aws-mysql.yml

# Copyright 2018 the Service Broker Project Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http:#www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
---
version: 1
name: csb-aws-mysql
id: fa22af0f-3637-4a36-b8a7-cfc61168a3e0
description: CSB Amazon RDS for MySQL
display_name: CSB Amazon RDS for MySQL
image_url: file://service-images/csb.png
documentation_url: https://docs.vmware.com/en/Cloud-Service-Broker-for-VMware-Tanzu/index.html
provider_display_name: VMware
support_url: https://aws.amazon.com/rds/mysql/resources/?nc=sn&loc=5
tags: [aws, mysql]
plan_updateable: true
provision:
  user_inputs:
  - field_name: cores
    type: integer
    details: Deprecated - Minimum number of cores for service instance. Suggest setting `instance_class` property instead.
    constraints:
      maximum: 64
      minimum: 2
      multipleOf: 2
  - field_name: mysql_version
    required: true
    type: string
    details: |
      The version for the MySQL instance. Can be any supported version by the provider.
      If `auto_minor_version_upgrade` is enabled, you must specify a major version such as 5.7 (for 5.7.10).
      See https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/MySQL.Concepts.VersionMgmt.html#MySQL.Concepts.VersionMgmt.Supported
  - field_name: storage_gb
    required: true
    type: number
    details: Size of storage volume for service instance.
    constraints:
      minimum: 5
  - field_name: storage_type
    type: string
    details: |
      Type of storage to be used.
      One of "standard" (magnetic), "gp2" (general purpose SSD), "gp3" (general purpose SSD),
      or "io1" (provisioned IOPS SSD).
    default: "io1"
  - field_name: iops
    nullable: true
    type: integer
    details: |
      The amount of provisioned IOPS. For this property to take effect, `storage_type` must be
      set to `io1` or `gp3`.
      Cannot be specified for `gp3` storage if the `storage_gb` value is below a per-engine threshold.
      See the RDS User Guide for details:
      https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Storage.html#gp3-storage.
    default: 3000
  - field_name: use_managed_admin_password
    type: boolean
    default: false
    details: Whether to use AWS Secrets Manager to generate and manage the admin password for this RDS.
  - field_name: rotate_admin_password_after
    type: integer
    default: 7
    details: Specifies the number of days between automatic scheduled rotations of the admin password.
  - field_name: storage_autoscale
    type: boolean
    default: true
    details: Enable storage autoscaling up to storage_autoscale_limit_gb if true
  - field_name: storage_autoscale_limit_gb
    type: number
    details: Max storage size if storage_autoscale is true
    default: 250
  - field_name: storage_encrypted
    type: boolean
    default: true
    details: Specifies whether the DB instance is encrypted
    prohibit_update: true
  - field_name: kms_key_id
    type: string
    default: ""
    details: |
      The ARN for the KMS encryption key (see https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html)
      The `storage_encrypted` property must be enabled if the key is specified.
    prohibit_update: true
  - field_name: option_group_name
    type: string
    default: ""
    details: |
      Name of the DB option group to associate. If left empty, defaults to `default:mysql-<version>-<minor_version>`
      MySQL offers additional features such as the audit plugin or Memcached to manage data and database or to provide additional security for the database.
      RDS uses option groups to enable and configure these features.
  - field_name: parameter_group_name
    type: string
    default: ""
    details: DB parameter group name - default 'default.mysql.<mysql version>'
  - field_name: instance_name
    type: string
    details: Name for your mysql instance
    default: csb-mysql-${request.instance_id}
    constraints:
      maxLength: 98
      minLength: 6
      pattern: ^[a-z][a-z0-9-]+$
    prohibit_update: true
  - field_name: db_name
    type: string
    details: Name for your database
    default: vsbdb
    constraints:
      maxLength: 64
    prohibit_update: true
  - field_name: publicly_accessible
    type: boolean
    details: Make instance public if true
    default: false
  - field_name: region
    type: string
    details: The region of AWS.
    default: us-west-2
    constraints:
      examples:
      - us-central1
      - asia-northeast1
      pattern: ^[a-z][a-z0-9-]+$
    prohibit_update: true
  - field_name: multi_az
    type: boolean
    details: Enables Multi-AZ DB instance deployment (see https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.MultiAZ.html)
    default: true
  - field_name: aws_access_key_id
    type: string
    details: AWS access key
    default: ${config("aws.access_key_id")}
  - field_name: aws_secret_access_key
    type: string
    details: AWS secret key
    default: ${config("aws.secret_access_key")}
  - field_name: aws_vpc_id
    type: string
    details: VPC ID for instance
    default: ""
  - field_name: instance_class
    type: string
    details: AWS DB instance class (see https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.DBInstanceClass.html)
    default: ""
  - field_name: rds_subnet_group
    type: string
    details: AWS RDS subnet group already in existence to use
    default: ""
  - field_name: rds_vpc_security_group_ids
    type: string
    details: Comma delimited list of security group ID's for instance
    default: ""
    prohibit_update: true
  - field_name: allow_major_version_upgrade
    type: boolean
    details: Allow major version upgrades. Changing this parameter does not result in an outage and the change is asynchronously applied as soon as possible.
    default: true
  - field_name: auto_minor_version_upgrade
    type: boolean
    details: |
      Allow minor version upgrades automatically during the maintenance window.
