<EXTREMELY_IMPORTANT>
You have superpowers.

**Below is the full content of your 'superpowers:using-superpowers' skill - your introduction to using skills. For all other skills, use the 'Skill' tool:**

---
name: using-superpowers
description: Use when starting any conversation - establishes how to find and use skills, requiring Skill tool invocation before ANY response including clarifying questions
---

<SUBAGENT-STOP>
If you were dispatched as a subagent to execute a specific task, skip this skill.
</SUBAGENT-STOP>

<EXTREMELY-IMPORTANT>
If you think there is even a 1% chance a skill might apply to what you are doing, you ABSOLUTELY MUST invoke the skill.

IF A SKILL APPLIES TO YOUR TASK, YOU DO NOT HAVE A CHOICE. YOU MUST USE IT.

This is not negotiable. This is not optional. You cannot rationalize your way out of this.
</EXTREMELY-IMPORTANT>

## Instruction Priority

Superpowers skills override default system prompt behavior, but **user instructions always take precedence**:

1. **User's explicit instructions** (CLAUDE.md, GEMINI.md, AGENTS.md, direct requests) — highest priority
2. **Superpowers skills** — override default system behavior where they conflict
3. **Default system prompt** — lowest priority

If CLAUDE.md, GEMINI.md, or AGENTS.md says "don't use TDD" and a skill says "always use TDD," follow the user's instructions. The user is in control.

## How to Access Skills

**In Claude Code:** Use the `Skill` tool. When you invoke a skill, its content is loaded and presented to you—follow it directly. Never use the Read tool on skill files.

**In Copilot CLI:** Use the `skill` tool. Skills are auto-discovered from installed plugins. The `skill` tool works the same as Claude Code's `Skill` tool.

**In Gemini CLI:** Skills activate via the `activate_skill` tool. Gemini loads skill metadata at session start and activates the full content on demand.

**In other environments:** Check your platform's documentation for how skills are loaded.

## Platform Adaptation

Skills use Claude Code tool names. Non-CC platforms: see `references/copilot-tools.md` (Copilot CLI), `references/codex-tools.md` (Codex) for tool equivalents. Gemini CLI users get the tool mapping loaded automatically via GEMINI.md.

# Using Skills

## The Rule

**Invoke relevant or requested skills BEFORE any response or action.** Even a 1% chance a skill might apply means that you should invoke the skill to check. If an invoked skill turns out to be wrong for the situation, you don't need to use it.

```dot
digraph skill_flow {
    "User message received" [shape=doublecircle];
    "About to EnterPlanMode?" [shape=doublecircle];
    "Already brainstormed?" [shape=diamond];
    "Invoke brainstorming skill" [shape=box];
    "Might any skill apply?" [shape=diamond];
    "Invoke Skill tool" [shape=box];
    "Announce: 'Using [skill] to [purpose]'" [shape=box];
    "Has checklist?" [shape=diamond];
    "Create TodoWrite todo per item" [shape=box];
    "Follow skill exactly" [shape=box];
    "Respond (including clarifications)" [shape=doublecircle];

    "About to EnterPlanMode?" -> "Already brainstormed?";
    "Already brainstormed?" -> "Invoke brainstorming skill" [label="no"];
    "Already brainstormed?" -> "Might any skill apply?" [label="yes"];
    "Invoke brainstorming skill" -> "Might any skill apply?";

    "User message received" -> "Might any skill apply?";
    "Might any skill apply?" -> "Invoke Skill tool" [label="yes, even 1%"];
    "Might any skill apply?" -> "Respond (including clarifications)" [label="definitely not"];
    "Invoke Skill tool" -> "Announce: 'Using [skill] to [purpose]'";
    "Announce: 'Using [skill] to [purpose]'" -> "Has checklist?";
    "Has checklist?" -> "Create TodoWrite todo per item" [label="yes"];
    "Has checklist?" -> "Follow skill exactly" [label="no"];
    "Create TodoWrite todo per item" -> "Follow skill exactly";
}
```

## Red Flags

These thoughts mean STOP—you're rationalizing:

| Thought | Reality |
|---------|---------|
| "This is just a simple question" | Questions are tasks. Check for skills. |
| "I need more context first" | Skill check comes BEFORE clarifying questions. |
| "Let me explore the codebase first" | Skills tell you HOW to explore. Check first. |
| "I can check git/files quickly" | Files lack conversation context. Check for skills. |
| "Let me gather information first" | Skills tell you HOW to gather information. |
| "This doesn't need a formal skill" | If a skill exists, use it. |
| "I remember this skill" | Skills evolve. Read current version. |
| "This doesn't count as a task" | Action = task. Check for skills. |
| "The skill is overkill" | Simple things become complex. Use it. |
| "I'll just do this one thing first" | Check BEFORE doing anything. |
| "This feels productive" | Undisciplined action wastes time. Skills prevent this. |
| "I know what that means" | Knowing the concept ≠ using the skill. Invoke it. |

## Skill Priority

When multiple skills could apply, use this order:

1. **Process skills first** (brainstorming, debugging) - these determine HOW to approach the task
2. **Implementation skills second** (frontend-design, mcp-builder) - these guide execution

"Let's build X" → brainstorming first, then implementation skills.
"Fix this bug" → debugging first, then domain-specific skills.

## Skill Types

**Rigid** (TDD, debugging): Follow exactly. Don't adapt away discipline.

**Flexible** (patterns): Adapt principles to context.

The skill itself tells you which.

## User Instructions

Instructions say WHAT, not HOW. "Add X" or "Fix Y" doesn't mean skip workflows.

</EXTREMELY_IMPORTANT>


<memvid-mind-context>
# 🧠 Claude Mind Ready

📁 Project: **tools-database**
💾 Memory will be created at: `.claude/mind.mv2`

_Your observations will be automatically captured._
</memvid-mind-context>


<EXTREMELY_IMPORTANT>
You have superpowers.

**Below is the full content of your 'superpowers:using-superpowers' skill - your introduction to using skills. For all other skills, use the 'Skill' tool:**

---
name: using-superpowers
description: Use when starting any conversation - establishes how to find and use skills, requiring Skill tool invocation before ANY response including clarifying questions
---

<SUBAGENT-STOP>
If you were dispatched as a subagent to execute a specific task, skip this skill.
</SUBAGENT-STOP>

<EXTREMELY-IMPORTANT>
If you think there is even a 1% chance a skill might apply to what you are doing, you ABSOLUTELY MUST invoke the skill.

IF A SKILL APPLIES TO YOUR TASK, YOU DO NOT HAVE A CHOICE. YOU MUST USE IT.

This is not negotiable. This is not optional. You cannot rationalize your way out of this.
</EXTREMELY-IMPORTANT>

## Instruction Priority

Superpowers skills override default system prompt behavior, but **user instructions always take precedence**:

1. **User's explicit instructions** (CLAUDE.md, GEMINI.md, AGENTS.md, direct requests) — highest priority
2. **Superpowers skills** — override default system behavior where they conflict
3. **Default system prompt** — lowest priority

If CLAUDE.md, GEMINI.md, or AGENTS.md says "don't use TDD" and a skill says "always use TDD," follow the user's instructions. The user is in control.

## How to Access Skills

**In Claude Code:** Use the `Skill` tool. When you invoke a skill, its content is loaded and presented to you—follow it directly. Never use the Read tool on skill files.

**In Copilot CLI:** Use the `skill` tool. Skills are auto-discovered from installed plugins. The `skill` tool works the same as Claude Code's `Skill` tool.

**In Gemini CLI:** Skills activate via the `activate_skill` tool. Gemini loads skill metadata at session start and activates the full content on demand.

**In other environments:** Check your platform's documentation for how skills are loaded.

## Platform Adaptation

Skills use Claude Code tool names. Non-CC platforms: see `references/copilot-tools.md` (Copilot CLI), `references/codex-tools.md` (Codex) for tool equivalents. Gemini CLI users get the tool mapping loaded automatically via GEMINI.md.

# Using Skills

## The Rule

**Invoke relevant or requested skills BEFORE any response or action.** Even a 1% chance a skill might apply means that you should invoke the skill to check. If an invoked skill turns out to be wrong for the situation, you don't need to use it.

```dot
digraph skill_flow {
    "User message received" [shape=doublecircle];
    "About to EnterPlanMode?" [shape=doublecircle];
    "Already brainstormed?" [shape=diamond];
    "Invoke brainstorming skill" [shape=box];
    "Might any skill apply?" [shape=diamond];
    "Invoke Skill tool" [shape=box];
    "Announce: 'Using [skill] to [purpose]'" [shape=box];
    "Has checklist?" [shape=diamond];
    "Create TodoWrite todo per item" [shape=box];
    "Follow skill exactly" [shape=box];
    "Respond (including clarifications)" [shape=doublecircle];

    "About to EnterPlanMode?" -> "Already brainstormed?";
    "Already brainstormed?" -> "Invoke brainstorming skill" [label="no"];
    "Already brainstormed?" -> "Might any skill apply?" [label="yes"];
    "Invoke brainstorming skill" -> "Might any skill apply?";

    "User message received" -> "Might any skill apply?";
    "Might any skill apply?" -> "Invoke Skill tool" [label="yes, even 1%"];
    "Might any skill apply?" -> "Respond (including clarifications)" [label="definitely not"];
    "Invoke Skill tool" -> "Announce: 'Using [skill] to [purpose]'";
    "Announce: 'Using [skill] to [purpose]'" -> "Has checklist?";
    "Has checklist?" -> "Create TodoWrite todo per item" [label="yes"];
    "Has checklist?" -> "Follow skill exactly" [label="no"];
    "Create TodoWrite todo per item" -> "Follow skill exactly";
}
```

## Red Flags

These thoughts mean STOP—you're rationalizing:

| Thought | Reality |
|---------|---------|
| "This is just a simple question" | Questions are tasks. Check for skills. |
| "I need more context first" | Skill check comes BEFORE clarifying questions. |
| "Let me explore the codebase first" | Skills tell you HOW to explore. Check first. |
| "I can check git/files quickly" | Files lack conversation context. Check for skills. |
| "Let me gather information first" | Skills tell you HOW to gather information. |
| "This doesn't need a formal skill" | If a skill exists, use it. |
| "I remember this skill" | Skills evolve. Read current version. |
| "This doesn't count as a task" | Action = task. Check for skills. |
| "The skill is overkill" | Simple things become complex. Use it. |
| "I'll just do this one thing first" | Check BEFORE doing anything. |
| "This feels productive" | Undisciplined action wastes time. Skills prevent this. |
| "I know what that means" | Knowing the concept ≠ using the skill. Invoke it. |

## Skill Priority

When multiple skills could apply, use this order:

1. **Process skills first** (brainstorming, debugging) - these determine HOW to approach the task
2. **Implementation skills second** (frontend-design, mcp-builder) - these guide execution

"Let's build X" → brainstorming first, then implementation skills.
"Fix this bug" → debugging first, then domain-specific skills.

