rds instance only ever in private subnet

Author: chpy04

.ebextensions/03_install_psql.config

@@ -0,0 +1,8 @@
+###############################################################################
+# Install PostgreSQL client on EC2 host for direct database access
+# This allows running psql commands without entering the Docker container
+###############################################################################
+
+packages:
+  yum:
+    postgresql15: []

infrastructure/environments/production/main.tf

@@ -46,7 +46,6 @@ module "network" {
   environment  = local.environment
   aws_region   = var.aws_region
   vpc_cidr     = var.vpc_cidr
-  allowed_ips  = var.allowed_ips
 }
 
 #############
@@ -122,9 +121,10 @@ module "rds" {
   database_name        = var.database_name
   master_username      = var.db_master_username
   master_password      = module.secrets.db_password
+  # Keep RDS in private subnets (best practice for production)
   db_subnet_group_name = module.network.db_subnet_group_name
   security_group_id    = module.network.rds_security_group_id
-  publicly_accessible  = var.rds_publicly_accessible
+  publicly_accessible  = false  # Keep private for security
   multi_az             = var.rds_multi_az
 
   # Backup configuration

infrastructure/environments/production/terraform.tfvars.example

@@ -6,19 +6,16 @@
 aws_region = "us-east-1"
 
 # Network Configuration
-# Add your IP addresses here to allow direct RDS access (for psql, TablePlus, etc.)
-# Find your IP: curl ifconfig.me
-allowed_ips = [
-  # IP 1,
-  # IP 2
-]
+vpc_cidr = "10.0.0.0/16"
+
+# Database Configuration
 database_name      = "finishline"
 db_master_username = "postgres"
 
 # RDS Configuration
 rds_instance_class      = "db.t4g.medium"
 rds_allocated_storage   = 20
-rds_publicly_accessible = false 
+rds_publicly_accessible = false  # Always false for production 
 rds_multi_az            = false  # Set to true for high availability (costs 2x)
 
 # Elastic Beanstalk Configuration

infrastructure/environments/production/variables.tf

@@ -28,18 +28,6 @@ variable "vpc_cidr" {
   default     = "10.0.0.0/16"
 }
 
-variable "allowed_ips" {
-  description = "List of IP addresses (in CIDR notation) allowed to access RDS directly. Leave empty for no direct access."
-  type        = list(string)
-  default     = []
-  
-  # Example:
-  # allowed_ips = [
-  #   "73.123.45.67/32",  # Your home IP
-  #   "52.98.76.54/32"    # Your office IP
-  # ]
-}
-
 #####################
 # RDS Variables
 #####################
@@ -75,7 +63,7 @@ variable "db_master_username" {
 }
 
 variable "rds_publicly_accessible" {
-  description = "Whether RDS should be publicly accessible"
+  description = "Whether RDS should be publicly accessible (should always be false for production)"
   type        = bool
   default     = false
 }

infrastructure/modules/network/main.tf

@@ -191,13 +191,7 @@ resource "aws_security_group" "rds" {
   description = "Security group for RDS database"
   vpc_id      = aws_vpc.main.id
 
-  ingress {
-    description     = "PostgreSQL from EB instances"
-    from_port       = 5432
-    to_port         = 5432
-    protocol        = "tcp"
-    security_groups = [aws_security_group.eb_instance.id]
-  }
+  # No inline rules - all rules defined separately below
 
   egress {
     description = "Allow all outbound traffic"
@@ -219,22 +213,20 @@ resource "aws_security_group" "rds" {
 }
 
 #############
-# Security Group Rule - RDS Access from Whitelisted IPs
+# Security Group Rule - RDS Access from EB Instances
 #############
-resource "aws_security_group_rule" "rds_from_whitelisted_ips" {
-  count = length(var.allowed_ips) > 0 ? 1 : 0
-
-  type              = "ingress"
-  description       = "PostgreSQL from whitelisted IPs"
-  from_port         = 5432
-  to_port           = 5432
-  protocol          = "tcp"
-  cidr_blocks       = var.allowed_ips
-  security_group_id = aws_security_group.rds.id
+resource "aws_security_group_rule" "rds_from_eb" {
+  type                     = "ingress"
+  description              = "PostgreSQL from EB instances"
+  from_port                = 5432
+  to_port                  = 5432
+  protocol                 = "tcp"
+  source_security_group_id = aws_security_group.eb_instance.id
+  security_group_id        = aws_security_group.rds.id
 }
 
 #############
-# DB Subnet Group for RDS
+# DB Subnet Group for RDS (Private Subnets)
 #############
 resource "aws_db_subnet_group" "main" {
   name       = "${var.project_name}-${var.environment}-db-subnet-group"

infrastructure/modules/network/outputs.tf

@@ -36,7 +36,7 @@ output "rds_security_group_id" {
 }
 
 output "db_subnet_group_name" {
-  description = "Name of the DB subnet group"
+  description = "Name of the DB subnet group (private subnets)"
   value       = aws_db_subnet_group.main.name
 }
 

infrastructure/modules/network/variables.tf

@@ -20,16 +20,3 @@ variable "vpc_cidr" {
   type        = string
   default     = "10.0.0.0/16"
 }
-
-variable "allowed_ips" {
-  description = "List of IP addresses (in CIDR notation) allowed to access RDS directly"
-  type        = list(string)
-  default     = []
-  
-  validation {
-    condition = alltrue([
-      for ip in var.allowed_ips : can(regex("^([0-9]{1,3}\\.){3}[0-9]{1,3}/[0-9]{1,2}$", ip))
-    ])
-    error_message = "IPs must be in CIDR notation (e.g., '192.168.1.1/32')"
-  }
-}