update with tests for the parts of terraform logic we handle

Author: westonplatter

.github/workflows/notion-sync.yaml

@@ -0,0 +1,45 @@
+name: TF Test
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+permissions:
+  actions: read
+  checks: write
+  contents: read
+  id-token: write
+  pull-requests: read
+
+jobs:
+  tf-test:
+    name: ${{ matrix.tf }} Test
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        tf: [tofu, terraform]
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Aqua Cache
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        if: ${{ !github.event.act }} # Don't enable the cache step if we're using act for testing
+        with:
+          path: ~/.local/share/aquaproj-aqua
+          key: v1-aqua-installer-${{runner.os}}-${{runner.arch}}-${{hashFiles('aqua.yaml')}}
+          restore-keys: |
+            v1-aqua-installer-${{runner.os}}-${{runner.arch}}-
+
+      - name: Install Aqua
+        uses: aquaproj/aqua-installer@5e54e5cee8a95ee2ce7c04cb993da6dfad13e59c # v3.2.1
+        with:
+          aqua_version: v2.48.1
+
+      - name: Aqua Install
+        shell: bash
+        run: aqua install --tags ${{ matrix.tf }}
+
+      - run: ${{ matrix.tf }} init
+      - run: ${{ matrix.tf }} test

.github/workflows/test.yaml

@@ -47,7 +47,7 @@ module "logical_dbs" {
       name      = "system_user"
       login     = true
       superuser = false
-      password  = "insecure-pass-for-demo-app"
+      password  = "insecure-pass-for-readme-app"
     }
 
     table_grants = {
@@ -80,7 +80,7 @@ module "logical_dbs" {
     role = {
       name      = "readonly_user"
       login     = true
-      password  = "insecure-pass-for-demo-readonly"
+      password  = "insecure-pass-for-readme-readonly"
       superuser = false
     }
 

README.md

@@ -4,6 +4,5 @@ module "app_dbs" {
   source = "../../"
 
   databases = var.databases
-
-  roles = var.roles
+  roles     = var.roles
 }

examples/complete/main.tf

@@ -1,3 +1,7 @@
+output "databases" {
+  value = module.app_dbs.databases
+}
+
 output "database_access" {
   value = module.app_dbs.database_access
 }

examples/complete/outputs.tf

@@ -40,6 +40,7 @@ variable "databases" {
     name             = string
     connection_limit = number
   }))
+  default = []
 }
 
 
@@ -104,5 +105,6 @@ variable "roles" {
       privileges  = list(string)
     }))
   }))
+  default     = []
   description = "List of static postgres roles to create and related permissions. These are for applications that use static credentials and don't use IAM DB Auth. See defaults: https://registry.terraform.io/providers/cyrilgdn/postgresql/latest/docs/resources/postgresql_role"
 }

examples/complete/validation_script.py

@@ -1,10 +1,3 @@
-resource "postgresql_database" "logical_db" {
-  for_each         = { for database in var.databases : database.name => database }
-  name             = each.key
-  connection_limit = each.value.connection_limit
-}
-
-
 locals {
   roles_with_passwords = [for idx, role_data in var.roles : merge(role_data,
     {
@@ -27,6 +20,12 @@ locals {
   _table_grants       = [for role in local.roles_with_passwords : role.table_grants if try(role.table_grants, null) != null]
 }
 
+resource "postgresql_database" "logical_db" {
+  for_each         = { for database in var.databases : database.name => database }
+  name             = each.key
+  connection_limit = each.value.connection_limit
+}
+
 # If no password passed in, then use this to generate one
 resource "random_password" "user_password" {
   count = length(var.roles)
@@ -74,7 +73,7 @@ resource "postgresql_grant" "database_access" {
   object_type = each.value.object_type
   privileges  = each.value.privileges
 
-  depends_on = [postgresql_database.logical_db]
+  depends_on = [postgresql_database.logical_db, postgresql_role.role]
 }
 
 resource "postgresql_grant" "schema_access" {
@@ -87,7 +86,7 @@ resource "postgresql_grant" "schema_access" {
   object_type = each.value.object_type
   privileges  = each.value.privileges
 
-  depends_on = [postgresql_database.logical_db]
+  depends_on = [postgresql_database.logical_db, postgresql_role.role]
 }
 
 resource "postgresql_grant" "table_access" {
@@ -114,7 +113,7 @@ resource "postgresql_grant" "sequence_access" {
   object_type = each.value.object_type
   privileges  = each.value.privileges
 
-  depends_on = [postgresql_database.logical_db]
+  depends_on = [postgresql_database.logical_db, postgresql_role.role]
 }
 
 resource "postgresql_default_privileges" "privileges" {
@@ -128,5 +127,5 @@ resource "postgresql_default_privileges" "privileges" {
   object_type = each.value.object_type
   privileges  = each.value.privileges
 
-  depends_on = [postgresql_database.logical_db]
+  depends_on = [postgresql_database.logical_db, postgresql_role.role]
 }

examples/complete/variables.tf

@@ -1,3 +1,7 @@
+output "databases" {
+  value = postgresql_database.logical_db
+}
+
 output "database_access" {
   value = postgresql_grant.database_access
 }