rds-aurora-mysql.yaml

# aws cloudformation create-stack --stack-name rds-aurora-mysql-us-east-1-demo --template-body file://rds-aurora-mysql.yaml

AWSTemplateFormatVersion: '2010-09-09'

Description: >
  This template creates a RDS Aurora MySQL Database (Serverless) and also utilizes Secrets Manager.

Parameters:
  DeploymentId:
    Type: String
    Description: A unique deployment identifier.
    Default: demo

  Owner:
    Type: String
    Description: Email address of the person that created the stack.
    Default: jason@moskowitz.sh

  Service:
    Type: String
    Description: Name of the service or product that is associated with this stack.
    Default: aurora-mysql

  RdsAuroraMySqlDatabaseName:
    Type: String
    Description: RDS database name.
    Default: demo

  RdsAuroraMySqlInstanceType:
    Description: RDS EC2 instance type
    Type: String
    Default: db.t2.small

# The Resources section specifies the resources and their properties deployed in the stack.
Resources:
### RDS Aurora MySQL Database ###
  RdsAuroraMySqlSubnetGroup:
    Type: AWS::RDS::DBSubnetGroup
    Properties:
      DBSubnetGroupDescription: EES RDS Subnet Group
      SubnetIds:
        - !ImportValue 'DatabaseSubnetAz1'
        - !ImportValue 'DatabaseSubnetAz2'
      Tags:
        - Key: Name
          Value: !Sub rds-${Service}-${DeploymentId}
        - Key: Service
          Value: !Ref 'Service'
        - Key: Owner
          Value: !Ref 'Owner'

  RdsAuroraMySqlSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: RDS Security Group
      VpcId: !ImportValue 'VpcId'
      Tags:
        - Key: Name
          Value: !Sub rds-${Service}-${DeploymentId}
        - Key: Service
          Value: !Ref 'Service'
        - Key: Owner
          Value: !Ref 'Owner'

  RdsAuroraMySqlSecurityGroup3306Inbound:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref 'RdsAuroraMySqlSecurityGroup'
      IpProtocol: tcp
      FromPort: '3306'
      ToPort: '3306'
      CidrIp: 10.19.0.0/24

  RdsAuroraMySqlDbCluster:
    Type: AWS::RDS::DBCluster
    DeletionPolicy: Snapshot
    Properties:
      DatabaseName: !Ref 'RdsAuroraMySqlDatabaseName'
      DBClusterIdentifier: !Join ['-', [ !Ref 'Service', rds, !Ref 'AWS::Region', !Ref 'DeploymentId']]
      DBSubnetGroupName: !Ref 'RdsAuroraMySqlSubnetGroup'
      Engine: aurora
      EngineMode: serverless
      MasterUsername: !Join ['', ['{{resolve:secretsmanager:', !Ref RdsAuroraMySqlDbSecret, ':SecretString:username}}' ]]
      MasterUserPassword: !Join ['', ['{{resolve:secretsmanager:', !Ref RdsAuroraMySqlDbSecret, ':SecretString:password}}' ]]      
      BackupRetentionPeriod: 7
      StorageEncrypted: true
      ScalingConfiguration:
        AutoPause: true
        MaxCapacity: 2
        MinCapacity: 1
        SecondsUntilAutoPause: 300
      Tags:
        - Key: Name
          Value: !Sub rds-${Service}-${DeploymentId}
        - Key: Service
          Value: !Ref 'Service'
        - Key: Owner
          Value: !Ref 'Owner'
      VpcSecurityGroupIds:
        - !Ref 'RdsAuroraMySqlSecurityGroup'

### Secrets Manager ###
  RdsAuroraMySqlDbSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Description: "Dynamically generated secret password."
      GenerateSecretString:
        SecretStringTemplate: '{"username": "admin"}'
        GenerateStringKey: "password"
        PasswordLength: 16
        ExcludeCharacters: '"@/\'
      Tags:
        - Key: Name
          Value: !Sub rds-${Service}-${DeploymentId}
        - Key: Service
          Value: !Ref 'Service'
        - Key: Owner
          Value: !Ref 'Owner'

  SecretRDSInstanceAttachment:
    Type: AWS::SecretsManager::SecretTargetAttachment
    Properties:
      SecretId: !Ref RdsAuroraMySqlDbSecret
      TargetId: !Ref RdsAuroraMySqlDbCluster
      TargetType: AWS::RDS::DBCluster

Outputs:
  RdsAuroraMySqlDbClusterUrl:
    Description: RDS Aurora MySQL Database URL
    Value: !GetAtt [RdsAuroraMySqlDbCluster, Endpoint.Address]
    Export:
      Name: RdsAuroraMySqlDbClusterUrl

  RdsAuroraMySqlDbName:
    Description: RDS Aurora MySQL Database Name
    Value: !Ref 'RdsAuroraMySqlDatabaseName'
    Export:
      Name: RdsAuroraMySqlDbName