Skip to content

Revert "Enable RDS enhanced monitoring" #2207

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cadmiumcat merged 1 commit into from
Jul 16, 2026
Merged

Revert "Enable RDS enhanced monitoring" #2207

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 0 additions & 6 deletions infra/deployments/forms/inputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -205,13 +205,7 @@ variable "environmental_settings" {
allow_pagerduty_alerts = bool
redis_multi_az_enabled = bool
enable_advanced_database_insights = bool
rds_enhanced_monitoring_interval_seconds = number # Enables RDS enhanced monitoring if value is 1, 5, 10, 15, 30 or 60. Disabled if 0

})
validation {
condition = contains([0, 1, 5, 10, 15, 30, 60], var.environmental_settings.rds_enhanced_monitoring_interval_seconds)
error_message = "Valid values for the monitoring interval in RDS Enhanced Monitoring are 0, 1, 5, 10, 15, 30 and 60"
}
}

variable "scheduled_smoke_tests_settings" {
Expand Down
51 changes: 0 additions & 51 deletions infra/deployments/forms/rds/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,13 +4,6 @@ variable "apply_immediately" {
default = false
}

data "aws_caller_identity" "current" {}
data "aws_region" "current" {}

locals {
aws_account_id = data.aws_caller_identity.current.account_id
aws_region = data.aws_region.current.region
}
module "rds" {
# this is the rds cluster for the forms-admin database
source = "../../../modules/rds"
Expand All @@ -32,9 +25,6 @@ module "rds" {

enable_advanced_database_insights = var.environmental_settings.enable_advanced_database_insights

# Enable RDS Enhanced Monitoring only when the monitoring interval is set to be greater than 0
monitoring_interval = var.environmental_settings.rds_enhanced_monitoring_interval_seconds
monitoring_role_arn = var.environmental_settings.rds_enhanced_monitoring_interval_seconds > 0 ? aws_iam_role.rds_enhanced_monitoring[0].arn : ""
apps_list = {
forms-admin = { username = "forms-admin-app" }
}
Expand Down Expand Up @@ -62,50 +52,9 @@ module "forms_runner_rds" {

enable_advanced_database_insights = var.environmental_settings.enable_advanced_database_insights


# Enable RDS Enhanced Monitoring only when the monitoring interval is set to be greater than 0
monitoring_interval = var.environmental_settings.rds_enhanced_monitoring_interval_seconds
monitoring_role_arn = var.environmental_settings.rds_enhanced_monitoring_interval_seconds > 0 ? aws_iam_role.rds_enhanced_monitoring[0].arn : ""
apps_list = {
forms-runner = { username = "forms-runner-app" }
forms-runner-queue = { username = "forms-runner-app-queue" }
}
database_identifier = "forms-runner-${var.environment_name}-primary"
}

# Create an IAM role to allow RDS enhanced monitoring
resource "aws_iam_role" "rds_enhanced_monitoring" {
count = var.environmental_settings.rds_enhanced_monitoring_interval_seconds > 0 ? 1 : 0

name = "RDSEnhancedMonitoring"
description = "Used to enable enhanced monitoring in RDS"
assume_role_policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Action = "sts:AssumeRole"
Effect = "Allow"
Principal = {
Service = "monitoring.rds.amazonaws.com"
}
Condition = {
StringLike = {
"aws:SourceArn" = [
"arn:aws:rds:${local.aws_region}:${local.aws_account_id}:db:primary",
"arn:aws:rds:${local.aws_region}:${local.aws_account_id}:db:forms-runner-${var.environment_name}-primary"
]
},
StringEquals = {
"AWS:SourceAccount" = local.aws_account_id
}
}
}]
})
}

resource "aws_iam_role_policy_attachment" "rds_enhanced_monitoring" {
count = var.environmental_settings.rds_enhanced_monitoring_interval_seconds > 0 ? 1 : 0

role = aws_iam_role.rds_enhanced_monitoring[0].name
policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole"
}
1 change: 0 additions & 1 deletion infra/deployments/forms/tfvars/dev.tfvars
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,6 @@ environmental_settings = {
allow_pagerduty_alerts = false
redis_multi_az_enabled = false
enable_advanced_database_insights = false
rds_enhanced_monitoring_interval_seconds = 0 # disabled
}
root_domain = "dev.forms.service.gov.uk"
additional_dns_records = [
Expand Down
24 changes: 11 additions & 13 deletions infra/deployments/forms/tfvars/production.tfvars
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,19 +39,17 @@ environmental_settings = {
"@dhsc.egresscloud.com",
"@acas.org.uk"
]
forms_product_page_support_url = "https://www.forms.service.gov.uk/support"
rds_maintenance_window = "wed:04:00-wed:04:30"
rds_minimum_capacity_acus = 2
rds_maxium_capacity_acus = 10
rds_force_ssl_connections = true
ips_to_block = []
rate_limit_bypass_cidrs = []
enable_shield_advanced_healthchecks = true
allow_pagerduty_alerts = true
redis_multi_az_enabled = true
enable_advanced_database_insights = true
rds_enhanced_monitoring_interval_seconds = 15