## Skill Types

**Rigid** (TDD, debugging): Follow exactly. Don't adapt away discipline.

**Flexible** (patterns): Adapt principles to context.

The skill itself tells you which.

## User Instructions

Instructions say WHAT, not HOW. "Add X" or "Fix Y" doesn't mean skip workflows.

</EXTREMELY_IMPORTANT>

<memvid-mind-context>
# 🧠 Claude Mind Ready

📁 Project: **tools-database**
💾 Memory will be created at: `.claude/mind.mv2`

_Your observations will be automatically captured._
</memvid-mind-context>


alright fam, I need to create an rds postgres database for the churn-renewal-forecast project primarily (in this directory). I want the database to be called "tools-database" and use the database-rds module located at https://github.com/immuta/operations/tree/master/terraform/internal-modules/aws/data/database-rds, can you W this for me fr fr?


claude claude-code-guide Explore general-purpose Plan statusline-setup

- claude: Catch-all for any task that doesn't fit a more specific agent. FleetView's default when no agent name is typed. (Tools: *)

- claude-code-guide: Use this agent when the user asks questions ("Can Claude...", "Does Claude...", "How do I...") about: (1) Claude Code (the CLI tool) - features, hooks, slash commands, MCP servers, settings, IDE integrations, keyboard shortcuts; (2) Claude Agent SDK - building custom agents; (3) Claude API (formerly Anthropic API) - API usage, tool use, Anthropic SDK usage. **IMPORTANT:** Before spawning a new agent, check if there is already a running or recently completed claude-code-guide agent that you can continue via SendMessage. (Tools: Bash, Read, WebFetch, WebSearch)

- Explore: Fast read-only search agent for locating code. Use it to find files by pattern (eg. "src/components/**/*.tsx"), grep for symbols or keywords (eg. "API endpoints"), or answer "where is X defined / which files reference Y." Do NOT use it for code review, design-doc auditing, cross-file consistency checks, or open-ended analysis — it reads excerpts rather than whole files and will miss content past its read window. When calling, specify search breadth: "quick" for a single targeted lookup, "medium" for moderate exploration, or "very thorough" to search across multiple locations and naming conventions. (Tools: All tools except Agent, ExitPlanMode, Edit, Write, NotebookEdit)

- general-purpose: General-purpose agent for researching complex questions, searching for code, and executing multi-step tasks. When you are searching for a keyword or file and are not confident that you will find the right match in the first few tries use this agent to perform the search for you. (Tools: *)

- Plan: Software architect agent for designing implementation plans. Use this when you need to plan the implementation strategy for a task. Returns step-by-step plans, identifies critical files, and considers architectural trade-offs. (Tools: All tools except Agent, ExitPlanMode, Edit, Write, NotebookEdit)

- statusline-setup: Use this agent to configure the user's Claude Code status line setting. (Tools: Read, Edit)


## claude.ai Context7
Use this server to fetch current documentation whenever the user asks about a library, framework, SDK, API, CLI tool, or cloud service -- even well-known ones like React, Next.js, Prisma, Express, Tailwind, Django, or Spring Boot. This includes API syntax, configuration, version migration, library-specific debugging, setup instructions, and CLI tool usage. Use even when you think you know the answer -- your training data may not reflect recent changes. Prefer this over web search for library docs.

Do not use for: refactoring, writing scripts from scratch, debugging business logic, code review, or general programming concepts.


- obsidian-load: Load context from Obsidian notes in the `Claude/` directory into the current conversation.
- obsidian-save: Save current conversation context to an Obsidian note under the `Claude/` directory.
- mind:search: Search memories for specific content or patterns
- mind:stats: Show memory statistics and storage information
- mind:ask: Ask questions about memories and get context-aware answers
- mind:recent: Show recent memories and activity timeline
- mind:memory: Claude Mind - Search and manage Claude's persistent memory stored in a single portable .mv2 file
- mind:mind: Claude Mind - Search and manage Claude's persistent memory stored in a single portable .mv2 file
- superpowers:dispatching-parallel-agents: Use when facing 2+ independent tasks that can be worked on without shared state or sequential dependencies
- superpowers:test-driven-development: Use when implementing any feature or bugfix, before writing implementation code
- superpowers:systematic-debugging: Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes
- superpowers:executing-plans: Use when you have a written implementation plan to execute in a separate session with review checkpoints
- superpowers:using-superpowers: Use when starting any conversation - establishes how to find and use skills, requiring Skill tool invocation before ANY response including clarifying questions
- superpowers:using-git-worktrees: Use when starting feature work that needs isolation from current workspace or before executing implementation plans - ensures an isolated workspace exists via native tools or git worktree fallback
- superpowers:requesting-code-review: Use when completing tasks, implementing major features, or before merging to verify work meets requirements
- superpowers:finishing-a-development-branch: Use when implementation is complete, all tests pass, and you need to decide how to integrate the work - guides completion of development work by presenting structured options for merge, PR, or cleanup
- superpowers:brainstorming: You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
- superpowers:writing-plans: Use when you have a spec or requirements for a multi-step task, before touching code
- superpowers:receiving-code-review: Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation
- superpowers:verification-before-completion: Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always
- superpowers:writing-skills: Use when creating new skills, editing existing skills, or verifying skills work before deployment
- superpowers:subagent-driven-development: Use when executing implementation plans with independent tasks in the current session
- update-config: Use this skill to configure the Claude Code harness via settings.json. Automated behaviors ("from now on when X", "each time X", "whenever X", "before/after X") require hooks configured in settings.json - the harness executes these, not Claude, so memory/preferences cannot fulfill them. Also use for: permissions ("allow X", "add permission", "move permission to"), env vars ("set X=Y"), hook troubleshooting, or any changes to settings.json/settings.local.json files. Examples: "allow npm commands", "add bq permission to global settings", "move permission to user settings", "set DEBUG=true", "when claude stops show X". For simple settings like theme/model, suggest the /config command.
- keybindings-help: Use when the user wants to customize keyboard shortcuts, rebind keys, add chord bindings, or modify ~/.claude/keybindings.json. Examples: "rebind ctrl+s", "add a chord shortcut", "change the submit key", "customize keybindings".
- verify: Verify that a code change actually does what it's supposed to by running the app and observing behavior. Use when asked to verify a PR, confirm a fix works, test a change manually, check that a feature works, or validate local changes before pushing.
- simplify: Review changed code for reuse, quality, and efficiency, then fix any issues found.
- fewer-permission-prompts: Scan your transcripts for common read-only Bash and MCP tool calls, then add a prioritized allowlist to project .claude/settings.json to reduce permission prompts.
- loop: Run a prompt or slash command on a recurring interval (e.g. /loop 5m /foo). Omit the interval to let the model self-pace. - When the user wants to set up a recurring task, poll for status, or run something repeatedly on an interval (e.g. "check the deploy every 5 minutes", "keep running /babysit-prs"). Do NOT invoke for one-off tasks.
- schedule: Create, update, list, or run scheduled remote agents (routines) that execute on a cron schedule. - When the user wants to schedule a recurring remote agent, set up automated tasks, create a cron job for Claude Code, or manage their scheduled agents/routines. Also use when the user wants a one-time scheduled run ("run this once at 3pm", "remind me to check X tomorrow").
- claude-api: Build, debug, and optimize Claude API / Anthropic SDK apps. Apps built with this skill should include prompt caching. Also handles migrating existing Claude API code between Claude model versions (4.5 → 4.6, 4.6 → 4.7, retired-model replacements).
TRIGGER when: code imports `anthropic`/`@anthropic-ai/sdk`; user asks for the Claude API, Anthropic SDK, or Managed Agents; user adds/modifies/tunes a Claude feature (caching, thinking, compaction, tool use, batch, files, citations, memory) or model (Opus/Sonnet/Haiku) in a file; questions about prompt caching / cache hit rate in an Anthropic SDK project.
SKIP: file imports `openai`/other-provider SDK, filename like `*-openai.py`/`*-generic.py`, provider-neutral code, general programming/ML.
- run: Launch and drive this project's app to see a change working. Use when asked to run, start, or screenshot the app, or to confirm a change works in the real app (not just tests). First looks for a project skill that already covers launching the app; otherwise falls back to built-in patterns per project type (CLI, server, TUI, Electron, browser-driven, library).
- init: Initialize a new CLAUDE.md file with codebase documentation
- review: Review a pull request
- security-review: Complete a security review of the pending changes on the current branch


alright fam, I need to create an rds postgres database for the churn-renewal-forecast project primarily (in this directory). I want the database to be called "tools-database" and use the database-rds…


Set up RDS Postgres database for churn-renewal-forecast


Launching skill: superpowers:brainstorming


Base directory for this skill: /Users/steve.briggs/.claude/plugins/cache/claude-plugins-official/superpowers/5.1.0/skills/brainstorming

# Brainstorming Ideas Into Designs

Help turn ideas into fully formed designs and specs through natural collaborative dialogue.

