first commit

.github/workflows/action.yml

@@ -0,0 +1,52 @@
+name: "Terraform-MongoDB-User Module"
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  terraform-checks:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v2
+
+      - uses: hashicorp/setup-terraform@v1
+        with:
+          terraform_version: 1.6.3
+
+      - uses: terraform-linters/setup-tflint@v3
+        name: Setup TFLint
+        with:
+          tflint_version: v0.44.1
+
+      - name: Terraform Init
+        id: tf-init
+        run: terraform init
+
+      - name: Terraform Validate
+        id: tf-validate
+        run: terraform validate
+
+      - name: Terraform Format Check
+        id: tf-fmt-check
+        run: terraform fmt -recursive -check
+        continue-on-error: true
+
+      - name: Show version
+        run: tflint --version
+
+      - name: Init TFLint
+        run: tflint --init
+        env:
+          # https://github.com/terraform-linters/tflint/blob/master/docs/user-guide/plugins.md#avoiding-rate-limiting
+          GITHUB_TOKEN: ${{ github.token }}
+
+      - name: Run TFLint
+        run: tflint -f compact
+
+      - name: TFSec
+        uses: aquasecurity/tfsec-action@v1.0.0
+        with:
+          soft_fail: true

.gitignore

@@ -0,0 +1,37 @@
+.DS_Store
+*.lock.hcl
+
+# Local .terraform directories
+**/.terraform/*
+
+# .tfstate files
+*.tfstate
+*.tfstate.*
+
+# Crash log files
+crash.log
+crash.*.log
+
+# Exclude all .tfvars files, which are likely to contain sensitive data, such as
+# password, private keys, and other secrets. These should not be part of version
+# control as they are data points which are potentially sensitive and subject
+# to change depending on the environment.
+# *.tfvars
+*.tfvars.json
+
+# Ignore override files as they are usually used to override resources locally and so
+# are not checked in
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+
+# Include override files you do wish to add to version control using negated pattern
+# !example_override.tf
+
+# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
+# example: *tfplan*
+
+# Ignore CLI configuration files
+.terraformrc
+terraform.rc

.pre-commit-config.yaml

@@ -0,0 +1,15 @@
+repos:
+- repo: https://github.com/pre-commit/pre-commit-hooks
+  rev: v2.3.0
+  hooks:
+  - id: trailing-whitespace
+  - id: end-of-file-fixer
+  - id: check-yaml
+  - id: check-added-large-files
+- repo: https://github.com/antonbabenko/pre-commit-terraform
+  rev: v1.64.1
+  hooks:
+  - id: terraform_validate
+  - id: terraform_fmt
+  - id: terraform_tflint
+  - id: terraform_tfsec

LICENSE

@@ -0,0 +1,28 @@
+BSD 3-Clause License
+
+Copyright (c) 2023, ridwanfs
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

