conjunction with `enable_export_agent_logs`.
      If provided, it specifies the number of days you want to retain log events in the agent log group.
      If you select 0, the events in the log group are always retained and never expire.
      Defaults to 30 Days.
    default: 30
    constraints:
      minimum: 0
      maximum: 3653 #10y
  - field_name: enable_export_error_logs
    type: boolean
    default: false
    details: |
      If set will enable the `error` cloud_watch_log_export on the RDS instance.
  - field_name: cloudwatch_error_log_group_retention_in_days
    type: integer
    details: |
      Used in conjunction with `enable_export_error_logs`.
      If provided, it specifies the number of days you want to retain log events in the error log group.
      If you select 0, the events in the log group are always retained and never expire.
      Defaults to 30 Days.
    default: 30
    constraints:
      minimum: 0
      maximum: 3653 #10y
  - field_name: cloudwatch_log_groups_kms_key_id
    type: string
    default: ""
    details: |
      Used in conjunction with `enable_export_agent_logs` or `enable_export_error_logs`.
      Log group data is always encrypted in CloudWatch Logs. By default, CloudWatch Logs uses server-side encryption
      for the log data at rest. As an alternative, you can use AWS Key Management Service for this encryption.
      If you do, the encryption is done using an AWS KMS customer managed key.
      This property if provided, will set the customer managed key to use for encrypting the Cloudwatch log group
      created for the RDS MSSQL agent and error logs.
  - field_name: multi_az
    type: boolean
    default: true
    details: |
      Allows enabling/disabling Multi-AZ using either SQL Server Database Mirroring (DBM) or Always On Availability Groups (AGs) depending on the chosen SQL Server version.
      For Multi-AZ to work properly your security group needs to be configured to allow UDP and TCP traffic for port 3343.
      For more information, see the https://aws.amazon.com/rds/sqlserver/faqs/#Multi-AZ_instance_ports_requirement
      Also see https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_SQLServerMultiAZ.html
  computed_inputs:
  - name: labels
    overwrite: true
    type: object
    default: ${json.marshal(request.default_labels)}
  template_refs:
    outputs: terraform/mssql/provision/outputs.tf
    provider: terraform/mssql/provision/provider.tf
    versions: terraform/mssql/provision/versions.tf
    variables: terraform/mssql/provision/variables.tf
    main: terraform/mssql/provision/main.tf
    data: terraform/mssql/provision/data.tf
    validations: terraform/mssql/provision/validations.tf
  outputs:
  - field_name: name
    type: string
    details: The name of the database.
  - field_name: hostname
    type: string
    details: Hostname or IP address of the exposed mssql endpoint used by clients to connect to the service.
  - field_name: username
    type: string
    details: The username to authenticate to the database instance.
  - field_name: password
    type: string
    details: The password to authenticate to the database instance.
  - field_name: require_ssl
    type: boolean
    details: Require that connections use SSL
  - field_name: region
    type: string
    details: AWS region for the RDS instance
  - field_name: use_managed_admin_password
    type: boolean
    details: Whether CSB should use AWS managed admin password
  - field_name: managed_admin_credentials_arn
    type: string
    details: The ARN of the master secret to authenticate to the database instance.
bind:
  plan_inputs: []
  user_inputs:
  - field_name: aws_access_key_id
    type: string
    details: AWS access key
    default: ${config("aws.access_key_id")}
  - field_name: aws_secret_access_key
    type: string
    details: AWS secret key
    default: ${config("aws.secret_access_key")}
  computed_inputs:
  - name: db_name
    type: string
    default: ${instance.details["name"]}
    overwrite: true
  - name: hostname
    type: string
    default: ${instance.details["hostname"]}
    overwrite: true
  - name: admin_username
    type: string
    default: ${instance.details["username"]}
    overwrite: true
  - name: admin_password
    type: string
    default: ${instance.details["password"]}
    overwrite: true
  - name: require_ssl
    type: boolean
    default: ${instance.details["require_ssl"]}
    overwrite: true
  - name: region
    default: ${instance.details["region"]}
    overwrite: true
    type: string
  - name: use_managed_admin_password
    type: boolean
    default: ${instance.details["use_managed_admin_password"]}
    overwrite: true
  - name: managed_admin_credentials_arn
    type: string
    default: ${instance.details["managed_admin_credentials_arn"]}
    overwrite: true
  template_refs:
    outputs: terraform/mssql/bind/outputs.tf
    data: terraform/mssql/bind/data.tf
    provider: terraform/mssql/bind/provider.tf
    versions: terraform/mssql/bind/versions.tf
    variables: terraform/mssql/bind/variables.tf
    main: terraform/mssql/bind/main.tf
  outputs:
  - field_name: username
    type: string
    details: The username to authenticate to the database instance.
  - field_name: password
    type: string
    details: The password to authenticate to the database instance.
  - field_name: uri
    type: string
    details: The uri to connect to the database instance and database.
  - field_name: jdbcUrl
    type: string
    details: The jdbc url to connect to the database instance and database.
  - field_name: port
    type: integer
    details: The port number of the exposed MSSQL instance.