Start by understanding the current project context, then ask questions one at a time to refine the idea. Once you understand what you're building, present the design and get user approval.

<HARD-GATE>
Do NOT invoke any implementation skill, write any code, scaffold any project, or take any implementation action until you have presented a design and the user has approved it. This applies to EVERY project regardless of perceived simplicity.
</HARD-GATE>

## Anti-Pattern: "This Is Too Simple To Need A Design"

Every project goes through this process. A todo list, a single-function utility, a config change — all of them. "Simple" projects are where unexamined assumptions cause the most wasted work. The design can be short (a few sentences for truly simple projects), but you MUST present it and get approval.

## Checklist

You MUST create a task for each of these items and complete them in order:

1. **Explore project context** — check files, docs, recent commits
2. **Offer visual companion** (if topic will involve visual questions) — this is its own message, not combined with a clarifying question. See the Visual Companion section below.
3. **Ask clarifying questions** — one at a time, understand purpose/constraints/success criteria
4. **Propose 2-3 approaches** — with trade-offs and your recommendation
5. **Present design** — in sections scaled to their complexity, get user approval after each section
6. **Write design doc** — save to `docs/superpowers/specs/YYYY-MM-DD-<topic>-design.md` and commit
7. **Spec self-review** — quick inline check for placeholders, contradictions, ambiguity, scope (see below)
8. **User reviews written spec** — ask user to review the spec file before proceeding
9. **Transition to implementation** — invoke writing-plans skill to create implementation plan

## Process Flow

```dot
digraph brainstorming {
    "Explore project context" [shape=box];
    "Visual questions ahead?" [shape=diamond];
    "Offer Visual Companion\n(own message, no other content)" [shape=box];
    "Ask clarifying questions" [shape=box];
    "Propose 2-3 approaches" [shape=box];
    "Present design sections" [shape=box];
    "User approves design?" [shape=diamond];
    "Write design doc" [shape=box];
    "Spec self-review\n(fix inline)" [shape=box];
    "User reviews spec?" [shape=diamond];
    "Invoke writing-plans skill" [shape=doublecircle];

    "Explore project context" -> "Visual questions ahead?";
    "Visual questions ahead?" -> "Offer Visual Companion\n(own message, no other content)" [label="yes"];
    "Visual questions ahead?" -> "Ask clarifying questions" [label="no"];
    "Offer Visual Companion\n(own message, no other content)" -> "Ask clarifying questions";
    "Ask clarifying questions" -> "Propose 2-3 approaches";
    "Propose 2-3 approaches" -> "Present design sections";
    "Present design sections" -> "User approves design?";
    "User approves design?" -> "Present design sections" [label="no, revise"];
    "User approves design?" -> "Write design doc" [label="yes"];
    "Write design doc" -> "Spec self-review\n(fix inline)";
    "Spec self-review\n(fix inline)" -> "User reviews spec?";
    "User reviews spec?" -> "Write design doc" [label="changes requested"];
    "User reviews spec?" -> "Invoke writing-plans skill" [label="approved"];
}
```

**The terminal state is invoking writing-plans.** Do NOT invoke frontend-design, mcp-builder, or any other implementation skill. The ONLY skill you invoke after brainstorming is writing-plans.

## The Process

**Understanding the idea:**

- Check out the current project state first (files, docs, recent commits)
- Before asking detailed questions, assess scope: if the request describes multiple independent subsystems (e.g., "build a platform with chat, file storage, billing, and analytics"), flag this immediately. Don't spend questions refining details of a project that needs to be decomposed first.
- If the project is too large for a single spec, help the user decompose into sub-projects: what are the independent pieces, how do they relate, what order should they be built? Then brainstorm the first sub-project through the normal design flow. Each sub-project gets its own spec → plan → implementation cycle.
- For appropriately-scoped projects, ask questions one at a time to refine the idea
- Prefer multiple choice questions when possible, but open-ended is fine too
- Only one question per message - if a topic needs more exploration, break it into multiple questions
- Focus on understanding: purpose, constraints, success criteria

**Exploring approaches:**

- Propose 2-3 different approaches with trade-offs
- Present options conversationally with your recommendation and reasoning
- Lead with your recommended option and explain why

**Presenting the design:**

- Once you believe you understand what you're building, present the design
- Scale each section to its complexity: a few sentences if straightforward, up to 200-300 words if nuanced
- Ask after each section whether it looks right so far
- Cover: architecture, components, data flow, error handling, testing
- Be ready to go back and clarify if something doesn't make sense

**Design for isolation and clarity:**

- Break the system into smaller units that each have one clear purpose, communicate through well-defined interfaces, and can be understood and tested independently
- For each unit, you should be able to answer: what does it do, how do you use it, and what does it depend on?
- Can someone understand what a unit does without reading its internals? Can you change the internals without breaking consumers? If not, the boundaries need work.
- Smaller, well-bounded units are also easier for you to work with - you reason better about code you can hold in context at once, and your edits are more reliable when files are focused. When a file grows large, that's often a signal that it's doing too much.

**Working in existing codebases:**

- Explore the current structure before proposing changes. Follow existing patterns.
- Where existing code has problems that affect the work (e.g., a file that's grown too large, unclear boundaries, tangled responsibilities), include targeted improvements as part of the design - the way a good developer improves code they're working in.
- Don't propose unrelated refactoring. Stay focused on what serves the current goal.

## After the Design

**Documentation:**

- Write the validated design (spec) to `docs/superpowers/specs/YYYY-MM-DD-<topic>-design.md`
  - (User preferences for spec location override this default)
- Use elements-of-style:writing-clearly-and-concisely skill if available
- Commit the design document to git

**Spec Self-Review:**
After writing the spec document, look at it with fresh eyes:

1. **Placeholder scan:** Any "TBD", "TODO", incomplete sections, or vague requirements? Fix them.
2. **Internal consistency:** Do any sections contradict each other? Does the architecture match the feature descriptions?
3. **Scope check:** Is this focused enough for a single implementation plan, or does it need decomposition?
4. **Ambiguity check:** Could any requirement be interpreted two different ways? If so, pick one and make it explicit.

Fix any issues inline. No need to re-review — just fix and move on.

**User Review Gate:**
After the spec review loop passes, ask the user to review the written spec before proceeding:

> "Spec written and committed to `<path>`. Please review it and let me know if you want to make any changes before we start writing out the implementation plan."

Wait for the user's response. If they request changes, make them and re-run the spec review loop. Only proceed once the user approves.

**Implementation:**

- Invoke the writing-plans skill to create a detailed implementation plan
- Do NOT invoke any other skill. writing-plans is the next step.

## Key Principles

- **One question at a time** - Don't overwhelm with multiple questions
- **Multiple choice preferred** - Easier to answer than open-ended when possible
- **YAGNI ruthlessly** - Remove unnecessary features from all designs
- **Explore alternatives** - Always propose 2-3 approaches before settling
- **Incremental validation** - Present design, get approval before moving on
- **Be flexible** - Go back and clarify when something doesn't make sense

## Visual Companion

A browser-based companion for showing mockups, diagrams, and visual options during brainstorming. Available as a tool — not a mode. Accepting the companion means it's available for questions that benefit from visual treatment; it does NOT mean every question goes through the browser.

**Offering the companion:** When you anticipate that upcoming questions will involve visual content (mockups, layouts, diagrams), offer it once for consent:
> "Some of what we're working on might be easier to explain if I can show it to you in a web browser. I can put together mockups, diagrams, comparisons, and other visuals as we go. This feature is still new and can be token-intensive. Want to try it? (Requires opening a local URL)"

**This offer MUST be its own message.** Do not combine it with clarifying questions, context summaries, or any other content. The message should contain ONLY the offer above and nothing else. Wait for the user's response before continuing. If they decline, proceed with text-only brainstorming.

**Per-question decision:** Even after the user accepts, decide FOR EACH QUESTION whether to use the browser or the terminal. The test: **would the user understand this better by seeing it than reading it?**

- **Use the browser** for content that IS visual — mockups, wireframes, layout comparisons, architecture diagrams, side-by-side visual designs
- **Use the terminal** for content that is text — requirements questions, conceptual choices, tradeoff lists, A/B/C/D text options, scope decisions

A question about a UI topic is not automatically a visual question. "What does personality mean in this context?" is a conceptual question — use the terminal. "Which wizard layout works better?" is a visual question — use the browser.

If they agree to the companion, read the detailed guide before proceeding:
`skills/brainstorming/visual-companion.md`


Aight Sir Charles of St Cheese, let me explore the project context before we get into it fr fr, no cap.