      If `auto_minor_version_upgrade` is enabled, you must specify a major engine version.
    default: true
  - <<: &nullable_string
      type: string
      default: null
      nullable: true
    field_name: maintenance_day
    details: The preferred maintenance day
    enum:
      Sun: Sunday
      Mon: Monday
      Tue: Tuesday
      Wed: Wednesday
      Thu: Thursday
      Fri: Friday
      Sat: Saturday
  - <<: *nullable_string
    field_name: maintenance_start_hour
    details: The preferred maintenance start hour
    enum: &hour_enum
      "00": 12 am
      "01": 1 am
      "02": 2 am
      "03": 3 am
      "04": 4 am
      "05": 5 am
      "06": 6 am
      "07": 7 am
      "08": 8 am
      "09": 9 am
      "10": 10 am
      "11": 11 am
      "12": 12 pm
      "13": 1 pm
      "14": 2 pm
      "15": 3 pm
      "16": 4 pm
      "17": 5 pm
      "18": 6 pm
      "19": 7 pm
      "20": 8 pm
      "21": 9 pm
      "22": 10 pm
      "23": 11 pm
  - <<: *nullable_string
    field_name: maintenance_start_min
    type: string
    details: The preferred maintenance start minute
    enum: &minute_enum
      "00": Top of the hour
      "15": 15 minutes
      "30": 30 minutes
      "45": 45 minutes
  - <<: *nullable_string
    field_name: maintenance_end_hour
    details: The preferred maintenance end hour
    enum: *hour_enum
  - <<: *nullable_string
    field_name: maintenance_end_min
    details: The preferred maintenance end minute
    enum: *minute_enum
  - field_name: deletion_protection
    type: boolean
    default: false
    details: |
      Whether the DB instance should have deletion protection enabled.
      The database can't be deleted when this value is set to `true`.
  - field_name: backup_retention_period
    type: integer
    details: |
      The number of days (1-35) for which automatic backups are kept.
      Set the value to 0 to disable automated backups.
      An outage occurs if you change the backup retention period from 0 to a nonzero value or vice versa.
      This applies to both Single-AZ and Multi-AZ DB instances.
    default: 7
  - <<: *nullable_string
    field_name: backup_window
    details: |
      The daily time range in UTC during which automated backups are created, e.g.: "09:46-10:16".
      Must not overlap with the maintenance window. If not set, uses the default for the region
      (see https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.html#USER_WorkingWithAutomatedBackups.BackupWindow)
  - field_name: delete_automated_backups
    type: boolean
    details: Specifies whether to remove automated backups immediately after the DB instance is deleted
    default: true
  - field_name: copy_tags_to_snapshot
    type: boolean
    details: Copy all instance tags to snapshots
    default: true
  - field_name: monitoring_interval
    type: integer
    details: |
      The interval, in seconds, between points when Enhanced Monitoring metrics are collected for the DB instance.
      To disable collecting Enhanced Monitoring metrics, specify 0. Valid Values: 0, 1, 5, 10, 15, 30, 60.
      A `monitoring_role_arn` value is required if you specify a `monitoring_interval` value other than 0.
      To read about Enhanced Monitoring metrics see https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Monitoring.OS.overview.html.
    default: 0
    constraints:
      maximum: 60
      minimum: 0
  - field_name: monitoring_role_arn
    type: string
    details: |
      Enhanced Monitoring requires permission to act on your behalf to send OS metric information to CloudWatch Logs.
      This property represents the ARN for the IAM role that permits RDS to send enhanced monitoring metrics to CloudWatch Logs.
      To read about setting up and enabling Enhanced Monitoring see https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Monitoring.OS.Enabling.html.
    default: ""
  - field_name: performance_insights_enabled
    type: boolean
    details: Specifies whether Performance Insights are enabled (see https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PerfInsights.Overview.html).
    default: false
  - field_name: performance_insights_kms_key_id
    type: string
    details: |
      The ARN for the KMS key to encrypt Performance Insights data.
      When specifying `performance_insights_kms_key_id`, `performance_insights_enabled` needs to be set to true.