README.md

@@ -0,0 +1,209 @@
+# Terraform MongoDB User
+
+This is a Terraform module for managing user access at MongoDB. You can use this module both for commercial or non-commercial purposes.
+
+Currently, you can manage these resources in MongoDB by using this module:
+
+- users
+- roles
+
+Tested in:
+
+- MongoDB
+
+## A. Prerequisites
+
+Requirements:
+
+- Terraform with version >= 1.4
+- Kaginari/mongodb
+- Hashicorp/random
+
+Before we continue to use the module, please pay attention to these terms for `database `in this module:
+
+- `role_db`, selected database for storing role configuration. Default value from tf-provider is `admin`
+- `target_db`, selected database which the privilege will be assigned to.
+- `auth_database`, database that will be used by the user for authentication
+
+## B. How to use this module for your Terraform project ?
+
+- Copy `example/basic-1` project from this module. You can extend it as per your requirements
+- Configure MongoDB host and port by modifying the `providers.tf`. For example `localhost` and `27017`
+  - If you want to use another authentication method, [please read more at the provider documentation](https://registry.terraform.io/providers/Kaginari/mongodb/latest/docs)
+- Configure `TF_VAR_mongodb_username` and `TF_VAR_mongodb_password` as environment variables. For example:
+
+```
+$ export TF_VAR_mongodb_username=root
+$ export TF_VAR_mongodb_password=example
+```
+
+- Check `terraform.tfvars` inside the Project. Please try to see how the variables configured.
+- Adjust the tfvars based on your requirements. The tfvars is just example. Then, Save it
+- Run these commands:
+
+```
+$ terraform init
+$ terraform plan
+```
+This is the output when you run terraform plan successfully:
+
+```
+...
+
+  # module.tf_mongodb_user.random_password.password["septian"] will be created
+  + resource "random_password" "password" {
+      + bcrypt_hash      = (sensitive value)
+      + id               = (known after apply)
+      + length           = 16
+      + lower            = true
+      + min_lower        = 0
+      + min_numeric      = 0
+      + min_special      = 0
+      + min_upper        = 0
+      + number           = true
+      + numeric          = true
+      + override_special = "!#$%&*()-_=+[]{}<>:?"
+      + result           = (sensitive value)
+      + special          = true
+      + upper            = true
+    }
+
+Plan: 10 to add, 0 to change, 0 to destroy.
+
+Changes to Outputs:
+  + mongodb_roles = {
+      + developer = "admin"
+      + guest     = "admin"
+    }
+  + mongodb_users = {
+      + bejo    = "reporting"
+      + fadjar  = "reporting"
+      + ridwan  = "reporting"
+      + septian = "reporting"
+    }
+
+```
+
+After you feel confidence with the terraform plan output, let's apply it.
+
+```
+$ terraform apply -auto-approve
+```
+
+- If it succeed, you must see this kind of output on your terminal
+
+```
+...
+
+module.tf_mongodb_user.mongodb_db_role.roles["developer"]: Creation complete after 0s [id=YWRtaW4uZGV2ZWxvcGVy]
+module.tf_mongodb_user.mongodb_db_role.roles["guest"]: Creation complete after 0s [id=YWRtaW4uZ3Vlc3Q=]
+module.tf_mongodb_user.random_password.password["septian"]: Creation complete after 0s [id=none]
+module.tf_mongodb_user.random_password.password["bejo"]: Creation complete after 0s [id=none]
+module.tf_mongodb_user.random_password.password["fadjar"]: Creation complete after 0s [id=none]
+module.tf_mongodb_user.random_password.password["ridwan"]: Creation complete after 0s [id=none]
+module.tf_mongodb_user.mongodb_db_user.users["bejo"]: Creating...
+module.tf_mongodb_user.mongodb_db_user.users["fadjar"]: Creating...
+module.tf_mongodb_user.mongodb_db_user.users["septian"]: Creating...
+module.tf_mongodb_user.mongodb_db_user.users["ridwan"]: Creating...
+module.tf_mongodb_user.mongodb_db_user.users["bejo"]: Creation complete after 0s [id=cmVwb3J0aW5nLmJlam8=]
+module.tf_mongodb_user.mongodb_db_user.users["ridwan"]: Creation complete after 0s [id=cmVwb3J0aW5nLnJpZHdhbg==]
+module.tf_mongodb_user.mongodb_db_user.users["septian"]: Creation complete after 0s [id=cmVwb3J0aW5nLnNlcHRpYW4=]
+module.tf_mongodb_user.mongodb_db_user.users["fadjar"]: Creation complete after 0s [id=cmVwb3J0aW5nLmZhZGphcg==]
+
+Apply complete! Resources: 10 added, 0 changed, 0 destroyed.
+
+Outputs:
+
+mongodb_roles = {
+  "developer" = "admin"
+  "guest" = "admin"
+}
+mongodb_users = {
+  "bejo" = "reporting"
+  "fadjar" = "reporting"
+  "ridwan" = "reporting"
+  "septian" = "reporting"
+}
+```
+
+You will see at your MongoDB that users and roles are created once the terraform applied.
+
+## C. Understanding tfvars scenarios
+
+There are some scenarios that you could choose when using this module. For example:
+
+1. user could be assined without any roles
+
+```
+mongodb_users = [
+  {
+    name          = "bejo"
+    auth_database = "reporting"
+    roles         = []
+  },
+]
+
+```
+
+2. user could be assigned with default roles (e.g. readAnyDatabase)
+
+```
+mongodb_users = [
+  {
+    name          = "septian"
+    auth_database = "reporting"
+    roles = [
+      {
+        name    = "readAnyDatabase",
+        role_db = "admin"
+      }
+    ]
+  },
+]
+
+```
+
+3. user could be assigned with custom roles (e.g. developer)
+
+```
+mongodb_users = [
+  {
+    name          = "ridwan"
+    auth_database = "reporting"
+    roles = [
+      {
+        name    = "developer",
+        role_db = "admin"
+      }
+    ]
+  },
+]
+```
+
+## D. Ensuring quality
+
+I am trying to follow these approaches for ensuring quality of the tf-module:
+
+- **validate**, ensure my Terraform module is in correct configuration based on Terraform guideline
+- **auto-format**, ensure my Terraform script is edited with correct format based on Terraform guideline
+- **linter**, ensure my Terraform script is in correct format based on Terraform guideline
+- **security**, ensure my Terraform module is free from CVE and stay compliance
+- **automation**, run all above steps by using automation tool to improve development time and keep best quality before or after merging to Git repository
+
+
+The tools:
+
+- [terraform validate](https://developer.hashicorp.com/terraform/cli/commands)
+- [terraform fmt](https://developer.hashicorp.com/terraform/cli/commands)
+- [tflint](https://github.com/terraform-lint48ers/tflint)
+- [tfsec](https://github.com/aquasecurity/tfsec)
+- [Pre-commit](https://pre-commit.com/)
+- Github Action [Setup Terraform pipeline](https://github.com/hashicorp/setup-terraform)
+
+## E. How to contribute ?
+
+If you find any issue, you can raise it here at our [Issue Tracker](https://github.com/ridwanbejo/terraform-mongodb-user/issues)
+
+If you have something that you want to merge to this repo, just raise [Pull Requests](https://github.com/ridwanbejo/terraform-mongodb-user/pulls)
+
+Ensure that you install all the tools from section D. for development purpose.

examples/config-1-basic/locals.tf

@@ -0,0 +1,3 @@
+locals {
+
+}

examples/config-1-basic/main.tf

@@ -0,0 +1,7 @@
+module "tf_postgres_config" {
+  source            = "../../modules/config"
+  extensions        = var.postgres_extension
+  replication_slots = var.postgres_replication_slots
+
+  physical_replication_slots = var.postgres_physical_replication_slots
+}

examples/config-1-basic/outputs.tf

@@ -0,0 +1,5 @@
+output "postgres_extension" {
+  description = "Current PostgreSQL Extensions"
+  value       = module.tf_postgres_config.postgres_extensions
+}
+

examples/config-1-basic/providers.tf

@@ -0,0 +1,24 @@
+terraform {
+  required_version = ">= 1.4"
+
+  required_providers {
+    postgresql = {
+      source = "cyrilgdn/postgresql"
+      version = "1.21.1-beta.1"
+    }
+
+    random = {
+      source  = "hashicorp/random"
+      version = "3.5.1"
+    }
+  }
+}
+
+provider "postgresql" {
+  host     = "127.0.0.1"
+  port     = "5432"
+  database = "postgres"
+  username = "postgres"
+  password = "example"
+  sslmode  = "disable"
+}