From 03312ba4c6a4b686d83569637bc5fa8ca90a92a1 Mon Sep 17 00:00:00 2001 From: Alex English Date: Sat, 17 Oct 2026 12:12:39 -0700 Subject: [PATCH 1/2] Add 20 GiB replacement for the shared RDS instance --- terraform/database.tf | 62 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 62 insertions(+) diff --git a/terraform/database.tf b/terraform/database.tf index b140133..4332042 100644 --- a/terraform/database.tf +++ b/terraform/database.tf @@ -86,6 +86,68 @@ resource "aws_db_instance" "default" { vpc_security_group_ids = ["sg-0ab8947eeb3d705ac"] } +# Replacement for aws_db_instance.default on a 20 GiB volume. RDS cannot shrink +# allocated storage, so the data moves by pg_dump/pg_restore and the two instances +# then swap identifiers, which keeps the endpoint hostname -- and every connection +# URL -- unchanged. See hackforla/incubator#267. +# +# Until that swap this is "incubator-prod-database-new"; a follow-up PR renames it +# here and removes the old block. Every attribute matches the old instance except +# identifier, allocated_storage, storage_type and max_allocated_storage. +# +# gp3 rather than gp2: gp2 baseline IOPS scale with size (3 per GiB, minimum 100), +# so 20 GiB of gp2 would drop from 300 to 100 IOPS. gp3 is a flat 3,000 at the +# same price. With max_allocated_storage set, the provider ignores the difference +# from allocated_storage once autoscaling grows the volume. +# +# The master password reuses var.pgpassword, so TF_VAR_PGPASSWORD stays valid. +# password_wo keeps it out of state; bump password_wo_version to push a new one. +resource "aws_db_instance" "incubator_prod" { + allocated_storage = 20 + allow_major_version_upgrade = true + apply_immediately = true + auto_minor_version_upgrade = true + availability_zone = "us-west-2a" + backup_retention_period = 4 + backup_target = "region" + backup_window = "03:00-06:00" + ca_cert_identifier = "rds-ca-rsa2048-g1" + copy_tags_to_snapshot = true + customer_owned_ip_enabled = false + db_subnet_group_name = aws_db_subnet_group.incubator_prod.name + deletion_protection = false + enabled_cloudwatch_logs_exports = ["postgresql", "upgrade"] + engine = "postgres" + engine_lifecycle_support = "open-source-rds-extended-support" + engine_version = "15" + iam_database_authentication_enabled = false + identifier = "incubator-prod-database-new" + instance_class = "db.t3.small" + max_allocated_storage = 50 + multi_az = false + network_type = "IPV4" + parameter_group_name = aws_db_parameter_group.postgres15.name + password_wo = var.pgpassword + password_wo_version = 1 + port = 5432 + publicly_accessible = true + skip_final_snapshot = true + storage_encrypted = false + storage_type = "gp3" + + tags = { + Name = "incubator-prod-database" + } + + username = "postgres" + + vpc_security_group_ids = ["sg-0ab8947eeb3d705ac"] + + lifecycle { + prevent_destroy = true + } +} + # RDS creates these two because the instance sets enabled_cloudwatch_logs_exports. # Neither had any retention at all, so postgresql had accumulated 964 MB since 2021 and # would never have expired. 180 days is the agreed window; note that applying it deletes From fa9b49d8cf9eb1303d428653963ee20fd05702c9 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Sat, 17 Oct 2026 19:12:57 +0000 Subject: [PATCH 2/2] terraform-docs: automated updates to Terraform modules README.md [skip ci] --- terraform/README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/terraform/README.md b/terraform/README.md index e72c7ce..7c1e275 100644 --- a/terraform/README.md +++ b/terraform/README.md @@ -35,6 +35,7 @@ | [aws_cognito_user_pool.shared](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_user_pool) | resource | | [aws_cognito_user_pool_domain.shared](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_user_pool_domain) | resource | | [aws_db_instance.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance) | resource | +| [aws_db_instance.incubator_prod](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance) | resource | | [aws_db_parameter_group.postgres15](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_parameter_group) | resource | | [aws_db_subnet_group.incubator_prod](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_subnet_group) | resource | | [aws_iam_policy.incubator_builder](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |