diff --git a/infra/deployments/forms/inputs.tf b/infra/deployments/forms/inputs.tf index 6696961d0..74626bd60 100644 --- a/infra/deployments/forms/inputs.tf +++ b/infra/deployments/forms/inputs.tf @@ -205,13 +205,7 @@ variable "environmental_settings" { allow_pagerduty_alerts = bool redis_multi_az_enabled = bool enable_advanced_database_insights = bool - rds_enhanced_monitoring_interval_seconds = number # Enables RDS enhanced monitoring if value is 1, 5, 10, 15, 30 or 60. Disabled if 0 - }) - validation { - condition = contains([0, 1, 5, 10, 15, 30, 60], var.environmental_settings.rds_enhanced_monitoring_interval_seconds) - error_message = "Valid values for the monitoring interval in RDS Enhanced Monitoring are 0, 1, 5, 10, 15, 30 and 60" - } } variable "scheduled_smoke_tests_settings" { diff --git a/infra/deployments/forms/rds/main.tf b/infra/deployments/forms/rds/main.tf index 8c0283662..87b442b70 100644 --- a/infra/deployments/forms/rds/main.tf +++ b/infra/deployments/forms/rds/main.tf @@ -4,13 +4,6 @@ variable "apply_immediately" { default = false } -data "aws_caller_identity" "current" {} -data "aws_region" "current" {} - -locals { - aws_account_id = data.aws_caller_identity.current.account_id - aws_region = data.aws_region.current.region -} module "rds" { # this is the rds cluster for the forms-admin database source = "../../../modules/rds" @@ -32,9 +25,6 @@ module "rds" { enable_advanced_database_insights = var.environmental_settings.enable_advanced_database_insights - # Enable RDS Enhanced Monitoring only when the monitoring interval is set to be greater than 0 - monitoring_interval = var.environmental_settings.rds_enhanced_monitoring_interval_seconds - monitoring_role_arn = var.environmental_settings.rds_enhanced_monitoring_interval_seconds > 0 ? aws_iam_role.rds_enhanced_monitoring[0].arn : "" apps_list = { forms-admin = { username = "forms-admin-app" } } @@ -62,50 +52,9 @@ module "forms_runner_rds" { enable_advanced_database_insights = var.environmental_settings.enable_advanced_database_insights - - # Enable RDS Enhanced Monitoring only when the monitoring interval is set to be greater than 0 - monitoring_interval = var.environmental_settings.rds_enhanced_monitoring_interval_seconds - monitoring_role_arn = var.environmental_settings.rds_enhanced_monitoring_interval_seconds > 0 ? aws_iam_role.rds_enhanced_monitoring[0].arn : "" apps_list = { forms-runner = { username = "forms-runner-app" } forms-runner-queue = { username = "forms-runner-app-queue" } } database_identifier = "forms-runner-${var.environment_name}-primary" } - -# Create an IAM role to allow RDS enhanced monitoring -resource "aws_iam_role" "rds_enhanced_monitoring" { - count = var.environmental_settings.rds_enhanced_monitoring_interval_seconds > 0 ? 1 : 0 - - name = "RDSEnhancedMonitoring" - description = "Used to enable enhanced monitoring in RDS" - assume_role_policy = jsonencode({ - Version = "2012-10-17" - Statement = [ - { - Action = "sts:AssumeRole" - Effect = "Allow" - Principal = { - Service = "monitoring.rds.amazonaws.com" - } - Condition = { - StringLike = { - "aws:SourceArn" = [ - "arn:aws:rds:${local.aws_region}:${local.aws_account_id}:db:primary", - "arn:aws:rds:${local.aws_region}:${local.aws_account_id}:db:forms-runner-${var.environment_name}-primary" - ] - }, - StringEquals = { - "AWS:SourceAccount" = local.aws_account_id - } - } - }] - }) -} - -resource "aws_iam_role_policy_attachment" "rds_enhanced_monitoring" { - count = var.environmental_settings.rds_enhanced_monitoring_interval_seconds > 0 ? 1 : 0 - - role = aws_iam_role.rds_enhanced_monitoring[0].name - policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole" -} diff --git a/infra/deployments/forms/tfvars/dev.tfvars b/infra/deployments/forms/tfvars/dev.tfvars index cfc2502be..3afec906e 100644 --- a/infra/deployments/forms/tfvars/dev.tfvars +++ b/infra/deployments/forms/tfvars/dev.tfvars @@ -27,7 +27,6 @@ environmental_settings = { allow_pagerduty_alerts = false redis_multi_az_enabled = false enable_advanced_database_insights = false - rds_enhanced_monitoring_interval_seconds = 0 # disabled } root_domain = "dev.forms.service.gov.uk" additional_dns_records = [ diff --git a/infra/deployments/forms/tfvars/production.tfvars b/infra/deployments/forms/tfvars/production.tfvars index 76fe59b19..ecc53780a 100644 --- a/infra/deployments/forms/tfvars/production.tfvars +++ b/infra/deployments/forms/tfvars/production.tfvars @@ -39,19 +39,17 @@ environmental_settings = { "@dhsc.egresscloud.com", "@acas.org.uk" ] - forms_product_page_support_url = "https://www.forms.service.gov.uk/support" - rds_maintenance_window = "wed:04:00-wed:04:30" - rds_minimum_capacity_acus = 2 - rds_maxium_capacity_acus = 10 - rds_force_ssl_connections = true - ips_to_block = [] - rate_limit_bypass_cidrs = [] - enable_shield_advanced_healthchecks = true - allow_pagerduty_alerts = true - redis_multi_az_enabled = true - enable_advanced_database_insights = true - rds_enhanced_monitoring_interval_seconds = 15 - + forms_product_page_support_url = "https://www.forms.service.gov.uk/support" + rds_maintenance_window = "wed:04:00-wed:04:30" + rds_minimum_capacity_acus = 2 + rds_maxium_capacity_acus = 10 + rds_force_ssl_connections = true + ips_to_block = [] + rate_limit_bypass_cidrs = [] + enable_shield_advanced_healthchecks = true + allow_pagerduty_alerts = true + redis_multi_az_enabled = true + enable_advanced_database_insights = true } root_domain = "forms.service.gov.uk" additional_dns_records = [ diff --git a/infra/deployments/forms/tfvars/staging.tfvars b/infra/deployments/forms/tfvars/staging.tfvars index 854e6e8d9..36e3e5f36 100644 --- a/infra/deployments/forms/tfvars/staging.tfvars +++ b/infra/deployments/forms/tfvars/staging.tfvars @@ -35,12 +35,10 @@ environmental_settings = { "51.142.199.225/32", "20.162.198.121/32" ] - enable_shield_advanced_healthchecks = false - allow_pagerduty_alerts = false - redis_multi_az_enabled = false - enable_advanced_database_insights = true - rds_enhanced_monitoring_interval_seconds = 0 # disabled - + enable_shield_advanced_healthchecks = false + allow_pagerduty_alerts = false + redis_multi_az_enabled = false + enable_advanced_database_insights = true } root_domain = "staging.forms.service.gov.uk" additional_dns_records = [] diff --git a/infra/modules/deployer-access/policy.tf b/infra/modules/deployer-access/policy.tf index 95b40fc50..87f76d876 100644 --- a/infra/modules/deployer-access/policy.tf +++ b/infra/modules/deployer-access/policy.tf @@ -497,8 +497,7 @@ data "aws_iam_policy_document" "iam" { "arn:aws:iam::${var.account_id}:role/event-bridge-actor", "arn:aws:iam::${var.account_id}:role/ecs-events-role", "arn:aws:iam::${var.account_id}:role/deployer-${var.environment_name}", - "arn:aws:iam::${var.account_id}:role/malware-protection-for-s3", - "arn:aws:iam::${var.account_id}:role/RDSEnhancedMonitoring" + "arn:aws:iam::${var.account_id}:role/malware-protection-for-s3" ] sid = "ManageRoles" } diff --git a/infra/modules/rds/rds.tf b/infra/modules/rds/rds.tf index 051db169c..00b8982e8 100644 --- a/infra/modules/rds/rds.tf +++ b/infra/modules/rds/rds.tf @@ -63,10 +63,6 @@ resource "aws_rds_cluster" "cluster_aurora_v2" { database_insights_mode = var.enable_advanced_database_insights ? "advanced" : null - # Enhanced Monitoring (disabled by default) - monitoring_interval = var.monitoring_interval - monitoring_role_arn = var.monitoring_role_arn - # performance insights with 15 month retention is required for advanced database insights # https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_DatabaseInsights.TurningOnAdvanced.html performance_insights_enabled = var.enable_advanced_database_insights @@ -112,7 +108,6 @@ resource "aws_rds_cluster" "cluster_aurora_v2" { resource "aws_rds_cluster_instance" "member" { #checkov:skip=CKV_AWS_118:We don't currently have enhanced monitoring #checkov:skip=CKV_AWS_354:We can use the default kms key for encryption - #checkov:skip=CKV_AWS_353:We enabled performance insights at cluster level cluster_identifier = aws_rds_cluster.cluster_aurora_v2.id engine = "aurora-postgresql" diff --git a/infra/modules/rds/variables.tf b/infra/modules/rds/variables.tf index dad7cb6bb..c3c7b5d26 100644 --- a/infra/modules/rds/variables.tf +++ b/infra/modules/rds/variables.tf @@ -93,20 +93,3 @@ variable "force_ssl_connections" { description = "Whether to force SSL connections to the database" default = true } - -variable "monitoring_interval" { - type = number - description = "Interval, in seconds, between points when Enhanced Monitoring metrics are collected. A value of 0 means Enhanced Monitoring is disabled. Valid Values: 0, 1, 5, 10, 15, 30, 60. " - default = 0 - - validation { - condition = contains([0, 1, 5, 10, 15, 30, 60], var.monitoring_interval) - error_message = "Valid values for the monitoring interval in RDS Enhanced Monitoring are 0, 1, 5, 10, 15, 30 and 60" - } -} - -variable "monitoring_role_arn" { - type = string - description = "ARN for the IAM role that allows RDS to send enhanced monitoring metrics to CloudWatch Logs. Only needed when the monitoring_interval is non zero" - default = "" -}