如何使用我的 SecretsManager 用户名和密码访问 pgAdmin4（在 Terraform 中设置）

Question

我正在使用一些 AWS Terraform 代码来创建一些简单的测试基础设施。在输入 Terraform 代码之前，我使用 AWS CLI 创建了两个密钥（一个用于 Postgres 用户名，另一个用于 Postgres 密码，我可以在 AWS 管理控制台密钥管理器部分中看到）。

当我运行

terraform apply

时，它确实创建了基础设施，但是当我在 pgAdmin4 的注册服务器（连接选项卡）中使用 AWS RDS 端点主机名/地址和我的用户名、密码时，它显示“无法连接到服务器：连接不良：名称或服务未知”。

请参阅问题底部的图片。

（我已经删除了下面代码块中的一些敏感信息）。

主.tf

resource "aws_vpc" "testrdsvpc" {
 cidr_block = "10.0.0.0/16"
 enable_dns_support = true
 enable_dns_hostnames= true 

 tags = {

   Name = "Test-RDS-related-VPC"

 }
}

resource "aws_subnet" "public_subnets" {
 count      = length(var.public_subnet_cidrs)
 vpc_id     = aws_vpc.testrdsvpc.id
 cidr_block = element(var.public_subnet_cidrs, count.index)
 availability_zone = element(var.azs, count.index)
 map_public_ip_on_launch = true


 

 tags = {

   Name = "Public Subnet(rds) ${count.index + 1}"

 }

}

resource "aws_subnet" "private_subnets" {
 count      = length(var.private_subnet_cidrs)
 vpc_id     = aws_vpc.testrdsvpc.id
 cidr_block = element(var.private_subnet_cidrs, count.index)
 availability_zone = element(var.azs, count.index)
 map_public_ip_on_launch = false

 tags = {

   Name = "Private Subnet(rds) ${count.index + 1}"

 }
}

resource "aws_internet_gateway" "gw" {
 vpc_id = aws_vpc.testrdsvpc.id
 tags = {
   Name = "testrds-vpc-igw"

 }

}

resource "aws_route_table" "second_rt" {

 vpc_id = aws_vpc.testrdsvpc.id

 

 route {
   cidr_block = "0.0.0.0/0"
   gateway_id = aws_internet_gateway.gw.id

 }

 tags = {

   Name = "2nd Route Table"

 }

}

resource "aws_route_table_association" "public_subnet_asso" {
 count = length(var.public_subnet_cidrs)
 subnet_id      = element(aws_subnet.public_subnets[*].id, count.index)
 route_table_id = aws_route_table.second_rt.id
}

resource "aws_security_group" "rds-security-group" {
 name        = "Allow postgres"
 description = "Allow inbound traffic from my IP address"
 vpc_id      = aws_vpc.testrdsvpc.id

ingress {
   description = "postgresql ingress"
   from_port   = 5432
   to_port     = 5432
   protocol    = "tcp"
   cidr_blocks = ["myipaddrsss"]
   ipv6_cidr_blocks = ["myipv6ipaddress"]
 }


egress {
   from_port   = 0
   to_port     = 0
   protocol    = "-1"
   cidr_blocks = ["0.0.0.0/0"]
   ipv6_cidr_blocks = ["::/0"]

 }

 tags = {
    Name = "postgres-sg"
 }

}

data "aws_secretsmanager_secret" "rds_secret" {
  count = length(var.secrets_list)
  name = element(var.secrets_list,count.index)
}

data "aws_secretsmanager_secret_version" "secret-rds-version" {
  count = length(var.secrets_list)
  secret_id = data.aws_secretsmanager_secret.rds_secret[count.index].id
}

#rds_instance name is:"RDS_learner_db"
resource "aws_db_instance" "learner-rds-ins" {
  allocated_storage    = var.allocated_storage
  db_name              = var.rds_instance_name
  publicly_accessible  = true
  engine               = var.engine
  engine_version       = var.engine_version
  instance_class       = var.instance_class
  username             = var.db_username
  password             = var.db_password
  db_subnet_group_name = aws_db_subnet_group.rds_sub_grp.name
  skip_final_snapshot  = true
  vpc_security_group_ids = [aws_security_group.rds-security-group.id]
}

resource "aws_db_subnet_group" "rds_sub_grp" {
  name       = "rds-subnet-test-grp"
  subnet_ids = aws_subnet.public_subnets[*].id

  tags = {
    Name = "My RDS subnet group"
  }
}

输出.tf

output "secret_value" {
  value = data.aws_secretsmanager_secret_version.secret-rds-version[*].secret_string
  sensitive = true
}

output "rds_instance_endpoint" {
  value = aws_db_instance.learner-rds-ins.address
}

output "rds_instance_endpoint-port" {
  value = aws_db_instance.learner-rds-ins.port
}

注意：var.db_username 和 var.db_password 与我的密钥用户名和密码（密钥名称）相同，var.secrets_list 是密钥管理器 AWS 控制台中的密钥名称

Answer 1

我很高兴与您合作解决这个问题，首先创建您的数据库凭据，然后像下一个示例一样引用数据源

接下来尝试从 tf 代码获取您的秘密凭证

代码示例：

data "aws_secretsmanager_secret" "rds_secret" {
  name = "db-credential-test" #your aws secret manager name
}

data "aws_secretsmanager_secret_version" "secret-rds-version" {
  secret_id = data.aws_secretsmanager_secret.password.id
}

#rds_instance name is:"RDS_learner_db"
resource "aws_db_instance" "learner-rds-ins" {
  allocated_storage    = var.allocated_storage
  db_name              = var.rds_instance_name
  publicly_accessible  = true
  engine               = var.engine
  engine_version       = var.engine_version
  instance_class       = var.instance_class
  username             = jsondecode(data.aws_secretsmanager_secret_version.secret-rds-version.secret_string)["username"]
  password             = jsondecode(data.aws_secretsmanager_secret_version.secret-rds-version.secret_string)["password"]
  db_subnet_group_name = aws_db_subnet_group.rds_sub_grp.name
  skip_final_snapshot  = true
  vpc_security_group_ids = [aws_security_group.rds-security-group.id]
}