ToolSearch

Question: select:TaskCreate


Question: select:TaskCreate


Bash

find /Users/steve.briggs/projects/cpi-new/platform-management/us-east-1/tools-database -type f | head -50

List all files in the tools-database directory


TaskCreate

Explore project context

Check existing files, structure, module interface, and nearby similar configs


Task #1 created successfully: Explore project context

Explore project context


Bash

find /Users/steve.briggs/projects/cpi-new/platform-management/us-east-1/tools-database -maxdepth 1 -type f

List top-level files in tools-database


List sibling directories to understand surrounding context


drwxr-xr-x steve.briggs staff 128 B  Wed May 13 15:43:42 2026 aws-limit-checker-datadog-monitors
drwxr-xr-x steve.briggs staff 128 B  Wed May 13 15:43:42 2026 aws-limit-checker
drwxr-xr-x steve.briggs staff 128 B  Wed May 13 15:43:42 2026 datadog
drwxr-xr-x steve.briggs staff 128 B  Wed May 13 15:43:42 2026 harbor-s3-access-policy
drwxr-xr-x steve.briggs staff 128 B  Wed May 13 15:43:42 2026 harbor
drwxr-xr-x steve.briggs staff 128 B  Wed May 13 15:43:42 2026 iam-external-access-analyzer
drwxr-xr-x steve.briggs staff 128 B  Wed May 13 15:43:42 2026 ic-ops-net-cert
drwxr-xr-x steve.briggs staff 128 B  Wed May 13 15:43:42 2026 merlin
drwxr-xr-x steve.briggs staff 128 B  Wed May 13 15:43:42 2026 mgmt-db-roles
drwxr-xr-x steve.briggs staff 128 B  Wed May 13 15:43:42 2026 platform-mgmt-privatelink
.rw-r--r-- steve.briggs staff 147 B  Wed May 13 15:43:42 2026 region.hcl
drwxr-xr-x steve.briggs staff 128 B  Wed May 13 15:43:42 2026 retool-nonprod
drwxr-xr-x steve.briggs staff 128 B  Wed May 13 15:43:42 2026 retool-roles
drwxr-xr-x steve.briggs staff  96 B  Wed May 13 15:43:42 2026 ruth-service-account
drwxr-xr-x steve.briggs staff 128 B  Wed May 13 15:43:42 2026 saas-ca
drwxr-xr-x steve.briggs staff 160 B  Wed May 13 15:43:42 2026 saas-nonprod-ca
drwxr-xr-x steve.briggs staff 160 B  Wed May 13 15:43:42 2026 saas-nonprod-eu-imca
drwxr-xr-x steve.briggs staff 160 B  Wed May 13 15:43:42 2026 saas-nonprod-na-imca
drwxr-xr-x steve.briggs staff 160 B  Wed May 13 15:43:42 2026 saas-prod-ap-imca
drwxr-xr-x steve.briggs staff 160 B  Wed May 13 15:43:42 2026 saas-prod-ca
drwxr-xr-x steve.briggs staff 160 B  Wed May 13 15:43:42 2026 saas-prod-eu-imca
drwxr-xr-x steve.briggs staff 128 B  Wed May 13 15:43:42 2026 saas-prod-mgmt-imca
drwxr-xr-x steve.briggs staff 160 B  Wed May 13 15:43:42 2026 saas-prod-na-imca
drwxr-xr-x steve.briggs staff 128 B  Wed May 13 15:43:42 2026 sops-management
drwxr-xr-x steve.briggs staff 128 B  Wed May 13 15:43:42 2026 teleport-controller
drwxr-xr-x steve.briggs staff 128 B  Wed May 13 15:43:42 2026 teleport-db-bot-service-account
drwxr-xr-x steve.briggs staff 128 B  Wed May 13 15:43:42 2026 vault-privatelink
drwxr-xr-x steve.briggs staff 128 B  Wed May 13 15:43:42 2026 vault
drwxr-xr-x steve.briggs staff 128 B  Wed May 13 15:43:42 2026 vpc-cloudwan-gitlab-phz
drwxr-xr-x steve.briggs staff 128 B  Wed May 13 15:43:42 2026 vpc-cloudwan-pkg-hub-phz
drwxr-xr-x steve.briggs staff 128 B  Wed May 13 15:43:42 2026 vpc-cloudwan-vault-infrastructure-phz
drwxr-xr-x steve.briggs staff 128 B  Wed May 13 15:43:42 2026 vpc-harbor-phz
drwxr-xr-x steve.briggs staff 384 B  Wed May 13 15:43:42 2026 ..
drwxr-xr-x steve.briggs staff 192 B  Wed May 20 13:43:36 2026 eks-platform-mgmt-use1-1
drwxr-xr-x steve.briggs staff 128 B  Wed May 20 13:52:34 2026 retool
drwxr-xr-x steve.briggs staff 128 B  Wed May 20 13:52:59 2026 mgmt-database
drwxr-xr-x steve.briggs staff 1.3 KB Wed May 20 13:53:32 2026 .
drwxr-xr-x steve.briggs staff 160 B  Wed May 20 13:57:10 2026 vpc-cloudwan
drwxr-xr-x steve.briggs staff 128 B  Wed May 20 14:12:36 2026 retool-database
drwxr-xr-x steve.briggs staff 160 B  Wed May 20 14:35:46 2026 tools-database


Good, there's already a `retool-database` and `mgmt-database` I can use as reference. Let me read those and the module's variables.


find /Users/steve.briggs/projects/cpi-new/platform-management/us-east-1/retool-database -type f | head -20

List files in retool-database for reference


find /Users/steve.briggs/projects/cpi-new/platform-management/us-east-1/mgmt-database -type f | head -20

List files in mgmt-database for reference


/Users/steve.briggs/projects/cpi-new/platform-management/us-east-1/mgmt-database/terragrunt.hcl
/Users/steve.briggs/projects/cpi-new/platform-management/us-east-1/mgmt-database/.terraform.lock.hcl


1	# ---------------------------------------------------------------------------------------------------------------------
2	# MODULE PARAMETERS
3	# These variables are expected to be passed in by the operator when calling this terraform module.
4	# ---------------------------------------------------------------------------------------------------------------------
5
6	# ---------------------------------------------------------------------------------------------------------------------
7	# REQUIRED PARAMETERS
8	# These variables must be set.
9	# ---------------------------------------------------------------------------------------------------------------------
10
11	variable vpc_id {
12	  description = "The VPC Id for the resources to be created in"
13	  type        = string
14	}
15
16	variable subnet_ids {
17	  description = "Subnet IDs to put this DB instance in"
18	  type        = list(string)
19	}
20
21	variable domain_name {
22	  description = "The domain for the DNS record to be created"
23	  type        = string
24	}
25
26	variable env {
27	  description = "The standard name for the running environment.  One of: dev, staging, prod"
28	  type        = string
29	}
30
31	variable pg_version {
32	  description = "Postgres database version prefix"
33	  type        = string
34	  # default     = "11.6"
35	}
36
37	# ---------------------------------------------------------------------------------------------------------------------
38	# OPTIONAL PARAMETERS
39	# These variables are configurable, but have reasonable defaults set.
40	# ---------------------------------------------------------------------------------------------------------------------
41
42	variable final_snapshot {
43	  description = "Take a snapshot before tearing down this db instance"
44	  type        = bool
45	  default     = true
46	}
47
48	variable instance_class {
49	  description = "DB instance class"
50	  type        = string
51	  default     = "db.m5.large"
52	}
53
54	variable iam_database_authentication_enabled {
55	  description = "Enable IAM auth"
56	  type        = bool
57	  default     = true
58	}
59
60	variable column_encryption_policy_path {
61	  description = "Path to put column encryption policy under"
62	  type        = string
63	  default     = "/imc-database/"
64	}
65
66	variable maintenance_window {
67	  description = "DB database automatic maintenance / upgrades window"
68	  type        = string
69	  default     = "Mon:21:00-Mon:23:00"
70	}
71
72	variable enhanced_monitoring_enabled {
73	  description = "Creates IAM Role and enables Enhanced Monitoring on DB"
74	  type        = bool
75	  default     = false
76	}
77
78	variable performance_insights_enabled {
79	  description = "Enables performance insights on DB"
80	  type        = bool
81	  default     = false
82	}
83
84	variable max_allocated_storage {
85	  description = "When configured, the upper limit to which Amazon DB can automatically scale the storage of the DB instance.  Set to 0 to turn off"
86	  type        = number
87	  default     = 1000
88	}
89
90	variable multi_az {
91	  description = "Specifies if the DB instance is multi-AZ"
92	  type        = bool
93	  default     = true
94	}
95	variable name {
96	  description = "The name to use for the resources created"
97	  type        = string
98	  default     = "imc"
99	}
100
101	variable name_prefix {
102	  description = "An optional string that will be pre-pended to the beginning of the resource names or paths"
103	  type        = string
104	  default     = ""
105	}
106
107	variable name_suffix {
108	  description = "An optional string that will be appended to the end of the resource names"
109	  type        = string
110	  default     = ""
111	}
112
113	variable parameters {
114	  description = "A map of DB parameters to apply via a parameter group.  If map is empty, the default parameter group will be used"
115	  type        = map
116	  default     = {}
117	}
118
119	variable port {
120	  description = "The port on which the DB accepts connections."
121	  type        = number
122	  default     = 5432
123	}
124
125	variable security_group_ids {
126	  description = "An optional list of VPC security groups to attach to the DB instance.  These are in additional to the default security created."
127	  type        = list(string)
128	  default     = []
129	}
130
131	variable storage_encrypted {
132	  description = "Specifies whether the DB instance is encrypted"
133	  type        = bool
134	  default     = true
135	}
136
137	variable tags {
138	  description = "Tags to assign to the compute resources"
139	  type        = map
140	  default     = {}
141	}
142
143	variable trusted_cidr_blocks {
144	  description = "A optional list of CIDR blocks to allow access to the DB."
145	  type        = list(string)
146	  default     = []
147	}
148
149	variable trusted_security_group_ids {
150	  description = "A optional list of security groups to allow access to the DB."
151	  type        = list(string)
152	  default     = []
153	}
154
155	variable admin_username {
156	  description = "Username for the initial database user"
157	  type        = string
158	  default     = "imc_admin"
159	}
160
161	variable allocated_storage {
162	  description = "The initial storage allocated in gibibytes"
163	  type        = number
164	  default     = 100
165	}
166
167	variable backup_retention_period {
168	  description = "The days to retain backups for. Must be between 0 and 35."
169	  type        = number
170	  default     = 21
171	}
172
173	variable replica_retention_period {
174	  description = "The retention period for backup replication in days. Must be between 0 and 35."
175	  type        = number
176	  default     = 21
177	}
178
179	variable encrypt_replicas {
180	  description = "Indicates if backup replicas should be ecrypted. Creates a KMS key and encrypts them if true."
181	  type        = bool
182	  default     = false
183	}
184
185	variable backup_window {
186	  description = "Window for DB to run database backups"
187	  type        = string
188	  default     = "19:15-20:15"
189	}
190
191	variable cloudwatch_logs_exports {
192	  description = "List of log types to enable for exporting to CloudWatch logs"
193	  type        = list(string)
194	  default     = ["upgrade"]
195	}
196
197	variable db_name {
198	  description = "Database name to create when creating the DB instance"
199	  type        = string
200	  default     = "imc"
201	}
202
203	variable ca_cert_identifier {
204	  description = "RDS CA cert identifier to use"
205	  type        = string
206	  default     = "rds-ca-rsa2048-g1"
207	}
208
209	variable subnet_group_name_override {
210	  description = "Optional override for subnet group name. Can be used when moving DB Subnet Groups."
211	  type        = string
212	  default     = ""
213	}
214
215	variable dba_security_group_name_override {
216	  description = "Optional override for external access SG name. Can be used when moving DB Subnet Groups."
217	  type        = string
218	  default     = ""
219	}
220
221	variable security_group_name_override {
222	  description = "Optional override for local access sg name. Can be used when moving DB Subnet Groups."
223	  type        = string
224	  default     = ""
225	}
226
227	variable deletion_protection {
228	  description = "When true, the DB instance cannot be deleted via the API util the flag is disabled"
229	  type        = bool
230	  default     = true
231	}
232

