Issue 110: Add enable deletion protection (#112)

Co-authored-by: Nacho Suay Mas <[email protected]> Co-authored-by: Dan Miller <[email protected]> Co-authored-by: Joe Niland <[email protected]>
cloudposse · Aug 26, 2023 · 1a11bea · 1a11bea
1 parent 382d0dd
commit 1a11bea
Show file tree

Hide file tree

Showing 6 changed files with 34 additions and 26 deletions.
diff --git a/README.md b/README.md
@@ -232,14 +232,14 @@ Available targets:
 | Name | Version |
 |------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.0 |
-| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.22 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.59 |
 | <a name="requirement_null"></a> [null](#requirement\_null) | >= 2.0 |
 
 ## Providers
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.22 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.59 |
 | <a name="provider_null"></a> [null](#provider\_null) | >= 2.0 |
 
 ## Modules
@@ -273,6 +273,7 @@ Available targets:
 | <a name="input_autoscaler_tags"></a> [autoscaler\_tags](#input\_autoscaler\_tags) | Additional resource tags for the autoscaler module | `map(string)` | `{}` | no |
 | <a name="input_billing_mode"></a> [billing\_mode](#input\_billing\_mode) | DynamoDB Billing mode. Can be PROVISIONED or PAY\_PER\_REQUEST | `string` | `"PROVISIONED"` | no |
 | <a name="input_context"></a> [context](#input\_context) | Single object for setting entire context at once.<br>See description of individual variables for details.<br>Leave string and numeric variables as `null` to use default value.<br>Individual variable settings (non-null) override settings in context object,<br>except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | <pre>{<br>  "additional_tag_map": {},<br>  "attributes": [],<br>  "delimiter": null,<br>  "descriptor_formats": {},<br>  "enabled": true,<br>  "environment": null,<br>  "id_length_limit": null,<br>  "label_key_case": null,<br>  "label_order": [],<br>  "label_value_case": null,<br>  "labels_as_tags": [<br>    "unset"<br>  ],<br>  "name": null,<br>  "namespace": null,<br>  "regex_replace_chars": null,<br>  "stage": null,<br>  "tags": {},<br>  "tenant": null<br>}</pre> | no |
+| <a name="input_deletion_protection_enabled"></a> [deletion\_protection\_enabled](#input\_deletion\_protection\_enabled) | Enable/disable DynamoDB table deletion protection | `bool` | `false` | no |
 | <a name="input_delimiter"></a> [delimiter](#input\_delimiter) | Delimiter to be used between ID elements.<br>Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no |
 | <a name="input_descriptor_formats"></a> [descriptor\_formats](#input\_descriptor\_formats) | Describe additional descriptors to be output in the `descriptors` output map.<br>Map of maps. Keys are names of descriptors. Values are maps of the form<br>`{<br>   format = string<br>   labels = list(string)<br>}`<br>(Type is `any` so the map values can later be enhanced to provide additional options.)<br>`format` is a Terraform format string to be passed to the `format()` function.<br>`labels` is a list of labels, in order, to pass to `format()` function.<br>Label values will be normalized before being passed to `format()` so they will be<br>identical to how they appear in `id`.<br>Default is `{}` (`descriptors` output will be empty). | `any` | `{}` | no |
 | <a name="input_dynamodb_attributes"></a> [dynamodb\_attributes](#input\_dynamodb\_attributes) | Additional DynamoDB attributes in the form of a list of mapped values | <pre>list(object({<br>    name = string<br>    type = string<br>  }))</pre> | `[]` | no |

diff --git a/docs/terraform.md b/docs/terraform.md
@@ -4,14 +4,14 @@
 | Name | Version |
 |------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.0 |
-| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.22 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.59 |
 | <a name="requirement_null"></a> [null](#requirement\_null) | >= 2.0 |
 
 ## Providers
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.22 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.59 |
 | <a name="provider_null"></a> [null](#provider\_null) | >= 2.0 |
 
 ## Modules
@@ -45,6 +45,7 @@
 | <a name="input_autoscaler_tags"></a> [autoscaler\_tags](#input\_autoscaler\_tags) | Additional resource tags for the autoscaler module | `map(string)` | `{}` | no |
 | <a name="input_billing_mode"></a> [billing\_mode](#input\_billing\_mode) | DynamoDB Billing mode. Can be PROVISIONED or PAY\_PER\_REQUEST | `string` | `"PROVISIONED"` | no |
 | <a name="input_context"></a> [context](#input\_context) | Single object for setting entire context at once.<br>See description of individual variables for details.<br>Leave string and numeric variables as `null` to use default value.<br>Individual variable settings (non-null) override settings in context object,<br>except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | <pre>{<br>  "additional_tag_map": {},<br>  "attributes": [],<br>  "delimiter": null,<br>  "descriptor_formats": {},<br>  "enabled": true,<br>  "environment": null,<br>  "id_length_limit": null,<br>  "label_key_case": null,<br>  "label_order": [],<br>  "label_value_case": null,<br>  "labels_as_tags": [<br>    "unset"<br>  ],<br>  "name": null,<br>  "namespace": null,<br>  "regex_replace_chars": null,<br>  "stage": null,<br>  "tags": {},<br>  "tenant": null<br>}</pre> | no |
+| <a name="input_deletion_protection_enabled"></a> [deletion\_protection\_enabled](#input\_deletion\_protection\_enabled) | Enable/disable DynamoDB table deletion protection | `bool` | `false` | no |
 | <a name="input_delimiter"></a> [delimiter](#input\_delimiter) | Delimiter to be used between ID elements.<br>Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no |
 | <a name="input_descriptor_formats"></a> [descriptor\_formats](#input\_descriptor\_formats) | Describe additional descriptors to be output in the `descriptors` output map.<br>Map of maps. Keys are names of descriptors. Values are maps of the form<br>`{<br>   format = string<br>   labels = list(string)<br>}`<br>(Type is `any` so the map values can later be enhanced to provide additional options.)<br>`format` is a Terraform format string to be passed to the `format()` function.<br>`labels` is a list of labels, in order, to pass to `format()` function.<br>Label values will be normalized before being passed to `format()` so they will be<br>identical to how they appear in `id`.<br>Default is `{}` (`descriptors` output will be empty). | `any` | `{}` | no |
 | <a name="input_dynamodb_attributes"></a> [dynamodb\_attributes](#input\_dynamodb\_attributes) | Additional DynamoDB attributes in the form of a list of mapped values | <pre>list(object({<br>    name = string<br>    type = string<br>  }))</pre> | `[]` | no |

