feat(infra): grant DSQL IAM access - #398
Merged
Merged
Conversation
Groundwork for the Aurora DSQL migration, split out so the PR that adds the cluster does not also have to change IAM. branch-ci-plan carries AWS-managed ReadOnlyAccess, which does not reliably cover dsql:*. Without AmazonAuroraDSQLReadOnlyAccess, the PR introducing an aws_dsql_cluster fails its own terraform plan. branch-lambda-role gets dsql:DbConnectAdmin because DSQL authenticates with an IAM token rather than a password. The role is shared with every preview lambda, so previews are covered too. Resource is "*" until the cluster exists. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
- Auto-formatted .tf files with terraform fmt - Updated README.md with terraform-docs Co-authored-by: nourshoreibah <[email protected]>
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Contributor
Terraform Plan 📖
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First of four PRs migrating BRANCH from RDS Postgres to Aurora DSQL. IAM only — no cluster yet, no application changes.
Why this is separate
branch-ci-plancarries AWS-managedReadOnlyAccess, which does not reliably coverdsql:*. If the PR that introducesaws_dsql_clusteralso had to grant the plan role permission to read it, that PR would fail its ownterraform plan. Splitting the IAM out means the later PRs apply cleanly.Changes
infrastructure/aws/oidc.tf— attachAmazonAuroraDSQLReadOnlyAccesstobranch-ci-plan(dsql:GetCluster,dsql:ListClusters,dsql:GetClusterPolicy,dsql:GetVpcEndpointServiceName,dsql:ListTagsForResource).infrastructure/aws/lambda.tf— inline policy onbranch-lambda-rolegrantingdsql:DbConnectAdmin. DSQL authenticates with an IAM token rather than a password. This role is shared with every preview lambda (infrastructure/preview/lambda.tf:7-9), so previews are covered too.branch-ci-applyalready hasAdministratorAccess, so no change was needed there.Resource = "*"on the connect grant is deliberate — the cluster does not exist yet. It gets scoped to the cluster ARN in the cutover PR.Verification
terraform fmt -checkcleanterraform validatepasses (terraform init -backend=false)aws_dsql_clusterexists in the pinned provider 6.14.1, so the later PRs will not need a provider bumpNo runtime effect: nothing reads DSQL yet, and no existing permission was changed or removed.
Follow-ups in this series
@branch/storepackage (still on RDS)flyway-database-dsql(still on RDS)🤖 Generated with Claude Code