admin.tf

resource "random_string" "admin_username" {
  length  = 5
  special = false
  numeric = true
  upper   = false
}

locals {
  admin_username = "ns_admin_${random_string.admin_username.result}"
  admin_password = random_password.this.result
}

// Second-gen CloudSQL instances destroy the `root` user upon creation
// This creates an admin user that is used for administration
resource "google_sql_user" "admin" {
  name     = local.admin_username
  password = local.admin_password
  instance = google_sql_database_instance.this.name
  type     = "BUILT_IN"
}

resource "random_password" "this" {
  // Master password length constraints differ for each database engine. For more information, see the available settings when creating each DB instance.
  length      = 16
  special     = true
  min_upper   = 1
  min_lower   = 1
  min_numeric = 1
  min_special = 1

  // The password for the master database user can include any printable ASCII character except /, ", @, or a space.
  // We're also excluding the following characters:
  // ':' - not allowed by AWS DMS (Database Migration Service)
  // ';' - not allowed by AWS DMS
  // '+' - not allowed by AWS DMS
  // '%' - not allowed by AWS DMS, confuses url encoding
  // '?' - confuses url encoding
  // '#' - confuses url encoding
  // '[' - confuses url encoding
  // ']' - confuses url encoding
  // '{' - confuses url encoding
  // '}' - confuses url encoding
  // '(' - issues with batch files
  // ')' - issues with batch files
  // '&' - issues with batch files
  // '!' - issues with batch files
  // '^' - issues with batch files
  // '<' - issues with batch files
  // '>' - issues with batch files
  override_special = "$*-_="

  lifecycle {
    ignore_changes = [override_special] // Prevent changing passwords for deployed apps
  }
}

locals {
  // Valid metadata name: [a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*
  app_secret_store_name = "${local.resource_name}-gsm-secrets"
}

resource "google_secret_manager_secret" "admin_creds" {
  // Valid secret_id: [[a-zA-Z_0-9]+]
  secret_id = "${local.resource_name}_admin"
  labels    = local.labels

  replication {
    auto {}
  }

  depends_on = [google_project_service.secret_manager]
}

resource "google_secret_manager_secret_version" "admin_creds" {
  secret      = google_secret_manager_secret.admin_creds.id
  secret_data = jsonencode(tomap({ "username" = local.admin_username, "password" = local.admin_password }))
}