diff --git a/main.tf b/main.tf
@@ -44,17 +44,17 @@ resource "null_resource" "local_secondary_index_names" {
 }
 
 resource "aws_dynamodb_table" "default" {
-  count            = local.enabled ? 1 : 0
-  name             = module.this.id
-  billing_mode     = var.billing_mode
-  read_capacity    = var.billing_mode == "PAY_PER_REQUEST" ? null : var.autoscale_min_read_capacity
-  write_capacity   = var.billing_mode == "PAY_PER_REQUEST" ? null : var.autoscale_min_write_capacity
-  hash_key         = var.hash_key
-  range_key        = var.range_key
-  stream_enabled   = length(var.replicas) > 0 ? true : var.enable_streams
-  stream_view_type = length(var.replicas) > 0 || var.enable_streams ? var.stream_view_type : ""
-  table_class      = var.table_class
-
+  count                       = local.enabled ? 1 : 0
+  name                        = module.this.id
+  billing_mode                = var.billing_mode
+  read_capacity               = var.billing_mode == "PAY_PER_REQUEST" ? null : var.autoscale_min_read_capacity
+  write_capacity              = var.billing_mode == "PAY_PER_REQUEST" ? null : var.autoscale_min_write_capacity
+  hash_key                    = var.hash_key
+  range_key                   = var.range_key
+  stream_enabled              = length(var.replicas) > 0 ? true : var.enable_streams
+  stream_view_type            = length(var.replicas) > 0 || var.enable_streams ? var.stream_view_type : ""
+  table_class                 = var.table_class
+  deletion_protection_enabled = var.deletion_protection_enabled
 
   server_side_encryption {
     enabled     = var.enable_encryption
@@ -132,9 +132,9 @@ module "dynamodb_autoscaler" {
 
   attributes                   = concat(module.this.attributes, var.autoscaler_attributes)
   tags                         = var.tags_enabled ? merge(module.this.tags, var.autoscaler_tags) : null
-  dynamodb_table_name          = join("", aws_dynamodb_table.default.*.id)
-  dynamodb_table_arn           = join("", aws_dynamodb_table.default.*.arn)
-  dynamodb_indexes             = null_resource.global_secondary_index_names.*.triggers.name
+  dynamodb_table_name          = join("", aws_dynamodb_table.default[*].id)
+  dynamodb_table_arn           = join("", aws_dynamodb_table.default[*].arn)
+  dynamodb_indexes             = null_resource.global_secondary_index_names[*].triggers.name
   autoscale_write_target       = var.autoscale_write_target
   autoscale_read_target        = var.autoscale_read_target
   autoscale_min_read_capacity  = var.autoscale_min_read_capacity

diff --git a/outputs.tf b/outputs.tf
@@ -1,34 +1,34 @@
 output "table_name" {
-  value       = join("", aws_dynamodb_table.default.*.name)
+  value       = join("", aws_dynamodb_table.default[*].name)
   description = "DynamoDB table name"
 }
 
 output "table_id" {
-  value       = join("", aws_dynamodb_table.default.*.id)
+  value       = join("", aws_dynamodb_table.default[*].id)
   description = "DynamoDB table ID"
 }
 
 output "table_arn" {
-  value       = join("", aws_dynamodb_table.default.*.arn)
+  value       = join("", aws_dynamodb_table.default[*].arn)
   description = "DynamoDB table ARN"
 }
 
 output "global_secondary_index_names" {
-  value       = null_resource.global_secondary_index_names.*.triggers.name
+  value       = null_resource.global_secondary_index_names[*].triggers.name
   description = "DynamoDB secondary index names"
 }
 
 output "local_secondary_index_names" {
-  value       = null_resource.local_secondary_index_names.*.triggers.name
+  value       = null_resource.local_secondary_index_names[*].triggers.name
   description = "DynamoDB local index names"
 }
 
 output "table_stream_arn" {
-  value       = join("", aws_dynamodb_table.default.*.stream_arn)
+  value       = join("", aws_dynamodb_table.default[*].stream_arn)
   description = "DynamoDB table stream ARN"
 }
 
 output "table_stream_label" {
-  value       = join("", aws_dynamodb_table.default.*.stream_label)
+  value       = join("", aws_dynamodb_table.default[*].stream_label)
   description = "DynamoDB table stream label"
 }
diff --git a/variables.tf b/variables.tf
@@ -174,3 +174,9 @@ variable "table_class" {
   default     = "STANDARD"
   description = "DynamoDB storage class of the table. Can be STANDARD or STANDARD_INFREQUENT_ACCESS"
 }
+
+variable "deletion_protection_enabled" {
+  type        = bool
+  default     = false
+  description = "Enable/disable DynamoDB table deletion protection"
+}
diff --git a/versions.tf b/versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 4.22"
+      version = ">= 4.59"
     }
     null = {
       source  = "hashicorp/null"