forms_product_page_support_url = "https://www.forms.service.gov.uk/support"
rds_maintenance_window = "wed:04:00-wed:04:30"
rds_minimum_capacity_acus = 2
rds_maxium_capacity_acus = 10
rds_force_ssl_connections = true
ips_to_block = []
rate_limit_bypass_cidrs = []
enable_shield_advanced_healthchecks = true
allow_pagerduty_alerts = true
redis_multi_az_enabled = true
enable_advanced_database_insights = true
}
root_domain = "forms.service.gov.uk"
additional_dns_records = [
Expand Down
10 changes: 4 additions & 6 deletions infra/deployments/forms/tfvars/staging.tfvars
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,12 +35,10 @@ environmental_settings = {
"51.142.199.225/32",
"20.162.198.121/32"
]
enable_shield_advanced_healthchecks = false
allow_pagerduty_alerts = false
redis_multi_az_enabled = false
enable_advanced_database_insights = true
rds_enhanced_monitoring_interval_seconds = 0 # disabled

enable_shield_advanced_healthchecks = false
allow_pagerduty_alerts = false
redis_multi_az_enabled = false
enable_advanced_database_insights = true
}
root_domain = "staging.forms.service.gov.uk"
additional_dns_records = []
Expand Down
3 changes: 1 addition & 2 deletions infra/modules/deployer-access/policy.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -497,8 +497,7 @@ data "aws_iam_policy_document" "iam" {
"arn:aws:iam::${var.account_id}:role/event-bridge-actor",
"arn:aws:iam::${var.account_id}:role/ecs-events-role",
"arn:aws:iam::${var.account_id}:role/deployer-${var.environment_name}",
"arn:aws:iam::${var.account_id}:role/malware-protection-for-s3",
"arn:aws:iam::${var.account_id}:role/RDSEnhancedMonitoring"
"arn:aws:iam::${var.account_id}:role/malware-protection-for-s3"
]
sid = "ManageRoles"
}
Expand Down
5 changes: 0 additions & 5 deletions infra/modules/rds/rds.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,10 +63,6 @@ resource "aws_rds_cluster" "cluster_aurora_v2" {

database_insights_mode = var.enable_advanced_database_insights ? "advanced" : null

# Enhanced Monitoring (disabled by default)
monitoring_interval = var.monitoring_interval
monitoring_role_arn = var.monitoring_role_arn

# performance insights with 15 month retention is required for advanced database insights
# https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_DatabaseInsights.TurningOnAdvanced.html
performance_insights_enabled = var.enable_advanced_database_insights
Expand Down Expand Up @@ -112,7 +108,6 @@ resource "aws_rds_cluster" "cluster_aurora_v2" {
resource "aws_rds_cluster_instance" "member" {
#checkov:skip=CKV_AWS_118:We don't currently have enhanced monitoring
#checkov:skip=CKV_AWS_354:We can use the default kms key for encryption
#checkov:skip=CKV_AWS_353:We enabled performance insights at cluster level

cluster_identifier = aws_rds_cluster.cluster_aurora_v2.id
engine = "aurora-postgresql"
Expand Down
17 changes: 0 additions & 17 deletions infra/modules/rds/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,20 +93,3 @@ variable "force_ssl_connections" {
description = "Whether to force SSL connections to the database"
default = true
}

variable "monitoring_interval" {
type = number
description = "Interval, in seconds, between points when Enhanced Monitoring metrics are collected. A value of 0 means Enhanced Monitoring is disabled. Valid Values: 0, 1, 5, 10, 15, 30, 60. "
default = 0

validation {
condition = contains([0, 1, 5, 10, 15, 30, 60], var.monitoring_interval)
error_message = "Valid values for the monitoring interval in RDS Enhanced Monitoring are 0, 1, 5, 10, 15, 30 and 60"
}
}

variable "monitoring_role_arn" {
type = string
description = "ARN for the IAM role that allows RDS to send enhanced monitoring metrics to CloudWatch Logs. Only needed when the monitoring_interval is non zero"
default = ""
}