Summary
On September 19th, 2024, AWS announced that they were introducing the ability to manage Performance Insights at the Cluster Level:
https://aws.amazon.com/about-aws/whats-new/2024/09/amazon-rds-performance-insights-supports-aurora-cluster-level-configuration/
As it stands, the current rds_cluster module does include the necessary parameters to enable Performance Insights. I created a playbook that enforces standard settings across all of my company's accounts and individual environments within said accounts. Because AWS introduced the new feature, and after a colleague went through some of our clusters and enabled Performance Insights at the cluster level, the playbook fails. It fails because I can only enforce enabling Performance Insights at the instance level with the current Ansible modules and any cluster with this already enabled will have the individual instances fail/error out.
There are obvious ways around this (comment out the Performance Insight enforcement at instance level, write a python script to enforce this, etc) and I understand that my situation might be unique. However, I think it would be best practice if the rds_cluster module received an update that included the required parameters for enabling Performance Insights at a cluster level.
In the AWS documentation for the aws rds modify-db-cluster command, the three parameters they include are --enable-performance-insights , --performance-insights-kms-key-id, and --performance-insights-retention-period. These match the rds_instance parameters, which should hopefully make for an easy implementation for the rds_cluster module.
Looking at rds_instance.py, we should just be able to copy the same code and carry it over to rds_cluster.py. This should be something possible when creating, modifying, and restoring a cluster.
Issue Type
Feature Idea
Component Name
rds_cluster, rds_cluster_info
Additional Information
Part of my playbook currently:
---
- name: Enforce Database Settings
hosts: all
vars:
env_xx_cluster: "[?tags.environment == 'xx'].db_cluster_identifier"
env_xx_cluster_instance: "[?tags.environment == 'xx'].db_cluster_members[].db_instance_identifier"
env_xx_instance: "[?tags.environment == 'xx'].db_instance_identifier"
channel_email: something@something.com
tasks:
- name: connect to xx account
amazon.aws.sts_assume_role:
region: us-east-1
role_arn: "arn:aws:iam::123412351:role/role"
role_session_name: "enforce_settings"
register: assumed_role_xx
- name: get xx rds instance details
amazon.aws.rds_instance_info:
region: us-east-1
access_key: "{{ assumed_role_xx.sts_creds.access_key }}"
secret_key: "{{ assumed_role_xx.sts_creds.secret_key }}"
session_token: "{{ assumed_role_xx.sts_creds.session_token }}"
register: xx_instance
- name: filter out docdb and aurora engines in instances
ansible.builtin.set_fact:
xx_instances: "{{ xx_instance.instances | selectattr('engine', 'search', '^(?!aurora|docdb)') }}"
- name: filter out stopped instances
ansible.builtin.set_fact:
xx_instances_avail: "{{ xx_instances | selectattr('db_instance_status', 'eq', 'available') }}"
- name: get xx rds cluster details
amazon.aws.rds_cluster_info:
region: us-east-1
access_key: "{{ assumed_role_xx.sts_creds.access_key }}"
secret_key: "{{ assumed_role_xx.sts_creds.secret_key }}"
session_token: "{{ assumed_role_xx.sts_creds.session_token }}"
register: xx_cluster
- name: filter out docdb in clusters
ansible.builtin.set_fact:
xx_clusters: "{{ xx_cluster.clusters | selectattr('engine', 'search', 'aurora') }}"
- name: filter out stopped clusters
ansible.builtin.set_fact:
xx_clusters_avail: "{{ xx_clusters | selectattr('status', 'eq', 'available') }}"
- name: get xx rds cluster instance details
amazon.aws.rds_cluster_info:
region: us-east-1
access_key: "{{ assumed_role_xx.sts_creds.access_key }}"
secret_key: "{{ assumed_role_xx.sts_creds.secret_key }}"
session_token: "{{ assumed_role_xx.sts_creds.session_token }}"
register: xx_cluster_instance
- name: filter out docdb in cluster instances
ansible.builtin.set_fact:
xx_cluster_instances: "{{ xx_cluster_instance.clusters | selectattr('engine', 'search', 'aurora') }}"
- name: filter out xx clusters, instances in clusters, and standalone instances
ansible.builtin.set_fact:
xx_clusters_env: "{{ xx_clusters_avail | json_query(env_xx_cluster) }}"
xx_cluster_instances_env: "{{ xx_cluster_instances | json_query(env_xx_cluster_instance) }}"
xx_instances_env: "{{ xx_instances_avail | json_query(env_xx_instance) }}"
- block:
- name: enforce database setting for xx clusters
amazon.aws.rds_cluster:
region: us-east-1
access_key: "{{ assumed_role_xx.sts_creds.access_key }}"
secret_key: "{{ assumed_role_xx.sts_creds.secret_key }}"
session_token: "{{ assumed_role_xx.sts_creds.session_token }}"
id: '{{ item }}'
state: present
copy_tags_to_snapshot: true
deletion_protection: true
storage_encrypted: true
preferred_maintenance_window: "Thu:05:00-Thu:06:00"