# ---------------------------------------------------------------------------------------------------------------------
# MODULE PARAMETERS
# These variables are expected to be passed in by the operator when calling this terraform module.
# ---------------------------------------------------------------------------------------------------------------------

# ---------------------------------------------------------------------------------------------------------------------
# REQUIRED PARAMETERS
# These variables must be set.
# ---------------------------------------------------------------------------------------------------------------------

variable vpc_id {
  description = "The VPC Id for the resources to be created in"
  type        = string
}

variable subnet_ids {
  description = "Subnet IDs to put this DB instance in"
  type        = list(string)
}

variable domain_name {
  description = "The domain for the DNS record to be created"
  type        = string
}

variable env {
  description = "The standard name for the running environment.  One of: dev, staging, prod"
  type        = string
}

variable pg_version {
  description = "Postgres database version prefix"
  type        = string
  # default     = "11.6"
}

# ---------------------------------------------------------------------------------------------------------------------
# OPTIONAL PARAMETERS
# These variables are configurable, but have reasonable defaults set.
# ---------------------------------------------------------------------------------------------------------------------

variable final_snapshot {
  description = "Take a snapshot before tearing down this db instance"
  type        = bool
  default     = true
}

variable instance_class {
  description = "DB instance class"
  type        = string
  default     = "db.m5.large"
}

variable iam_database_authentication_enabled {
  description = "Enable IAM auth"
  type        = bool
  default     = true
}

variable column_encryption_policy_path {
  description = "Path to put column encryption policy under"
  type        = string
  default     = "/imc-database/"
}

variable maintenance_window {
  description = "DB database automatic maintenance / upgrades window"
  type        = string
  default     = "Mon:21:00-Mon:23:00"
}

variable enhanced_monitoring_enabled {
  description = "Creates IAM Role and enables Enhanced Monitoring on DB"
  type        = bool
  default     = false
}

variable performance_insights_enabled {
  description = "Enables performance insights on DB"
  type        = bool
  default     = false
}

variable max_allocated_storage {
  description = "When configured, the upper limit to which Amazon DB can automatically scale the storage of the DB instance.  Set to 0 to turn off"
  type        = number
  default     = 1000
}

variable multi_az {
  description = "Specifies if the DB instance is multi-AZ"
  type        = bool
  default     = true
}
variable name {
  description = "The name to use for the resources created"
  type        = string
  default     = "imc"
}

variable name_prefix {
  description = "An optional string that will be pre-pended to the beginning of the resource names or paths"
  type        = string
  default     = ""
}

variable name_suffix {
  description = "An optional string that will be appended to the end of the resource names"
  type        = string
  default     = ""
}

variable parameters {
  description = "A map of DB parameters to apply via a parameter group.  If map is empty, the default parameter group will be used"
  type        = map
  default     = {}
}

variable port {
  description = "The port on which the DB accepts connections."
  type        = number
  default     = 5432
}

variable security_group_ids {
  description = "An optional list of VPC security groups to attach to the DB instance.  These are in additional to the default security created."
  type        = list(string)
  default     = []
}

variable storage_encrypted {
  description = "Specifies whether the DB instance is encrypted"
  type        = bool
  default     = true
}

variable tags {
  description = "Tags to assign to the compute resources"
  type        = map
  default     = {}
}

variable trusted_cidr_blocks {
  description = "A optional list of CIDR blocks to allow access to the DB."
  type        = list(string)
  default     = []
}

variable trusted_security_group_ids {
  description = "A optional list of security groups to allow access to the DB."
  type        = list(string)
  default     = []
}

variable admin_username {
  description = "Username for the initial database user"
  type        = string
  default     = "imc_admin"
}

variable allocated_storage {
  description = "The initial storage allocated in gibibytes"
  type        = number
  default     = 100
}

variable backup_retention_period {
  description = "The days to retain backups for. Must be between 0 and 35."
  type        = number
  default     = 21
}

variable replica_retention_period {
  description = "The retention period for backup replication in days. Must be between 0 and 35."
  type        = number
  default     = 21
}

variable encrypt_replicas {
  description = "Indicates if backup replicas should be ecrypted. Creates a KMS key and encrypts them if true."
  type        = bool
  default     = false
}

variable backup_window {
  description = "Window for DB to run database backups"
  type        = string
  default     = "19:15-20:15"
}

variable cloudwatch_logs_exports {
  description = "List of log types to enable for exporting to CloudWatch logs"
  type        = list(string)
  default     = ["upgrade"]
}

variable db_name {
  description = "Database name to create when creating the DB instance"
  type        = string
  default     = "imc"
}

variable ca_cert_identifier {
  description = "RDS CA cert identifier to use"
  type        = string
  default     = "rds-ca-rsa2048-g1"
}

variable subnet_group_name_override {
  description = "Optional override for subnet group name. Can be used when moving DB Subnet Groups."
  type        = string
  default     = ""
}

variable dba_security_group_name_override {
  description = "Optional override for external access SG name. Can be used when moving DB Subnet Groups."
  type        = string
  default     = ""
}

variable security_group_name_override {
  description = "Optional override for local access sg name. Can be used when moving DB Subnet Groups."
  type        = string
  default     = ""
}

variable deletion_protection {
  description = "When true, the DB instance cannot be deleted via the API util the flag is disabled"
  type        = bool
  default     = true
}


