From 2392ebe5fb17320c651211efca3b90a131db5b3c Mon Sep 17 00:00:00 2001 From: Jay Dreyer Date: Fri, 14 Aug 2026 11:12:35 -0500 Subject: [PATCH] Fix RDS parameter group convergence --- infra/terraform/environments/demo/database.tf | 5 +++-- .../environments/demo/tests/architecture.tftest.hcl | 8 ++++++++ 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/infra/terraform/environments/demo/database.tf b/infra/terraform/environments/demo/database.tf index 4c53584..d4cd623 100644 --- a/infra/terraform/environments/demo/database.tf +++ b/infra/terraform/environments/demo/database.tf @@ -12,8 +12,9 @@ resource "aws_db_parameter_group" "postgres17" { family = "postgres17" parameter { - name = "rds.force_ssl" - value = "1" + apply_method = "pending-reboot" + name = "rds.force_ssl" + value = "1" } tags = { diff --git a/infra/terraform/environments/demo/tests/architecture.tftest.hcl b/infra/terraform/environments/demo/tests/architecture.tftest.hcl index f749d91..ed6db2a 100644 --- a/infra/terraform/environments/demo/tests/architecture.tftest.hcl +++ b/infra/terraform/environments/demo/tests/architecture.tftest.hcl @@ -119,6 +119,14 @@ run "adr_0022_off_state" { error_message = "RDS deletion protection must be enabled by default." } + assert { + condition = alltrue([ + for parameter in aws_db_parameter_group.postgres17.parameter : + parameter.name != "rds.force_ssl" || parameter.apply_method == "pending-reboot" + ]) + error_message = "The static rds.force_ssl parameter must use pending-reboot so Terraform converges after creation." + } + assert { condition = aws_ecs_task_definition.application.cpu == "1024" && aws_ecs_task_definition.application.memory == "2048" error_message = "The application task must retain the approved 1 vCPU / 2 GiB size."