resource "aws_security_group" "rds_cluster" {
  name        = "rds-postgres-cluster"
  description = "Allow Postgres traffic to rds"
  vpc_id      = data.aws_ssm_parameter.vpc_id.value

  ingress {
    description     = "TLS from VPC"
    from_port       = 5432
    to_port         = 5432
    protocol        = "tcp"
    cidr_blocks     = [data.aws_ssm_parameter.vpc_cidr.value]
    security_groups = [aws_security_group.rds_proxy.id]
    // Cluster should accept traffic from RDS proxy Security group
  }

  egress {
    from_port        = 0
    to_port          = 0
    protocol         = "-1"
    cidr_blocks      = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }
}
  

  
resource "aws_rds_cluster" "demo" {
  cluster_identifier                  = "${var.service}-${var.stage}-demo"
  database_name                       = "demo"
  master_username                     = "hyatt_main"
  master_password                     = random_password.rds_demo.result
  engine                              = "aurora-postgresql"
  engine_mode                         = "provisioned"
  engine_version                      = "13.6"
  storage_encrypted                   = true
  kms_key_id                          = module.main_kms.alias_target_key_arn
  vpc_security_group_ids              = [aws_security_group.rds_cluster.id]
  db_subnet_group_name                = aws_db_subnet_group.cortex_back.id
  availability_zones                  = ["us-east-2a", "us-east-2b", "us-east-2c"]
  iam_database_authentication_enabled = true


  serverlessv2_scaling_configuration {
    max_capacity = 2.0
    min_capacity = 1.0
  }
}

#RDS Cluster Instance

resource "aws_rds_cluster_instance" "demo" {
  identifier          = "${var.stage}-demo-1"
  cluster_identifier  = aws_rds_cluster.demo.id
  instance_class      = "db.serverless"
  engine              = aws_rds_cluster.demo.engine
  engine_version      = aws_rds_cluster.demo.engine_version
  publicly_accessible = false

}

  

  
resource "aws_secretsmanager_secret_version" "rds_credentials" {
  secret_id     = aws_secretsmanager_secret.rds_credentials.id
  secret_string = \<

  
resource "aws_iam_role" "rds_proxy_secrets_access" {
  name = "rds_proxy_secrets_access"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Sid    = ""
        Principal = {
          Service = "rds.amazonaws.com"
        }
      },
    ]
  })


  inline_policy {
    name = "my_inline_policy"

    policy = jsonencode({
      Version = "2012-10-17"
      Statement = [
        {
          Action   = ["secretsmanager:GetSecretValue"]
          Effect   = "Allow"
          Resource = "${aws_secretsmanager_secret.rds_credentials.arn}"
        },
        {
          Action   = ["kms:Decrypt"]
          Effect   = "Allow"
          Resource = "*"
          Condition = {
            StringEquals = {
              "kms:ViaService" = "secretsmanager.us-east-2.amazonaws.com"
            }
          }
        },
      ]
    })
  }
}
  

  
# RDS Proxy Security Group

resource "aws_security_group" "rds_proxy" {
  name        = "rds-postgres-proxy-sg"
  description = "Allow Postgres traffic to rds from proxy"
  vpc_id      = data.aws_ssm_parameter.vpc_id.value

  ingress {
    description = "TLS from VPC"
    from_port   = 5432
    to_port     = 5432
    protocol    = "tcp"
    cidr_blocks = [data.aws_ssm_parameter.vpc_cidr.value]
  }
  egress {
    from_port        = 0
    to_port          = 0
    protocol         = "-1"
    cidr_blocks      = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }
}
  

  
# RDS Proxy

resource "aws_db_proxy" "demo" {
  name                   = "demo"
  debug_logging          = true
  engine_family          = "POSTGRESQL"
  idle_client_timeout    = 1800
  require_tls            = true
  role_arn               = aws_iam_role.rds_proxy_secrets_access.arn
  vpc_security_group_ids = [aws_security_group.rds_proxy.id]
  vpc_subnet_ids         = [data.aws_ssm_parameter.private_subneta.value, data.aws_ssm_parameter.private_subnetb.value, data.aws_ssm_parameter.private_subnetc.value]

  auth {
    auth_scheme = "SECRETS"
    description = "example"
    iam_auth    = "REQUIRED"
    secret_arn  = aws_secretsmanager_secret.rds_credentials.arn
  }

  tags = {
    Name = "Name"
    Key  = "demo"
  }
}

# RDS Proxy Target Group

resource "aws_db_proxy_default_target_group" "demo" {
  db_proxy_name = aws_db_proxy.demo.name

  connection_pool_config {
    connection_borrow_timeout    = 120
    max_connections_percent      = 100
    max_idle_connections_percent = 50
  }
}

# RDS Proxy Target

resource "aws_db_proxy_target" "demo" {
  db_instance_identifier = aws_rds_cluster_instance.demo.id
  db_proxy_name          = aws_db_proxy.demo.name
  target_group_name      = aws_db_proxy_default_target_group.demo.name
}

  

  
// rds.ts

import { Signer } from '@aws-sdk/rds-signer';
import { Client } from 'pg';


// Get an IAM token, This will be used as a password to connect to RDS Proxy

 const signer = new Signer({
    hostname: 'Your RDS Proxy Endpoint',
    port: 5432,
    username: 'RDS Cluster Username',
    region: 'us-east-2',
  });

  const token = await signer.getAuthToken();


    const client = new Client({
      user: 'RDS Cluster Username',
      host: 'Your RDS Proxy Endpoint',
      database: 'DB name',
      password: token, // IAM token
      port: 5432,
      ssl: true,
    });

    await client.connect();
    await client.query(`select * from 'your table name'`);

  

  
{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Effect": "Allow",
         "Action": [
             "rds-db:connect"
         ],
         "Resource": [
             "arn:aws:rds-db:region:awsaccountnumber:dbuser:{proxyIdentifier from your rds proxy arn}/*"
         ]
      }
   ]
}