1	# ---------------------------------------------------------------------------------------------------------------------
2	# TERRAGRUNT CONFIGURATION
3	# ---------------------------------------------------------------------------------------------------------------------
4
5	terraform {
6	  source = "tfr://crow.infrastructure.immuta.io/internal/data-database-cps/aws?version=2.4.0"
7	}
8
9	# Include all settings from the root terragrunt.hcl file
10	include {
11	  path = find_in_parent_folders()
12	}
13
14	generate "backup_provider" {
15	  path      = "backup-provider.tf"
16	  if_exists = "overwrite_terragrunt"
17	  contents  = <<EOF
18	provider aws {
19	  alias   = "backup"
20	  profile = "${local.accounts["platform_management"]["profile"]}"
21	  region  = "us-east-2"
22	}
23	EOF
24	}
25
26	# ---------------------------------------------------------------------------------------------------------------------
27	# Locals are named constants that are reusable within the configuration.
28	# ---------------------------------------------------------------------------------------------------------------------
29	locals {
30	  # Automatically load common variables shared across all accounts
31	  common_vars = read_terragrunt_config(find_in_parent_folders("common.hcl"))
32
33	  # Automatically load account-level variables
34	  account_vars = read_terragrunt_config(find_in_parent_folders("account.hcl"))
35
36	  # Automatically load region-level variables
37	  region_vars = read_terragrunt_config(find_in_parent_folders("region.hcl"))
38
39	  # Extract the region and environment for easy access
40	  aws_region = local.region_vars.locals.aws_region
41	  env        = local.account_vars.locals.env
42
43	  # A local for more convenient access to the accounts map.
44	  accounts = local.common_vars.locals.accounts
45
46	  # Temp hard coding of networking info
47	  private_subnet_ids = [
48	    "subnet-06cb9a003fdd25469",
49	    "subnet-0c0d3ae5cb03f32c4",
50	    "subnet-09ec022a9217e26d2"
51	  ]
52	  vpc_id             = "vpc-05a7c8e424ce2fadf"
53
54	  gs_cidr_blocks        = local.common_vars.locals.global_segment_cidrs
55	  internal_domain_names = local.common_vars.locals.internal_domain_names
56
57
58	  tags = merge(local.common_vars.locals.global_tags, {
59	    tfpath = "/platform-management/${local.aws_region}/mgmt-database"
60	  })
61	}
62
63	# ---------------------------------------------------------------------------------------------------------------------
64	# MODULE DEPENDENCIES
65	# ---------------------------------------------------------------------------------------------------------------------
66
67	 dependency vpc {
68	   config_path = "../vpc-cloudwan"
69	 }
70
71	# ---------------------------------------------------------------------------------------------------------------------
72	# MODULE PARAMETERS
73	# These are the variables we have to pass in to use the module specified in the terragrunt configuration above
74	# ---------------------------------------------------------------------------------------------------------------------
75	inputs = {
76	  name                     = "mgmt-database"
77	  name_prefix              = "platform"
78	  db_name                  = "default_db"
79	  pg_version               = "14.2"
80	  domain_name              = local.internal_domain_names[local.env]["main"]
81	  env                      = "prod"
82	  column_encryption_policy_path = "/mgmt/"
83	  subnet_ids       = [for subnet in dependency.vpc.outputs.vpc.private_subnet_map : subnet.id]
84	  vpc_id                   = dependency.vpc.outputs.vpc.vpc_id
85
86	  subnet_group_name_override       = "platform-mgmt-db"
87	  dba_security_group_name_override = "platform-mgmt-db-access"
88	  security_group_name_override     = "platform-mgmt-db-trusted-access"
89
90	  instance_class = "db.t4g.medium"
91	  iam_database_authentication_enabled = true
92	  enhanced_monitoring_enabled = false
93	  performance_insights_enabled = false
94	  multi_az = true
95
96	  allocated_storage = 20
97	  storage_encrypted = true
98
99	  backup_retention_period = 5
100	  replica_retention_period = 5
101	  final_snapshot = false
102	  encrypt_replicas = true
103
104	  trusted_cidr_blocks = [
105	    local.gs_cidr_blocks["management"]["mgmt"]
106	  ]
107
108	  tags = local.tags
109	}
110

# ---------------------------------------------------------------------------------------------------------------------
# TERRAGRUNT CONFIGURATION
# ---------------------------------------------------------------------------------------------------------------------

terraform {
  source = "tfr://crow.infrastructure.immuta.io/internal/data-database-cps/aws?version=2.4.0"
}

# Include all settings from the root terragrunt.hcl file
include {
  path = find_in_parent_folders()
}

generate "backup_provider" {
  path      = "backup-provider.tf"
  if_exists = "overwrite_terragrunt"
  contents  = <<EOF
provider aws {
  alias   = "backup"
  profile = "${local.accounts["platform_management"]["profile"]}"
  region  = "us-east-2"
}
EOF
}

# ---------------------------------------------------------------------------------------------------------------------
# Locals are named constants that are reusable within the configuration.
# ---------------------------------------------------------------------------------------------------------------------
locals {
  # Automatically load common variables shared across all accounts
  common_vars = read_terragrunt_config(find_in_parent_folders("common.hcl"))

  # Automatically load account-level variables
  account_vars = read_terragrunt_config(find_in_parent_folders("account.hcl"))

  # Automatically load region-level variables
  region_vars = read_terragrunt_config(find_in_parent_folders("region.hcl"))

  # Extract the region and environment for easy access
  aws_region = local.region_vars.locals.aws_region
  env        = local.account_vars.locals.env

  # A local for more convenient access to the accounts map.
  accounts = local.common_vars.locals.accounts

  # Temp hard coding of networking info
  private_subnet_ids = [
    "subnet-06cb9a003fdd25469",
    "subnet-0c0d3ae5cb03f32c4",
    "subnet-09ec022a9217e26d2"
  ]
  vpc_id             = "vpc-05a7c8e424ce2fadf"

  gs_cidr_blocks        = local.common_vars.locals.global_segment_cidrs
  internal_domain_names = local.common_vars.locals.internal_domain_names

  tags = merge(local.common_vars.locals.global_tags, {
    tfpath = "/platform-management/${local.aws_region}/mgmt-database"
  })
}

# ---------------------------------------------------------------------------------------------------------------------
# MODULE DEPENDENCIES
# ---------------------------------------------------------------------------------------------------------------------

 dependency vpc {
   config_path = "../vpc-cloudwan"
 }

# ---------------------------------------------------------------------------------------------------------------------
# MODULE PARAMETERS
# These are the variables we have to pass in to use the module specified in the terragrunt configuration above
# ---------------------------------------------------------------------------------------------------------------------
inputs = {
  name                     = "mgmt-database"
  name_prefix              = "platform"
  db_name                  = "default_db"
  pg_version               = "14.2"
  domain_name              = local.internal_domain_names[local.env]["main"]
  env                      = "prod"
  column_encryption_policy_path = "/mgmt/"
  subnet_ids       = [for subnet in dependency.vpc.outputs.vpc.private_subnet_map : subnet.id]
  vpc_id                   = dependency.vpc.outputs.vpc.vpc_id

  subnet_group_name_override       = "platform-mgmt-db"
  dba_security_group_name_override = "platform-mgmt-db-access"
  security_group_name_override     = "platform-mgmt-db-trusted-access"

  instance_class = "db.t4g.medium"
  iam_database_authentication_enabled = true
  enhanced_monitoring_enabled = false
  performance_insights_enabled = false
  multi_az = true

  allocated_storage = 20
  storage_encrypted = true

  backup_retention_period = 5
  replica_retention_period = 5
  final_snapshot = false
  encrypt_replicas = true

  trusted_cidr_blocks = [
    local.gs_cidr_blocks["management"]["mgmt"]
  ]

  tags = local.tags
}


1	# ---------------------------------------------------------------------------------------------------------------------
2	# TERRAGRUNT CONFIGURATION
3	# ---------------------------------------------------------------------------------------------------------------------
4
5	terraform {
6	  source = "tfr://crow.infrastructure.immuta.io/iac/storage-database-retool/aws?version=1.3.0"
7	}
8
9	# Include all settings from the root terragrunt.hcl file
10	include {
11	  path = find_in_parent_folders()
12	}
13
14	generate "backup_provider" {
15	  path      = "backup-provider.tf"
16	  if_exists = "overwrite_terragrunt"
17	  contents  = <<EOF
18	provider aws {
19	  alias   = "backup"
20	  profile = "${local.accounts["platform_management"]["profile"]}"
21	  region  = "us-east-2"
22	}
23	EOF
24	}
25
26	# ---------------------------------------------------------------------------------------------------------------------
27	# Locals are named constants that are reusable within the configuration.
28	# ---------------------------------------------------------------------------------------------------------------------
29	locals {
30	  # Automatically load common variables shared across all accounts
31	  common_vars = read_terragrunt_config(find_in_parent_folders("common.hcl"))
32
33	  # Automatically load account-level variables
34	  account_vars = read_terragrunt_config(find_in_parent_folders("account.hcl"))
35
36	  # Automatically load region-level variables
37	  region_vars = read_terragrunt_config(find_in_parent_folders("region.hcl"))
38
39	  # Extract the region and environment for easy access
40	  aws_region = local.region_vars.locals.aws_region
41	  env        = local.account_vars.locals.env
42
43	  # A local for more convenient access to the accounts map.
44	  accounts = local.common_vars.locals.accounts
45
46	  # Temp hard coding of networking info
47	  private_subnet_ids = [
48	    "subnet-06cb9a003fdd25469",
49	    "subnet-0c0d3ae5cb03f32c4",
50	    "subnet-09ec022a9217e26d2"
51	  ]
52	  vpc_id             = "vpc-05a7c8e424ce2fadf"
53
54	  cidr_blocks           = local.common_vars.locals.cidr_blocks
55	  internal_domain_names = local.common_vars.locals.internal_domain_names
56
57
58	  tags = merge(local.common_vars.locals.global_tags, {
59	    tfpath = "/platform-management/${local.aws_region}/retool-database"
60	  })
61	}
62
63	# ---------------------------------------------------------------------------------------------------------------------
64	# MODULE DEPENDENCIES
65	# ---------------------------------------------------------------------------------------------------------------------
66
67	 dependency vpc {
68	   config_path = "../vpc-cloudwan"
69	 }
70
71	# ---------------------------------------------------------------------------------------------------------------------
72	# MODULE PARAMETERS
73	# These are the variables we have to pass in to use the module specified in the terragrunt configuration above
74	# ---------------------------------------------------------------------------------------------------------------------
75	inputs = {
76	  name                     = "retool-app"
77	  pg_version               = "17.4"
78	  domain_name              = local.internal_domain_names[local.env]["main"]
79	  env                      = "prod"
80	  private_subnet_ids       = [for subnet in dependency.vpc.outputs.vpc.private_subnet_map : subnet.id]
81	  vpc_id                   = dependency.vpc.outputs.vpc.vpc_id
82
83	  subnet_group_name_override       = "retool-db"
84	  dba_security_group_name_override = "retool-db-trusted-access"
85	  security_group_name_override     = "retool-db-access"
86
87	  trusted_cidr_blocks = [
88	    local.common_vars.locals.global_segment_cidrs["management"]["mgmt"]
89	  ]
90
91	  tags = local.tags
92	}
93

# ---------------------------------------------------------------------------------------------------------------------
# TERRAGRUNT CONFIGURATION
# ---------------------------------------------------------------------------------------------------------------------

terraform {
  source = "tfr://crow.infrastructure.immuta.io/iac/storage-database-retool/aws?version=1.3.0"
}

# Include all settings from the root terragrunt.hcl file
include {
  path = find_in_parent_folders()
}

generate "backup_provider" {
  path      = "backup-provider.tf"
  if_exists = "overwrite_terragrunt"
  contents  = <<EOF
provider aws {
  alias   = "backup"
  profile = "${local.accounts["platform_management"]["profile"]}"
  region  = "us-east-2"
}
EOF
}

# ---------------------------------------------------------------------------------------------------------------------
# Locals are named constants that are reusable within the configuration.
# ---------------------------------------------------------------------------------------------------------------------
locals {
  # Automatically load common variables shared across all accounts
  common_vars = read_terragrunt_config(find_in_parent_folders("common.hcl"))

  # Automatically load account-level variables
  account_vars = read_terragrunt_config(find_in_parent_folders("account.hcl"))

  # Automatically load region-level variables
  region_vars = read_terragrunt_config(find_in_parent_folders("region.hcl"))

  # Extract the region and environment for easy access
  aws_region = local.region_vars.locals.aws_region
  env        = local.account_vars.locals.env

  # A local for more convenient access to the accounts map.
  accounts = local.common_vars.locals.accounts

  # Temp hard coding of networking info
  private_subnet_ids = [
    "subnet-06cb9a003fdd25469",
    "subnet-0c0d3ae5cb03f32c4",
    "subnet-09ec022a9217e26d2"
  ]
  vpc_id             = "vpc-05a7c8e424ce2fadf"

  cidr_blocks           = local.common_vars.locals.cidr_blocks
  internal_domain_names = local.common_vars.locals.internal_domain_names

  tags = merge(local.common_vars.locals.global_tags, {
    tfpath = "/platform-management/${local.aws_region}/retool-database"
  })
}

# ---------------------------------------------------------------------------------------------------------------------
# MODULE DEPENDENCIES
# ---------------------------------------------------------------------------------------------------------------------

 dependency vpc {
   config_path = "../vpc-cloudwan"
 }

# ---------------------------------------------------------------------------------------------------------------------
# MODULE PARAMETERS
# These are the variables we have to pass in to use the module specified in the terragrunt configuration above
# ---------------------------------------------------------------------------------------------------------------------
inputs = {
  name                     = "retool-app"
  pg_version               = "17.4"
  domain_name              = local.internal_domain_names[local.env]["main"]
  env                      = "prod"
  private_subnet_ids       = [for subnet in dependency.vpc.outputs.vpc.private_subnet_map : subnet.id]
  vpc_id                   = dependency.vpc.outputs.vpc.vpc_id

  subnet_group_name_override       = "retool-db"
  dba_security_group_name_override = "retool-db-trusted-access"
  security_group_name_override     = "retool-db-access"

  trusted_cidr_blocks = [
    local.common_vars.locals.global_segment_cidrs["management"]["mgmt"]
  ]

  tags = local.tags
}


Let me check the cached terragrunt config and the module source to understand how GitHub modules are referenced here.


1	# ---------------------------------------------------------------------------------------------------------------------
2	# TERRAGRUNT CONFIGURATION
3	# ---------------------------------------------------------------------------------------------------------------------
4
5	terraform {
6	  source = "tfr://crow.infrastructure.immuta.io/internal/data-database-cps/aws?version=2.4.0"
7	}
8
9	# Include all settings from the root terragrunt.hcl file
10	include {
11	  path = find_in_parent_folders()
12	}
13
14	generate "backup_provider" {
15	  path      = "backup-provider.tf"
16	  if_exists = "overwrite_terragrunt"
17	  contents  = <<EOF
18	provider aws {
19	  alias   = "backup"
20	  profile = "${local.accounts["platform_management"]["profile"]}"
21	  region  = "us-east-2"
22	}
23	EOF
24	}
25
26	# ---------------------------------------------------------------------------------------------------------------------
27	# Locals are named constants that are reusable within the configuration.
28	# ---------------------------------------------------------------------------------------------------------------------
29	locals {
30	  # Automatically load common variables shared across all accounts
31	  common_vars = read_terragrunt_config(find_in_parent_folders("common.hcl"))
32
33	  # Automatically load account-level variables
34	  account_vars = read_terragrunt_config(find_in_parent_folders("account.hcl"))
35
36	  # Automatically load region-level variables
37	  region_vars = read_terragrunt_config(find_in_parent_folders("region.hcl"))
38
39	  # Extract the region and environment for easy access
40	  aws_region = local.region_vars.locals.aws_region
41	  env        = local.account_vars.locals.env
42
43	  # A local for more convenient access to the accounts map.
44	  accounts = local.common_vars.locals.accounts
45
46	  # Temp hard coding of networking info
47	  private_subnet_ids = [
48	    "subnet-06cb9a003fdd25469",
49	    "subnet-0c0d3ae5cb03f32c4",
50	    "subnet-09ec022a9217e26d2"
51	  ]
52	  vpc_id             = "vpc-05a7c8e424ce2fadf"
53
54	  gs_cidr_blocks        = local.common_vars.locals.global_segment_cidrs
55	  internal_domain_names = local.common_vars.locals.internal_domain_names
56
57
58	  tags = merge(local.common_vars.locals.global_tags, {
59	    tfpath = "/platform-management/${local.aws_region}/tools-database"
60	  })
61	}
62
63	# ---------------------------------------------------------------------------------------------------------------------
64	# MODULE DEPENDENCIES
65	# ---------------------------------------------------------------------------------------------------------------------
66
67	 dependency vpc {
68	   config_path = "../vpc-cloudwan"
69	 }
70
71	# ---------------------------------------------------------------------------------------------------------------------
72	# MODULE PARAMETERS
73	# These are the variables we have to pass in to use the module specified in the terragrunt configuration above
74	# ---------------------------------------------------------------------------------------------------------------------
75	inputs = {
76	  name                     = "tools-database"
77	  name_prefix              = "platform"
78	  db_name                  = "default_db"
79	  pg_version               = "16.2"
80	  domain_name              = local.internal_domain_names[local.env]["main"]
81	  env                      = "prod"
82	  subnet_ids       = [for subnet in dependency.vpc.outputs.vpc.private_subnet_map : subnet.id]
83	  vpc_id                   = dependency.vpc.outputs.vpc.vpc_id
84
85	  subnet_group_name_override       = "tools-db"
86	  dba_security_group_name_override = "tools-db-access"
87	  security_group_name_override     = "tools-db-trusted-access"
88
89	  instance_class = "db.t4g.micro"
90	  iam_database_authentication_enabled = true
91	  enhanced_monitoring_enabled = false
92	  performance_insights_enabled = false
93	  multi_az = false
94
95	  allocated_storage = 20
96	  storage_encrypted = true
97
98	  backup_retention_period = 5
99	  replica_retention_period = 5
100	  final_snapshot = false
101	  encrypt_replicas = true
102
103	  trusted_cidr_blocks = [
104	    local.gs_cidr_blocks["management"]["mgmt"]
105	  ]
106
107	  tags = local.tags
108	}
109

# ---------------------------------------------------------------------------------------------------------------------
# TERRAGRUNT CONFIGURATION
# ---------------------------------------------------------------------------------------------------------------------

terraform {
  source = "tfr://crow.infrastructure.immuta.io/internal/data-database-cps/aws?version=2.4.0"
}

# Include all settings from the root terragrunt.hcl file
include {
  path = find_in_parent_folders()
}

generate "backup_provider" {
  path      = "backup-provider.tf"
  if_exists = "overwrite_terragrunt"
  contents  = <<EOF
provider aws {
  alias   = "backup"
  profile = "${local.accounts["platform_management"]["profile"]}"
  region  = "us-east-2"
}
EOF
}

# ---------------------------------------------------------------------------------------------------------------------
# Locals are named constants that are reusable within the configuration.
# ---------------------------------------------------------------------------------------------------------------------
locals {
  # Automatically load common variables shared across all accounts
  common_vars = read_terragrunt_config(find_in_parent_folders("common.hcl"))

  # Automatically load account-level variables
  account_vars = read_terragrunt_config(find_in_parent_folders("account.hcl"))

  # Automatically load region-level variables
  region_vars = read_terragrunt_config(find_in_parent_folders("region.hcl"))

  # Extract the region and environment for easy access
  aws_region = local.region_vars.locals.aws_region
  env        = local.account_vars.locals.env

  # A local for more convenient access to the accounts map.
  accounts = local.common_vars.locals.accounts

  # Temp hard coding of networking info
  private_subnet_ids = [
    "subnet-06cb9a003fdd25469",
    "subnet-0c0d3ae5cb03f32c4",
    "subnet-09ec022a9217e26d2"
  ]
  vpc_id             = "vpc-05a7c8e424ce2fadf"

  gs_cidr_blocks        = local.common_vars.locals.global_segment_cidrs
  internal_domain_names = local.common_vars.locals.internal_domain_names

  tags = merge(local.common_vars.locals.global_tags, {
    tfpath = "/platform-management/${local.aws_region}/tools-database"
  })
}

