From 4b6fc5fd03961d92bde167234af03707bdc1ce5d Mon Sep 17 00:00:00 2001 From: Andres Montalban Date: Thu, 23 May 2024 18:21:41 -0300 Subject: [PATCH 1/7] feat: Allow configuring transit_encryption_mode --- main.tf | 1 + variables.tf | 13 +++++++++++++ 2 files changed, 14 insertions(+) diff --git a/main.tf b/main.tf index d3c532d..03c3b3a 100644 --- a/main.tf +++ b/main.tf @@ -155,6 +155,7 @@ resource "aws_elasticache_replication_group" "default" { engine_version = var.engine_version at_rest_encryption_enabled = var.at_rest_encryption_enabled transit_encryption_enabled = var.transit_encryption_enabled + transit_encryption_mode = var.transit_encryption_mode kms_key_id = var.at_rest_encryption_enabled ? var.kms_key_id : null snapshot_name = var.snapshot_name snapshot_arns = var.snapshot_arns diff --git a/variables.tf b/variables.tf index aa94519..cf86e9a 100644 --- a/variables.tf +++ b/variables.tf @@ -75,6 +75,19 @@ variable "transit_encryption_enabled" { EOT } +variable "transit_encryption_mode" { + type = string + default = "preferred" + description = <<-EOT + A setting that enables clients to migrate to in-transit encryption with no downtime. Valid values are `preferred` and `required`. When enabling encryption on an existing replication group, this must first be set to `preferred` before setting it to `required` in a subsequent apply. See the TransitEncryptionMode field in the [CreateReplicationGroup](https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CreateReplicationGroup.html) API documentation for additional details." + EOT + + validation { + condition = lower(var.transit_encryption_mode) == "preferred" || lower(var.transit_encryption_mode) == "required" + error_message = "The transit_encryption_mode must be either `preferred` (Default) or `required`" + } +} + variable "notification_topic_arn" { type = string default = "" From 1e54755a2064e7a92503c9ba10bd69bcebfd1635 Mon Sep 17 00:00:00 2001 From: nitrocode <7775707+nitrocode@users.noreply.github.com> Date: Sun, 9 Jun 2024 20:16:26 +0530 Subject: [PATCH 2/7] fix(tests): bump redis to 7.x --- examples/complete/fixtures.us-east-2.tfvars | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/examples/complete/fixtures.us-east-2.tfvars b/examples/complete/fixtures.us-east-2.tfvars index f9faa14..e542c71 100644 --- a/examples/complete/fixtures.us-east-2.tfvars +++ b/examples/complete/fixtures.us-east-2.tfvars @@ -15,9 +15,9 @@ instance_type = "cache.m6g.large" cluster_size = 1 -family = "redis6.x" +family = "redis7.x" -engine_version = "6.x" +engine_version = "7.x" at_rest_encryption_enabled = false From d9bf391b6d99803f08d72d8c7a1e168565ae0f1f Mon Sep 17 00:00:00 2001 From: nitrocode <7775707+nitrocode@users.noreply.github.com> Date: Sun, 9 Jun 2024 20:24:56 +0530 Subject: [PATCH 3/7] fix(tests): set redis to 7.2 --- examples/complete/fixtures.us-east-2.tfvars | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/examples/complete/fixtures.us-east-2.tfvars b/examples/complete/fixtures.us-east-2.tfvars index e542c71..e80b463 100644 --- a/examples/complete/fixtures.us-east-2.tfvars +++ b/examples/complete/fixtures.us-east-2.tfvars @@ -15,14 +15,12 @@ instance_type = "cache.m6g.large" cluster_size = 1 -family = "redis7.x" +family = "redis7.2" -engine_version = "7.x" +engine_version = "7.2" at_rest_encryption_enabled = false transit_encryption_enabled = true -zone_id = "Z3SO0TKDDQ0RGG" - cloudwatch_metric_alarms_enabled = false From b854027ed0ba31df0a93dcc5b1857b3847ba6ebc Mon Sep 17 00:00:00 2001 From: nitrocode <7775707+nitrocode@users.noreply.github.com> Date: Mon, 10 Jun 2024 06:41:13 +0530 Subject: [PATCH 4/7] fix(tests): set family to redis7 --- examples/complete/fixtures.us-east-2.tfvars | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/complete/fixtures.us-east-2.tfvars b/examples/complete/fixtures.us-east-2.tfvars index