From b6b02cf1ce15c9dd67b9f859b4b2641603e17101 Mon Sep 17 00:00:00 2001 From: santhosh <46589568+santhoshratala@users.noreply.github.com> Date: Thu, 10 Apr 2025 17:35:42 +0800 Subject: [PATCH] feat: add option to pass 'transit_encryption_mode' variable --- README.md | 13 +++++++------ main.tf | 1 + variables.tf | 6 ++++++ 3 files changed, 14 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 1820911..8da2b3e 100644 --- a/README.md +++ b/README.md @@ -11,8 +11,8 @@ | Name | Version | |------|---------| -| [aws](#provider\_aws) | 5.82.0 | -| [awscc](#provider\_awscc) | 1.24.0 | +| [aws](#provider\_aws) | 5.94.1 | +| [awscc](#provider\_awscc) | 1.36.0 | ## Modules @@ -42,7 +42,7 @@ No modules. | [alarm\_ecpu\_threshold\_percent](#input\_alarm\_ecpu\_threshold\_percent) | ECPU threshold alarm level for elasticache serverless | `number` | `75` | no | | [alarm\_memory\_threshold\_bytes](#input\_alarm\_memory\_threshold\_bytes) | Alarm memory threshold bytes | `number` | `10000000` | no | | [apply\_immediately](#input\_apply\_immediately) | Specifies whether any database modifications are applied immediately, or during the next maintenance window | `bool` | `true` | no | -| [at\_rest\_encryption\_enabled](#input\_at\_rest\_encryption\_enabled) | Specifies whether the encryption at rest is enabled | `bool` | `true` | no | +| [at\_rest\_encryption\_enabled](#input\_at\_rest\_encryption\_enabled) | Whether to enable encryption at rest | `string` | `true` | no | | [auth\_token](#input\_auth\_token) | Password used to access a password protected server. Can be specified only if `transit_encryption_enabled = true` | `string` | `null` | no | | [cluster\_id](#input\_cluster\_id) | Cluster ID | `string` | `null` | no | | [cluster\_mode\_enabled](#input\_cluster\_mode\_enabled) | Set to false to diable cluster module | `bool` | `false` | no | @@ -62,9 +62,9 @@ No modules. | [num\_node\_groups](#input\_num\_node\_groups) | Number of node groups (shards) for this Redis replication group. Changing this number will trigger an online resizing operation before other settings modifications. Required unless `global_replication_group_id` is set | `number` | `2` | no | | [ok\_actions](#input\_ok\_actions) | The list of actions to execute when this alarm transitions into an OK state from any other state. | `list(string)` | `[]` | no | | [parameter\_group\_name](#input\_parameter\_group\_name) | Existing Parameter Group name | `string` | `""` | no | -| [parameters](#input\_parameters) | A list of Redis parameters to apply. Note that parameters may differ from one Redis family to another | 
list(object({
    name  = string
    value = string
  }))
| `[]` | no | +| [parameters](#input\_parameters) | A list of Redis parameters to apply. Note that parameters may differ from one Redis family to another | 
list(object({
    name  = string
    value = string
  }))
| `[]` | no | | [port](#input\_port) | Redis port | `number` | `6379` | no | -| [preferred\_cache\_cluster\_azs](#input\_preferred\_cache\_cluster\_azs) | List of EC2 availability zones in which the replication group's cache clusters will be created. The order of the availability zones in the list is considered. The first item in the list will be the primary node. Ignored when updating | `list(string)` | 
[
  "ap-southeast-1a",
  "ap-southeast-1b"
]
| no | +| [preferred\_cache\_cluster\_azs](#input\_preferred\_cache\_cluster\_azs) | List of EC2 availability zones in which the replication group's cache clusters will be created. The order of the availability zones in the list is considered. The first item in the list will be the primary node. Ignored when updating | `list(string)` | 
[
  "ap-southeast-1a",
  "ap-southeast-1b"
]
| no | | [replicas\_per\_node\_group](#input\_replicas\_per\_node\_group) | Number of replica nodes in each node group. Valid values are 0 to 5. Changing this number will trigger an online resizing operation before other settings modifications. | `number` | `1` | no | | [replication\_enabled](#input\_replication\_enabled) | Set to false to diable replication in redis cluster | `bool` | `false` | no | | [replication\_group\_id](#input\_replication\_group\_id) | ElastiCache replication\_group\_id | `string` | `""` | no | @@ -77,7 +77,8 @@ No modules. | [subnet\_group\_name](#input\_subnet\_group\_name) | Subnet group name for the ElastiCache instance | `string` | `""` | no | | [subnets](#input\_subnets) | AWS subnet ids | `list(string)` | `[]` | no | | [tags](#input\_tags) | Additional tags (\_e.g.\_ map("BusinessUnit","ABC") | `map(string)` | `{}` | no | -| [transit\_encryption\_enabled](#input\_transit\_encryption\_enabled) | Specifies whether the encryption at transit is enabled | `bool` | `true` | no | +| [transit\_encryption\_enabled](#input\_transit\_encryption\_enabled) | Whether to enable encryption in transit | `string` | `true` | no | +| [transit\_encryption\_mode](#input\_transit\_encryption\_mode) | Accepted values are preferred and required. Can be specified only if `transit_encryption_enabled = true` | `string` | `null` | no | | [use\_serverless](#input\_use\_serverless) | Use serverless ElastiCache service | `bool` | `false` | no | | [user\_group\_id](#input\_user\_group\_id) | The ID of the user group Elasticache | `string` | `""` | no | diff --git a/main.tf b/main.tf index 1679940..7816baf 100644 --- a/main.tf +++ b/main.tf @@ -59,6 +59,7 @@ resource "aws_elasticache_replication_group" "this" { multi_az_enabled = var.replication_enabled ? true : false at_rest_encryption_enabled = var.at_rest_encryption_enabled transit_encryption_enabled = var.transit_encryption_enabled + transit_encryption_mode = var.transit_encryption_mode automatic_failover_enabled = var.replication_enabled ? true : false notification_topic_arn = var.notification_topic_arn diff --git a/variables.tf b/variables.tf index 9f339e4..5198231 100644 --- a/variables.tf +++ b/variables.tf @@ -184,6 +184,12 @@ variable "transit_encryption_enabled" { default = true } +variable "transit_encryption_mode" { + description = "Accepted values are preferred and required. Can be specified only if `transit_encryption_enabled = true`" + type = string + default = null +} + variable "auth_token" { description = "Password used to access a password protected server. Can be specified only if `transit_encryption_enabled = true`" type = string