resource "aws_db_instance" "ameba-rds-prod" {
  # checkov:skip=CKV_AWS_118: Ensure that enhanced monitoring is enabled for Amazon RDS instances
  # checkov:skip=CKV_AWS_157: Ensure that RDS instances have Multi-AZ enabled
  # checkov:skip=CKV_AWS_161: Ensure RDS database has IAM authentication enabled
  # checkov:skip=CKV_AWS_226: Ensure DB instance gets all minor upgrades automatically
  # checkov:skip=CKV2_AWS_30: Ensure Postgres RDS as aws_db_instance has Query Logging enabled
  allocated_storage          = 500
  auto_minor_version_upgrade = false
  #  availability_zone          = "eu-central-1b"
  backup_retention_period   = 7
  backup_window             = "07:00-07:30"
  ca_cert_identifier        = "rds-ca-rsa2048-g1"
  copy_tags_to_snapshot     = true
  customer_owned_ip_enabled = false
  db_name                   = "ameba"
  db_subnet_group_name      = "aoma-p1-rds-sng"
  delete_automated_backups  = true
  deletion_protection       = true
  enabled_cloudwatch_logs_exports = [
    "postgresql",
    "upgrade",
  ]
  engine                                = "postgres"
  engine_version                        = "17.7"
  iam_database_authentication_enabled   = false
  identifier                            = "ameba-rds-prod"
  instance_class                        = "db.m6g.large"
  iops                                  = 12000
  kms_key_id                            = "arn:aws:kms:eu-central-1:613871678587:key/f3f00387-1ce2-4e0b-8528-dfcb0a8a56c0"
  license_model                         = "postgresql-license"
  maintenance_window                    = "sun:08:00-sun:08:30"
  max_allocated_storage                 = 550
  monitoring_interval                   = 0
  multi_az                              = false
  network_type                          = "IPV4"
  parameter_group_name                  = "ameba-rds-prod-config-v17"
  performance_insights_enabled          = true
  performance_insights_kms_key_id       = "arn:aws:kms:eu-central-1:613871678587:key/f3f00387-1ce2-4e0b-8528-dfcb0a8a56c0"
  performance_insights_retention_period = 7
  port                                  = 5432
  publicly_accessible                   = false
  skip_final_snapshot                   = true
  storage_encrypted                     = true
  storage_throughput                    = 500
  storage_type                          = "gp3"
  apply_immediately                     = true
  allow_major_version_upgrade           = true
  tags = {
    "Business-Unit" = "SME-AOMA-Core"
    "Environment"   = "Prod"
    "Owner"         = "Nathaniel Lovett"
    "Project-Code"  = "SME-2000-0306A"
    "Project-Name"  = "AOMA-Core"
    "SSS"           = "IGNORE"
    "map-migrated"  = "migKNBMDMW06I"
  }
  tags_all = {
    "Business-Unit" = "SME-AOMA-Core"
    "Environment"   = "Prod"
    "Owner"         = "Nathaniel Lovett"
    "Project-Code"  = "SME-2000-0306A"
    "Project-Name"  = "AOMA-Core"
    "SSS"           = "IGNORE"
    "map-migrated"  = "migKNBMDMW06I"
  }
  username = "master_rds"
  vpc_security_group_ids = [
    "sg-07c0b850c83ce8265",
    "sg-09f51d5f9d811a915",
  ]

}

resource "aws_db_instance" "aoma-rds-prod" {
  # checkov:skip=CKV_AWS_161: Ensure RDS database has IAM authentication enabled
  # checkov:skip=CKV_AWS_226: Ensure DB instance gets all minor upgrades automatically
  # checkov:skip=CKV2_AWS_30: Ensure Postgres RDS as aws_db_instance has Query Logging enabled
  allocated_storage           = 1099
  allow_major_version_upgrade = true
  apply_immediately           = true
  auto_minor_version_upgrade  = false
  #  availability_zone                     = "eu-central-1a"
  backup_retention_period             = 7
  backup_window                       = "07:00-07:30"
  ca_cert_identifier                  = "rds-ca-rsa2048-g1"
  character_set_name                  = null
  copy_tags_to_snapshot               = true
  custom_iam_instance_profile         = null
  customer_owned_ip_enabled           = false
  db_name                             = "aoma"
  db_subnet_group_name                = "aoma-p1-rds-sng"
  delete_automated_backups            = true
  deletion_protection                 = true
  domain                              = null
  domain_iam_role_name                = null
  enabled_cloudwatch_logs_exports     = ["postgresql", "upgrade"]
  engine                              = "postgres"
  engine_version                      = "17.7"
  final_snapshot_identifier           = null
  iam_database_authentication_enabled = false
  identifier                          = "aoma-rds-prod"
  identifier_prefix                   = null
  instance_class                      = "db.m6g.4xlarge"
  iops                                = 6000
  kms_key_id                          = "arn:aws:kms:eu-central-1:613871678587:key/f3f00387-1ce2-4e0b-8528-dfcb0a8a56c0"
  license_model                       = "postgresql-license"
  maintenance_window                  = "sun:08:00-sun:08:30"
  manage_master_user_password         = null
  master_user_secret_kms_key_id       = null
  max_allocated_storage               = 1450
  monitoring_interval                 = 60
  monitoring_role_arn                 = "arn:aws:iam::613871678587:role/rds-monitoring-role"
  multi_az                            = true
  nchar_character_set_name            = null
  network_type                        = "IPV4"
  #  option_group_name                     = "default:postgres-15"
  parameter_group_name                  = "aoma-rds-prod-config-v17"
  password                              = null # sensitive
  performance_insights_enabled          = true
  performance_insights_kms_key_id       = "arn:aws:kms:eu-central-1:613871678587:key/c23e38c4-9f5a-48a8-bbdb-b33c47933d2a"
  performance_insights_retention_period = 7
  port                                  = 5432
  publicly_accessible                   = false
  replica_mode                          = null
  replicate_source_db                   = null
  skip_final_snapshot                   = true
  snapshot_identifier                   = null
  storage_encrypted                     = true
  storage_throughput                    = 0
  storage_type                          = "io1"
  tags = {
    Business-Unit = "SME-AOMA-Core"
    Environment   = "Prod"
    Owner         = "Nathaniel Lovett"
    Project-Code  = "SME-2000-0306A"
    Project-Name  = "AOMA-Core"
    map-migrated  = "migKNBMDMW06I"
  }
  tags_all = {
    Business-Unit = "SME-AOMA-Core"
    Environment   = "Prod"
    Owner         = "Nathaniel Lovett"
    Project-Code  = "SME-2000-0306A"
    Project-Name  = "AOMA-Core"
    map-migrated  = "migKNBMDMW06I"
  }
  timezone               = null
  username               = "master_rds"
  vpc_security_group_ids = ["sg-0a62cdd529a710389"]
}