Project Farms

This code snippet demonstrates how to set up a database stack. It includes the creation of a VPC, security groups, and an RDS instance. The roles to be used by Lambdas to access the database are also defined here. Also included Lambda functions to initialize the database with a user and permissions and function to create tables on the database. The initialize function is triggered via a custom resource to ensure it runs after the RDS instance is created. The function to create tables is also defined and should be invoked as needed from AWS Console or other mechanisms.

    
export class DatabaseStack extends Stack {
  constructor(scope: Construct, id: string, props: WebStackProps) {
    super(scope, id, props);

    // Step 1: Create a VPC and security groups for the RDS instance and Lambda functions
    // The VPC will provide network isolation for the RDS instance and Lambda functions, ensuring that they can only communicate with each other and not be accessed from the public internet
    // We will create separate security groups for the RDS instance and Lambda functions to control the traffic between them
    // The security group for the RDS instance will allow inbound traffic on the PostgreSQL port (5432) only from the security group of the Lambda functions
    // Also add Interface VPC Endpoints for Secrets Manager and SQS to allow private communication between the Lambda functions and these services without going through the public internet

    // Step 2: Create a Role for the RDS instance
    // Allow to rds.amazonaws.com to write logs to CloudWatch and add Metrics.
    
    // Step 3: Create an RDS PostgreSQL instance
    // Create a subnet group for the RDS instance that includes the private subnets of the VPC
    // Create the RDS instance with the following configuration:
    // - Engine: PostgreSQL
    // - Instance type: db.t3.micro (suitable for development and testing, can be changed for production)
    // - Storage: 20 GB (can be adjusted based on needs)
    // - Credentials: RDS will automatically generate secrets for the database.
    // - VPC and security groups: Place the RDS instance in the VPC and associate it with the security group created for it

    // Step 4: Grant the RDS Role permissions to read the database credentials from the RDS instance secret.

    // Step 5: Grant the RDS Role permissions to read the database credentials from the Secrets Manager secret created in your AWS account.

    // Step 6: Create a Role for the Lambda functions
    // This role will be assumed by the Lambda functions that need to access the RDS instance
    // Grant this role permissions to read the database credentials from both the RDS instance secret and the Secrets Manager secret
    // Also grant permissions to connect to the RDS instance using the rds:Connect action, specifying the ARN of the RDS instance
    // Additionally, grant permissions for VPC access like creating and managing network interfaces, describing subnets, security groups, and route tables to allow the Lambda functions to operate within the VPC

    // Step 7: Instantiate a Lambda Layer that includes the necessary libraries to connect to the PostgreSQL database.
    // This layer will be used by the Lambda functions that need to access the RDS instance, allowing us to manage dependencies in a centralized way and keep the Lambda function code clean.

    // Step 8: Create a Lambda function to initialize the database with a user and permissions.
    // This function will be responsible for creating a new database user with the necessary permissions to access the database and perform operations on it.
    // The function will be triggered via a custom resource to ensure it runs after the RDS instance is created.

    // Step 9: Create another Lambda function to create tables on the database.
    // This function can be invoked as needed from AWS Console or other mechanisms to set up the database schema.

    // Outputs: You can add CfnOutput to share the RDS Endpoint or other resources if needed
  }
}