purge_tags: false
apply_immediately: true
backup_retention_period: 35
tags:
tag: tags
with_items: "{{ xx_clusters_env }}"
when: xx_clusters_env is defined
register: xx_clusters_after
- name: enforce database settings for xx target instances in clusters
amazon.aws.rds_instance:
region: us-east-1
access_key: "{{ assumed_role_xx.sts_creds.access_key }}"
secret_key: "{{ assumed_role_xx.sts_creds.secret_key }}"
session_token: "{{ assumed_role_xx.sts_creds.session_token }}"
id: '{{ item }}'
state: present
auto_minor_version_upgrade: true
enable_performance_insights: true
performance_insights_retention_period: 7
purge_tags: false
storage_encrypted: true
apply_immediately: true
monitoring_interval: 60
monitoring_role_arn: "arn:aws:iam::1234124315122:role/rds-monitoring-role"
preferred_maintenance_window: "Thu:05:00-Thu:06:00"
backup_retention_period: 35
tags:
tag: tags
with_items: "{{ xx_cluster_instances_env }}"
when: xx_cluster_instances_env is defined
register: xx_cluster_instances_after
- name: enforce database settings for xx target instances
amazon.aws.rds_instance:
region: us-east-1
access_key: "{{ assumed_role_xx.sts_creds.access_key }}"
secret_key: "{{ assumed_role_xx.sts_creds.secret_key }}"
session_token: "{{ assumed_role_xx.sts_creds.session_token }}"
id: '{{ item }}'
state: present
auto_minor_version_upgrade: true
copy_tags_to_snapshot: true
deletion_protection: true
enable_performance_insights: true
performance_insights_retention_period: 7
purge_tags: false
storage_encrypted: true
apply_immediately: true
monitoring_interval: 60
monitoring_role_arn: "arn:aws:iam::1234124315122:role/rds-monitoring-role"
preferred_maintenance_window: "Thu:05:00-Thu:06:00"
backup_retention_period: 35
tags:
tag: tags
with_items: "{{ xx_instances_env }}"
when: xx_instances_env is defined
register: xx_instances_after
rescue:
- name: send notification via teams email
ansible.builtin.mail:
host: somehost.name
port: 25
from: someemail@name.com
to: "{{ channel_email }}"
subtype: html
subject: "Enforce DB settings failed for xx instances"
body: "Check job {{ tower_job_id }} Enforce xx settings failure"
The implemented parameters would resemble what is used in rds_instance
- name: enforce database setting for xx clusters
amazon.aws.rds_cluster:
region: us-east-1
access_key: "{{ assumed_role_xx.sts_creds.access_key }}"
secret_key: "{{ assumed_role_xx.sts_creds.secret_key }}"
session_token: "{{ assumed_role_xx.sts_creds.session_token }}"
id: '{{ item }}'
state: present
copy_tags_to_snapshot: true
deletion_protection: true
storage_encrypted: true
enable_performance_insights: true
performance_insights_retention_period: 7
preferred_maintenance_window: "Thu:05:00-Thu:06:00"
purge_tags: false
apply_immediately: true
backup_retention_period: 35
tags:
tag: tags
with_items: "{{ xx_clusters_env }}"
when: xx_clusters_env is defined
register: xx_clusters_after
Code of Conduct
Summary
On September 19th, 2024, AWS announced that they were introducing the ability to manage Performance Insights at the Cluster Level:
https://aws.amazon.com/about-aws/whats-new/2024/09/amazon-rds-performance-insights-supports-aurora-cluster-level-configuration/
As it stands, the current rds_cluster module does include the necessary parameters to enable Performance Insights. I created a playbook that enforces standard settings across all of my company's accounts and individual environments within said accounts. Because AWS introduced the new feature, and after a colleague went through some of our clusters and enabled Performance Insights at the cluster level, the playbook fails. It fails because I can only enforce enabling Performance Insights at the instance level with the current Ansible modules and any cluster with this already enabled will have the individual instances fail/error out.
There are obvious ways around this (comment out the Performance Insight enforcement at instance level, write a python script to enforce this, etc) and I understand that my situation might be unique. However, I think it would be best practice if the rds_cluster module received an update that included the required parameters for enabling Performance Insights at a cluster level.
In the AWS documentation for the
aws rds modify-db-clustercommand, the three parameters they include are--enable-performance-insights,--performance-insights-kms-key-id, and--performance-insights-retention-period. These match the rds_instance parameters, which should hopefully make for an easy implementation for the rds_cluster module.Looking at
rds_instance.py, we should just be able to copy the same code and carry it over tords_cluster.py. This should be something possible when creating, modifying, and restoring a cluster.Issue Type
Feature Idea
Component Name
rds_cluster, rds_cluster_info
Additional Information
Part of my playbook currently:
The implemented parameters would resemble what is used in rds_instance
Code of Conduct