resource "aws_db_instance" "amp-assets-rds-dev-01" {
  #checkov:skip=CKV2_AWS_30: Ensure Postgres RDS as aws_db_instance has Query Logging enabled
  #checkov:skip=CKV_AWS_161: Ensure RDS database has IAM authentication enabled
  #checkov:skip=CKV_AWS_293: Ensure that AWS database instances have deletion protection enabled
  #checkov:skip=CKV_AWS_118: Ensure that enhanced monitoring is enabled for Amazon RDS instances
  #checkov:skip=CKV_AWS_129: Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled
  #checkov:skip=CKV_AWS_157: Ensure that RDS instances have Multi-AZ enabled
    allocated_storage                     = 20
    auto_minor_version_upgrade            = true
    availability_zone                     = "eu-central-1a"
    backup_retention_period               = 7
    backup_window                         = "07:00-07:30"
    ca_cert_identifier                    = "rds-ca-rsa2048-g1"
    copy_tags_to_snapshot                 = true
    customer_owned_ip_enabled             = false
    db_name                               = "assets"
    db_subnet_group_name = "amp-aas-d2-subnet-group"
    delete_automated_backups              = true
    deletion_protection                   = false
    enabled_cloudwatch_logs_exports       = []
    engine                                = "postgres"
    engine_version                        = "18.3"
    iam_database_authentication_enabled   = false
    instance_class                        = "db.t4g.small"
    identifier                            = "amp-assets-rds-dev-01"
    iops                                  = 3000
    kms_key_id                            = "arn:aws:kms:eu-central-1:887829410671:key/a8eb3b4f-75fa-42ea-922f-40b07cd5f247"
    license_model                         = "postgresql-license"
    maintenance_window                    = "sun:08:00-sun:08:30"
    max_allocated_storage                 = 0
    monitoring_interval                   = 0
    multi_az                              = false
    network_type                          = "IPV4"
    parameter_group_name                  = "amp-assets-rds-dev-pg18"
    #database_insights_mode                = "standard"
    #performance_insights_enabled          = true
    #performance_insights_kms_key_id       = "arn:aws:kms:eu-central-1:887829410671:key/a8eb3b4f-75fa-42ea-922f-40b07cd5f247"
    #performance_insights_retention_period = 7
    port                                  = 5432
    publicly_accessible                   = false
    skip_final_snapshot                   = true
    storage_encrypted                     = true
    storage_throughput                    = 125
    storage_type                          = "gp3"
    apply_immediately                     = true
    allow_major_version_upgrade           = true
    vpc_security_group_ids = ["sg-0e879fa9ac65a5cf8"]
    username = "master_rds"
    tags = {
        "Business-Unit" = "SME-AMP"
        "Environment"   = "Dev"
        "Project-Code"  = "SME-AMP"
        "Project-Name"  = "AMP"
    }
    tags_all = {
        "Business-Unit" = "SME-AMP"
        "Environment"   = "Dev"
        "Project-Code"  = "SME-AMP"
        "Project-Name"  = "AMP"
    }
    lifecycle {
        ignore_changes = [snapshot_identifier]
    }
    depends_on = [
        aws_db_subnet_group.amp-aas-d2-subnet-group
    ]
}

resource "aws_db_instance" "amp-assets-rds-stage-01" {
  #checkov:skip=CKV2_AWS_30: Ensure Postgres RDS as aws_db_instance has Query Logging enabled
  #checkov:skip=CKV_AWS_226: Ensure DB instance gets all minor upgrades automatically
  #checkov:skip=CKV_AWS_161: Ensure RDS database has IAM authentication enabled
  #checkov:skip=CKV_AWS_118: Ensure that enhanced monitoring is enabled for Amazon RDS instances
  #checkov:skip=CKV_AWS_157: Ensure that RDS instances have Multi-AZ enabled
    allocated_storage          = 20
    auto_minor_version_upgrade = false
    availability_zone          = "eu-central-1b"
    backup_retention_period    = 7
    backup_window              = "07:00-07:30"
    ca_cert_identifier         = "rds-ca-rsa2048-g1"
    copy_tags_to_snapshot      = true
    customer_owned_ip_enabled  = false
    db_name                    = "assets"
    db_subnet_group_name = "amp-aas-d2-subnet-group"
    delete_automated_backups   = true
    deletion_protection        = true
    enabled_cloudwatch_logs_exports = [
        "postgresql", "upgrade"
    ]
    engine                                = "postgres"
    engine_version                        = "18.3"
    iam_database_authentication_enabled   = false
    identifier = "amp-assets-rds-stage-01"
    instance_class    = "db.t4g.small"
    kms_key_id                            = "arn:aws:kms:eu-central-1:887829410671:key/a8eb3b4f-75fa-42ea-922f-40b07cd5f247"
    license_model                         = "postgresql-license"
    maintenance_window                    = "sun:08:00-sun:08:30"
    max_allocated_storage                 = 30
    monitoring_interval                   = 0
    multi_az                              = false
    network_type                          = "IPV4"
    parameter_group_name                  = "amp-assets-rds-stage-pg18"
    #database_insights_mode                = "standard"
    #performance_insights_enabled          = true
    #performance_insights_kms_key_id       = "arn:aws:kms:eu-central-1:887829410671:key/a8eb3b4f-75fa-42ea-922f-40b07cd5f247"
    #performance_insights_retention_period = 7
    port                                  = 5432
    publicly_accessible                   = false
    skip_final_snapshot = true
    storage_encrypted                     = true
    storage_type                          = "gp3"
    apply_immediately                     = true
    allow_major_version_upgrade           = true
    tags = {
        "Business-Unit" = "SME-AMP"
        "Environment"   = "Dev"
        "Owner"         = "Nathaniel Lovett"
        "Project-Code"  = "SME-AMP"
        "Project-Name"  = "AMP"
        "SSS"           = "IGNORE"
    }
    tags_all = {
        "Business-Unit" = "SME-AMP"
        "Environment"   = "Dev"
        "Owner"         = "Nathaniel Lovett"
        "Project-Code"  = "SME-AMP"
        "Project-Name"  = "AMP"
        "SSS"           = "IGNORE"
    }
    username = "master_rds"
    vpc_security_group_ids = ["sg-04e98c4fec4effea8"]
    lifecycle {
        ignore_changes = [snapshot_identifier]
    }
    depends_on = [
        aws_db_subnet_group.amp-aas-d2-subnet-group
    ]
}