RDS network fix auto-drive

[DaMandal0rian]

PR Type

Enhancement, Bug fix

---

Description

• Updated RDS subnet group configuration for better modularity.

• Added lifecycle rules to EC2 instances to ignore specific changes.

• Replaced hardcoded subnet configurations with dynamic private subnets.

• Removed VPC RDS module and one VPC for EC2 and RDS.

• moved RDS instance to same private subnet as EC2 instances

• Change RDS instance type for more resources

---

Changes walkthrough 📝

Relevant files

Enhancement

db.tf Refactored RDS subnet and security group configurations    auto-drive/db.tf Updated db_subnet_group_name to use aws_db_subnet_group. Added a new aws_db_subnet_group resource for dynamic subnet configuration. Removed the vpc_rds module and adjusted dependencies accordingly. Set publicly_accessible to false for enhanced security. +11/-20  main.tf Added private subnet configuration to VPC module                  auto-drive/main.tf Updated vpc module to include private_subnets configuration. Adjusted tags and formatting for consistency. +6/-6      main.tf Added lifecycle rules to EC2 instance resources                    templates/terraform/aws/ec2/main.tf Added lifecycle rules to ignore changes to ami, private_ip, and associate_public_ip_address. Updated both aws_instance and aws_instance.ignore_ami resources. +11/-1

---

Need help?

Type /help how to ... in the comments thread for any questions about PR-Agent usage.

Check out the documentation for more information.

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 4 🔵🔵🔵🔵⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Possible Misconfiguration The db_subnet_group_name now references aws_db_subnet_group.db_subnet_group.name, which is dynamically created. Ensure that this change does not conflict with existing configurations or dependencies. db_subnet_group_name = aws_db_subnet_group.db_subnet_group.name vpc_security_group_ids = [module.security_group.security_group_id] publicly_accessible = false Lifecycle Ignore Changes The lifecycle block for aws_instance resources now ignores changes to ami, private_ip, and associate_public_ip_address. Validate that ignoring these changes will not cause unintended consequences during updates or scaling. lifecycle { ignore_changes = [ ami, private_ip, associate_public_ip_address, ] }

[github-actions]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Score
Security	Restrict security group ingress CIDR blocks Verify that the cidr_blocks value in the security group ingress rule is appropriately restricted to trusted IP ranges to prevent unauthorized access. auto-drive/db.tf [141] -cidr_blocks = module.vpc.vpc_cidr_block +cidr_blocks = ["<trusted-ip-range>"] # Replace with specific trusted IP ranges Suggestion importance[1-10]: 8 Why: Restricting the cidr_blocks to trusted IP ranges is a critical security improvement. The suggestion is actionable and addresses a potential vulnerability in the security group configuration.	8
	Validate database public access configuration Ensure that the publicly_accessible attribute is set to false only if the database does not require public access. If public access is necessary for specific use cases, consider implementing additional security measures such as IP whitelisting. auto-drive/db.tf [35] -publicly_accessible = false +publicly_accessible = false # Ensure this aligns with access requirements Suggestion importance[1-10]: 7 Why: The suggestion to validate the publicly_accessible attribute is relevant for ensuring security and proper configuration. While it does not introduce a direct code change, it emphasizes an important security consideration, which is valuable.	7
General	Verify subnet CIDR block configurations Confirm that the private_subnets and public_subnets CIDR blocks do not overlap and are appropriately sized to avoid potential network conflicts. auto-drive/main.tf [35-36] -private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] -public_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"] +private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] # Ensure no overlap with public subnets +public_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"] # Validate against private subnets Suggestion importance[1-10]: 7 Why: Ensuring that private and public subnet CIDR blocks do not overlap is an important step in avoiding network conflicts. The suggestion is relevant and promotes good network design practices.	7
	Validate lifecycle ignore changes configuration Review the ignore_changes lifecycle block to ensure that ignoring changes to ami, private_ip, and associate_public_ip_address does not inadvertently prevent necessary updates or cause configuration drift. templates/terraform/aws/ec2/main.tf [194-199] lifecycle { ignore_changes = [ - ami, - private_ip, - associate_public_ip_address, + ami, # Ensure AMI updates are managed externally + private_ip, # Confirm static IPs are not required + associate_public_ip_address, # Validate public IP association needs ] } Suggestion importance[1-10]: 6 Why: The suggestion to review the ignore_changes lifecycle block is valid and encourages careful consideration of potential configuration drift. However, it does not directly address a specific issue or provide a concrete improvement.	6

[DaMandal0rian]

closes #395