Add 20 GiB replacement for the shared RDS instance

terraform/README.md

@@ -35,6 +35,7 @@
 | [aws_cognito_user_pool.shared](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_user_pool) | resource |
 | [aws_cognito_user_pool_domain.shared](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_user_pool_domain) | resource |
 | [aws_db_instance.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance) | resource |
+| [aws_db_instance.incubator_prod](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance) | resource |
 | [aws_db_parameter_group.postgres15](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_parameter_group) | resource |
 | [aws_db_subnet_group.incubator_prod](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_subnet_group) | resource |
 | [aws_iam_policy.incubator_builder](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |

terraform/database.tf

@@ -86,6 +86,68 @@ resource "aws_db_instance" "default" {
   vpc_security_group_ids = ["sg-0ab8947eeb3d705ac"]
 }
 
+# Replacement for aws_db_instance.default on a 20 GiB volume. RDS cannot shrink
+# allocated storage, so the data moves by pg_dump/pg_restore and the two instances
+# then swap identifiers, which keeps the endpoint hostname -- and every connection
+# URL -- unchanged. See hackforla/incubator#267.
+#
+# Until that swap this is "incubator-prod-database-new"; a follow-up PR renames it
+# here and removes the old block. Every attribute matches the old instance except
+# identifier, allocated_storage, storage_type and max_allocated_storage.
+#
+# gp3 rather than gp2: gp2 baseline IOPS scale with size (3 per GiB, minimum 100),
+# so 20 GiB of gp2 would drop from 300 to 100 IOPS. gp3 is a flat 3,000 at the
+# same price. With max_allocated_storage set, the provider ignores the difference
+# from allocated_storage once autoscaling grows the volume.
+#
+# The master password reuses var.pgpassword, so TF_VAR_PGPASSWORD stays valid.
+# password_wo keeps it out of state; bump password_wo_version to push a new one.
+resource "aws_db_instance" "incubator_prod" {
+  allocated_storage                   = 20
+  allow_major_version_upgrade         = true
+  apply_immediately                   = true
+  auto_minor_version_upgrade          = true
+  availability_zone                   = "us-west-2a"
+  backup_retention_period             = 4
+  backup_target                       = "region"
+  backup_window                       = "03:00-06:00"
+  ca_cert_identifier                  = "rds-ca-rsa2048-g1"
+  copy_tags_to_snapshot               = true
+  customer_owned_ip_enabled           = false
+  db_subnet_group_name                = aws_db_subnet_group.incubator_prod.name
+  deletion_protection                 = false
+  enabled_cloudwatch_logs_exports     = ["postgresql", "upgrade"]
+  engine                              = "postgres"
+  engine_lifecycle_support            = "open-source-rds-extended-support"
+  engine_version                      = "15"
+  iam_database_authentication_enabled = false
+  identifier                          = "incubator-prod-database-new"
+  instance_class                      = "db.t3.small"
+  max_allocated_storage               = 50
+  multi_az                            = false
+  network_type                        = "IPV4"
+  parameter_group_name                = aws_db_parameter_group.postgres15.name
+  password_wo                         = var.pgpassword
+  password_wo_version                 = 1
+  port                                = 5432
+  publicly_accessible                 = true
+  skip_final_snapshot                 = true
+  storage_encrypted                   = false
+  storage_type                        = "gp3"
+
+  tags = {
+    Name = "incubator-prod-database"
+  }
+
+  username = "postgres"
+
+  vpc_security_group_ids = ["sg-0ab8947eeb3d705ac"]
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
 # RDS creates these two because the instance sets enabled_cloudwatch_logs_exports.
 # Neither had any retention at all, so postgresql had accumulated 964 MB since 2021 and
 # would never have expired. 180 days is the agreed window; note that applying it deletes