e80b463..cccb24f 100644 --- a/examples/complete/fixtures.us-east-2.tfvars +++ b/examples/complete/fixtures.us-east-2.tfvars @@ -15,7 +15,7 @@ instance_type = "cache.m6g.large" cluster_size = 1 -family = "redis7.2" +family = "redis7" engine_version = "7.2" From 54f543016f2897f23f8a3fab34989fe53ff97d05 Mon Sep 17 00:00:00 2001 From: nitrocode <7775707+nitrocode@users.noreply.github.com> Date: Mon, 10 Jun 2024 06:53:56 +0530 Subject: [PATCH 5/7] fix(tests): set engine version to 7 --- examples/complete/fixtures.us-east-2.tfvars | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/complete/fixtures.us-east-2.tfvars b/examples/complete/fixtures.us-east-2.tfvars index cccb24f..344616e 100644 --- a/examples/complete/fixtures.us-east-2.tfvars +++ b/examples/complete/fixtures.us-east-2.tfvars @@ -17,7 +17,7 @@ cluster_size = 1 family = "redis7" -engine_version = "7.2" +engine_version = "7" at_rest_encryption_enabled = false From ad6d59ce9a490c06144087de36b9818e59195c1e Mon Sep 17 00:00:00 2001 From: nitrocode <7775707+nitrocode@users.noreply.github.com> Date: Mon, 10 Jun 2024 12:28:18 +0530 Subject: [PATCH 6/7] Update examples/complete/fixtures.us-east-2.tfvars --- examples/complete/fixtures.us-east-2.tfvars | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/complete/fixtures.us-east-2.tfvars b/examples/complete/fixtures.us-east-2.tfvars index 344616e..62676be 100644 --- a/examples/complete/fixtures.us-east-2.tfvars +++ b/examples/complete/fixtures.us-east-2.tfvars @@ -17,7 +17,7 @@ cluster_size = 1 family = "redis7" -engine_version = "7" +engine_version = "7.0" at_rest_encryption_enabled = false From fc39d1a3f34e89baea2de1a47992dc3f3921f16f Mon Sep 17 00:00:00 2001 From: Andres Montalban Date: Thu, 13 Jun 2024 23:29:01 -0300 Subject: [PATCH 7/7] chore: Update README.md --- README.md | 1 + docs/terraform.md | 6 ++++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index e5b8c9d..93ff16b 100644 --- a/README.md +++ b/README.md @@ -283,6 +283,7 @@ Available targets: | [target\_security\_group\_id](#input\_target\_security\_group\_id) | The ID of an existing Security Group to which Security Group rules will be assigned.
The Security Group's name and description will not be changed.
Not compatible with `inline_rules_enabled` or `revoke_rules_on_delete`.
If not provided (the default), this module will create a security group. | `list(string)` | `[]` | no | | [tenant](#input\_tenant) | ID element \_(Rarely used, not included by default)\_. A customer identifier, indicating who this instance of a resource is for | `string` | `null` | no | | [transit\_encryption\_enabled](#input\_transit\_encryption\_enabled) | Set `true` to enable encryption in transit. Forced `true` if `var.auth_token` is set.
If this is enabled, use the [following guide](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/in-transit-encryption.html#connect-tls) to access redis. | `bool` | `true` | no | +| [transit\_encryption\_mode](#input\_transit\_encryption\_mode) | A setting that enables clients to migrate to in-transit encryption with no downtime. Valid values are `preferred` and `required`. When enabling encryption on an existing replication group, this must first be set to `preferred` before setting it to `required` in a subsequent apply. See the TransitEncryptionMode field in the [CreateReplicationGroup](https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CreateReplicationGroup.html) API documentation for additional details." | `string` | `"preferred"` | no | | [use\_existing\_security\_groups](#input\_use\_existing\_security\_groups) | DEPRECATED: Use `create_security_group` instead.
Historical description: Flag to enable/disable creation of Security Group in the module.
Set to `true` to disable Security Group creation and provide a list of existing security Group IDs in `existing_security_groups` to place the cluster into.
Historical default: `false` | `bool` | `null` | no | | [user\_group\_ids](#input\_user\_group\_ids) | User Group ID to associate with the replication group | `list(string)` | `null` | no | | [vpc\_id](#input\_vpc\_id) | VPC ID | `string` | n/a | yes | diff --git a/docs/terraform.md b/docs/terraform.md index 452e4fe..03fb023 100644 --- a/docs/terraform.md +++ b/docs/terraform.md @@ -4,13 +4,13 @@ | Name | Version | |------|---------| | [terraform](#requirement\_terraform) | >= 1.3 | -| [aws](#requirement\_aws) | >= 4.18 | +| [aws](#requirement\_aws) | >= 5.27.0 | ## Providers | Name | Version | |------|---------| -| [aws](#provider\_aws) | >= 4.18 | +| [aws](#provider\_aws) | >= 5.27.0 | ## Modules @@ -48,6 +48,7 @@ | [at\_rest\_encryption\_enabled](#input\_at\_rest\_encryption\_enabled) | Enable encryption at rest | `bool` | `false` | no | | [attributes](#input\_attributes) | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,
in the order they appear in the list. New attributes are appended to the
end of the list. The elements of the list are joined by the `delimiter`
and treated as a single ID element. | `list(string)` | `[]` | no | | [auth\_token](#input\_auth\_token) | Auth token for password protecting redis, `transit_encryption_enabled` must be set to `true`. Password must be longer than 16 chars | `string` | `null` | no | +| [auth\_token\_update\_strategy](#input\_auth\_token\_update\_strategy) | Strategy to use when updating the auth\_token. Valid values are `SET`, `ROTATE`, and `DELETE`. Defaults to `ROTATE`. | `string` | `"ROTATE"` | no | | [auto\_minor\_version\_upgrade](#input\_auto\_minor\_version\_upgrade) | Specifies whether minor version engine upgrades will be applied automatically to the underlying Cache Cluster instances during the maintenance window. Only supported if the engine version is 6 or higher. | `bool` | `null` | no | | [automatic\_failover\_enabled](#input\_automatic\_failover\_enabled) | Automatic failover (Not available for T1/T2 instances) | `bool` | `false` | no | | [availability\_zones](#input\_availability\_zones) | Availability zone IDs | `list(string)` | `[]` | no | @@ -110,6 +111,7 @@ | [target\_security\_group\_id](#input\_target\_security\_group\_id) | The ID of an existing Security Group to which Security Group rules will be assigned.
The Security Group's name and description will not be changed.
Not compatible with `inline_rules_enabled` or `revoke_rules_on_delete`.
If not provided (the default), this module will create a security group. | `list(string)` | `[]` | no | | [tenant](#input\_tenant) | ID element \_(Rarely used, not included by default)\_. A customer identifier, indicating who this instance of a resource is for | `string` | `null` | no | | [transit\_encryption\_enabled](#input\_transit\_encryption\_enabled) | Set `true` to enable encryption in transit. Forced `true` if `var.auth_token` is set.
If this is enabled, use the [following guide](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/in-transit-encryption.html#connect-tls) to access redis. | `bool` | `true` | no | +| [transit\_encryption\_mode](#input\_transit\_encryption\_mode) | A setting that enables clients to migrate to in-transit encryption with no downtime. Valid values are `preferred` and `required`. When enabling encryption on an existing replication group, this must first be set to `preferred` before setting it to `required` in a subsequent apply. See the TransitEncryptionMode field in the [CreateReplicationGroup](https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CreateReplicationGroup.html) API documentation for additional details." | `string` | `"preferred"` | no | | [use\_existing\_security\_groups](#input\_use\_existing\_security\_groups) | DEPRECATED: Use `create_security_group` instead.
Historical description: Flag to enable/disable creation of Security Group in the module.
Set to `true` to disable Security Group creation and provide a list of existing security Group IDs in `existing_security_groups` to place the cluster into.
Historical default: `false` | `bool` | `null` | no | | [user\_group\_ids](#input\_user\_group\_ids) | User Group ID to associate with the replication group | `list(string)` | `null` | no | | [vpc\_id](#input\_vpc\_id) | VPC ID | `string` | n/a | yes |