      Once KMS key is set, it can never be changed.
    default: ""
  - field_name: performance_insights_retention_period
    type: integer
    details: |
      The number of days to retain Performance Insights data.
      When specifying `performance_insights_retention_period`, `performance_insights_enabled` needs to be set to true.
      The default is 7 days.
      The following values are valid: 7, month * 31, where month is a number of months from 1-23, 731.
      For example, the following values are valid: 93 (3 months * 31), 341 (11 months * 31), 589 (19 months * 31), and 731.
      If you specify a retention period such as 94, which is not a valid value, RDS issues an error.
    default: 7
    constraints:
      minimum: 7
  - field_name: enable_audit_logging
    type: boolean
    default: false
    details: |
      Requires setting option_group_name with a pre-created Option Group that fullfils requirements for audit log exports. 
      See AWS Docs for config options: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.MySQL.Options.AuditPlugin.html#Appendix.MySQL.Options.AuditPlugin.Add
      If set will enable the `audit` cloud_watch_log_export on the rds instance. 
  - field_name: cloudwatch_log_group_retention_in_days
    type: integer
    details: |
      Used in conjunction with `enable_audit_logging`. If provided will set the retention days for the log group containing the RDS audit logs. Defaults to 30 Days.
    default: 30
    constraints:
      minimum: 1
      maximum: 3653 #10y
  - field_name: cloudwatch_log_group_kms_key_id
    type: string
    default: ""
    details: Used in conjunction with `enable_audit_logging`. If provided will set the KSM key to use for encrypting the Cloudwatch log group created for the RDS audit logs.
  - field_name: admin_username
    type: string
    details: The username to use for the admin user of the database. When not specified a random username will be generated. This property should only be used when migrating data.
    default: ""
    prohibit_update: true
  computed_inputs:
  - name: labels
    default: ${json.marshal(request.default_labels)}
    overwrite: true
    type: object
  - name: engine
    default: mysql
    overwrite: true
    type: string
  - name: engine_version
    default: ${mysql_version}
    overwrite: true
    type: string
  template_refs:
    outputs: terraform/mysql/provision/outputs.tf
    provider: terraform/mysql/provision/provider.tf
    versions: terraform/mysql/provision/versions.tf
    variables: terraform/mysql/provision/variables.tf
    main: terraform/mysql/provision/main.tf
    data: terraform/mysql/provision/data.tf
  outputs:
  - field_name: name
    type: string
    details: The name of the database.
  - field_name: hostname
    type: string
    details: Hostname or IP address of the exposed mysql endpoint used by clients to connect to the service.
  - field_name: username
    type: string
    details: The username to authenticate to the database instance.
  - field_name: password
    type: string
    details: The password to authenticate to the database instance.
  - field_name: region
    type: string
    details: AWS region for the RDS instance
  - field_name: use_managed_admin_password
    type: boolean
    details: Whether CSB should use AWS managed admin password
  - field_name: managed_admin_credentials_arn
    type: string
    details: The ARN of the master secret to authenticate to the database instance.
bind:
  plan_inputs: []
  user_inputs:
  - field_name: aws_access_key_id
    type: string
    details: AWS access key
    default: ${config("aws.access_key_id")}
  - field_name: aws_secret_access_key
    type: string
    details: AWS secret key
    default: ${config("aws.secret_access_key")}
  computed_inputs:
  - name: db_name
    type: string
    default: ${instance.details["name"]}
    overwrite: true
  - name: hostname
    type: string
    default: ${instance.details["hostname"]}
    overwrite: true
  - name: admin_username
    type: string
    default: ${instance.details["username"]}
    overwrite: true
  - name: admin_password
    type: string
    default: ${instance.details["password"]}
    overwrite: true
  - name: region
    default: ${instance.details["region"]}
    overwrite: true
    type: string
  - name: use_managed_admin_password
    type: boolean
    default: ${instance.details["use_managed_admin_password"]}
    overwrite: true
  - name: managed_admin_credentials_arn
    type: string
    default: ${instance.details["managed_admin_credentials_arn"]}
    overwrite: true
  template_refs:
    outputs: terraform/mysql/bind/outputs.tf
    provider: terraform/mysql/bind/provider.tf
    versions: terraform/mysql/bind/versions.tf
    variables: terraform/mysql/bind/variables.tf
    main: terraform/mysql/bind/main.tf
    data: terraform/mysql/bind/data.tf
  outputs:
  - field_name: username
    type: string
    details: The username to authenticate to the database instance.
  - field_name: password
    type: string
    details: The password to authenticate to the database instance.
  - field_name: uri
    type: string
    details: The uri to connect to the database instance and database.
  - field_name: jdbcUrl
    type: string
    details: The jdbc url to connect to the database instance and database.
  - field_name: port
    type: integer
    details: The port number of the exposed mysql instance.