# ---------------------------------------------------------------------------------------------------------------------
# MODULE DEPENDENCIES
# ---------------------------------------------------------------------------------------------------------------------

 dependency vpc {
   config_path = "../vpc-cloudwan"
 }

# ---------------------------------------------------------------------------------------------------------------------
# MODULE PARAMETERS
# These are the variables we have to pass in to use the module specified in the terragrunt configuration above
# ---------------------------------------------------------------------------------------------------------------------
inputs = {
  name                     = "tools-database"
  name_prefix              = "platform"
  db_name                  = "default_db"
  pg_version               = "16.2"
  domain_name              = local.internal_domain_names[local.env]["main"]
  env                      = "prod"
  subnet_ids       = [for subnet in dependency.vpc.outputs.vpc.private_subnet_map : subnet.id]
  vpc_id                   = dependency.vpc.outputs.vpc.vpc_id

  subnet_group_name_override       = "tools-db"
  dba_security_group_name_override = "tools-db-access"
  security_group_name_override     = "tools-db-trusted-access"

  instance_class = "db.t4g.micro"
  iam_database_authentication_enabled = true
  enhanced_monitoring_enabled = false
  performance_insights_enabled = false
  multi_az = false

  allocated_storage = 20
  storage_encrypted = true

  backup_retention_period = 5
  replica_retention_period = 5
  final_snapshot = false
  encrypt_replicas = true

  trusted_cidr_blocks = [
    local.gs_cidr_blocks["management"]["mgmt"]
  ]

  tags = local.tags
}


1	Kkoaz5ZurXj4twAK5WFbZJQodIg


Explore project context

Check existing files, structure, module interface, and nearby similar configs


grep -r "database-rds" /Users/steve.briggs/projects/cpi-new/platform-management --include="*.hcl" -l 2>/dev/null | head -10

Search for any existing database-rds module usage


grep -r "github.com/immuta" /Users/steve.briggs/projects/cpi-new/platform-management --include="*.hcl" -l 2>/dev/null | head -10

Search for GitHub-sourced terraform modules


The user doesn't want to proceed with this tool use. The tool use was rejected (eg. if it was a file edit, the new_string was NOT written to the file). STOP what you are doing and wait for the user to tell you how to proceed.


[Request interrupted by user for tool use]


we should also probably create an iac module similar to https://github.com/immuta/operations/tree/master/terraform/iac-library/aws/storage/database-retool-app and setup vault to store the admin credentials


Got it, Sir Charles. Let me scope this properly. Let me look at the retool IAC module and vault patterns before asking clarifying questions.


find /Users/steve.briggs/projects -maxdepth 3 -name "operations" -type d 2>/dev/null

Find the operations repo locally


/Users/steve.briggs/projects/operations
/Users/steve.briggs/projects/IAC/github-immuta/operations


find /Users/steve.briggs/projects/operations/terraform/iac-library/aws/storage/database-retool-app -type f 2>/dev/null

List files in the retool-app IAC module


find /Users/steve.briggs/projects/operations/terraform/internal-modules/aws/data/database-rds -type f 2>/dev/null

List files in database-rds internal module


1	# ---------------------------------------------------------------------------------------------------------------------
2	# MODULE PARAMETERS
3	# These variables are expected to be passed in by the operator when calling this terraform module.
4	# ---------------------------------------------------------------------------------------------------------------------
5
6	# ---------------------------------------------------------------------------------------------------------------------
7	# REQUIRED PARAMETERS
8	# These variables must be set.
9	# ---------------------------------------------------------------------------------------------------------------------
10
11	variable "vpc_id" {
12	  description = "The VPC Id for the resources to be created in"
13	  type        = string
14	}
15
16	variable "subnet_ids" {
17	  description = "Subnet IDs to put this DB instance in"
18	  type        = list(string)
19	}
20
21	variable "env" {
22	  description = "The standard name for the running environment.  One of: dev, staging, prod"
23	  type        = string
24	}
25
26	variable "pg_version" {
27	  description = "Postgres database version prefix"
28	  type        = string
29	  # default     = "11.6"
30	}
31
32	variable "name" {
33	  description = "The name to use for the resources created"
34	  type        = string
35	}
36
37	# ---------------------------------------------------------------------------------------------------------------------
38	# OPTIONAL PARAMETERS
39	# These variables are configurable, but have reasonable defaults set.
40	# ---------------------------------------------------------------------------------------------------------------------
41	variable "db_name" {
42	  description = "Database name to create when creating the DB instance"
43	  type        = string
44	  default     = ""
45	}
46
47	variable "admin_username" {
48	  description = "Username for the initial database user"
49	  type        = string
50	  default     = ""
51	}
52
53	variable "tags" {
54	  description = "Tags to assign to the compute resources"
55	  type        = map(any)
56	  default     = {}
57	}
58
59	variable "subnet_group_name_override" {
60	  description = "Optional override for subnet group name. Can be used when moving DB Subnet Groups."
61	  type        = string
62	  default     = ""
63	}
64
65	variable "security_group_ids" {
66	  description = "An optional list of VPC security groups to attach to the DB instance.  These are in additional to the default security created."
67	  type        = list(string)
68	  default     = []
69	}
70
71	variable "allocated_storage" {
72	  description = "The initial storage allocated in gibibytes"
73	  type        = number
74	  default     = 100
75	}
76	variable "final_snapshot" {
77	  description = "Take a snapshot before tearing down this db instance"
78	  type        = bool
79	  default     = true
80	}
81	variable "trusted_cidr_blocks" {
82	  description = "A optional list of CIDR blocks to allow access to the DB."
83	  type        = list(string)
84	  default     = []
85	}
86	variable "port" {
87	  description = "The port on which the DB accepts connections."
88	  type        = number
89	  default     = 5432
90	}
91	variable "trusted_security_group_ids" {
92	  description = "A optional list of security groups to allow access to the DB."
93	  type        = list(string)
94	  default     = []
95	}
96
97	variable "backup_window" {
98	  description = "Window for DB to run database backups"
99	  type        = string
100	  default     = "19:15-20:15"
101	}
102
103	variable "backup_retention_period" {
104	  description = "The days to retain backups for. Must be between 0 and 35."
105	  type        = number
106	  default     = 21
107	}
108
109	variable "replica_retention_period" {
110	  description = "The retention period for backup replication in days. Must be between 0 and 35."
111	  type        = number
112	  default     = 21
113	}
114
115	variable "deletion_protection" {
116	  description = "When true, the DB instance cannot be deleted via the API util the flag is disabled"
117	  type        = bool
118	  default     = true
119	}
120
121	variable "cloudwatch_logs_exports" {
122	  description = "List of log types to enable for exporting to CloudWatch logs"
123	  type        = list(string)
124	  default     = ["upgrade"]
125	}
126
127	variable "name_prefix" {
128	  description = "An optional string that will be pre-pended to the beginning of the resource names or paths"
129	  type        = string
130	  default     = ""
131	}
132
133	variable "name_suffix" {
134	  description = "An optional string that will be appended to the end of the resource names"
135	  type        = string
136	  default     = ""
137	}
138
139	variable "iam_database_authentication_enabled" {
140	  description = "Enable IAM auth"
141	  type        = bool
142	  default     = true
143	}
144
145	variable "instance_class" {
146	  description = "DB instance class"
147	  type        = string
148	  default     = "db.m5.large"
149	}
150
151	variable "storage_encrypted" {
152	  description = "Specifies whether the DB instance is encrypted"
153	  type        = bool
154	  default     = true
155	}
156
157	variable "storage_type" {
158	  description = "Type of storage used for backend"
159	  type        = string
160	  default     = "gp2"
161	}
162
163	variable "iops" {
164	  description = "IOPS setting for gp3 volumes, only used when allocated_storage >= 400"
165	  type        = number
166	  default     = 12000
167	}
168
169	variable "storage_throughput" {
170	  description = "Throughput setting for gp3 volumes, only used when allocated_storage >= 400"
171	  type        = number
172	  default     = 500
173	}
174
175	variable "kms_key_arn" {
176	  description = "KMS Key ARN to be used for database encryption."
177	  type        = string
178	  default     = ""
179	}
180	variable "kms_key_id" {
181	  description = "KMS Key ID to be used for database encryption."
182	  type        = string
183	  default     = ""
184	}
185	variable "kms_replication_key_arn" {
186	  description = "KMS Key ARN to be used for database encryption of the replicated cross region backups"
187	  type        = string
188	  default     = ""
189	}
190	variable "kms_replication_key_id" {
191	  description = "KMS Key ID to be used for database encryption of the replicated cross region backups"
192	  type        = string
193	  default     = ""
194	}
195	variable "encrypt_replicas" {
196	  description = "Should backup replicas be encrypted?"
197	  type        = bool
198	  default     = true
199	}
200
201	variable "ca_cert_identifier" {
202	  description = "RDS CA cert identifier to use"
203	  type        = string
204	  default     = "rds-ca-rsa2048-g1"
205	}
206
207	variable "security_group_name_override" {
208	  description = "Optional override for local access sg name. Can be used when moving DB Subnet Groups."
209	  type        = string
210	  default     = ""
211	}
212
213	variable "dba_security_group_name_override" {
214	  description = "Optional override for external access SG name. Can be used when moving DB Subnet Groups."
215	  type        = string
216	  default     = ""
217	}
218	variable "maintenance_window" {
219	  description = "DB database automatic maintenance / upgrades window"
220	  type        = string
221	  default     = "Sat:05:00-Sat:07:00"
222	}
223
224	variable "enhanced_monitoring_enabled" {
225	  description = "Creates IAM Role and enables Enhanced Monitoring on DB"
226	  type        = bool
227	  default     = false
228	}
229
230	variable "performance_insights_enabled" {
231	  description = "Enables performance insights on DB"
232	  type        = bool
233	  default     = false
234	}
235
236	variable "max_allocated_storage" {
237	  description = "When configured, the upper limit to which Amazon DB can automatically scale the storage of the DB instance.  Set to 0 to turn off"
238	  type        = number
239	  default     = 1000
240	}
241
242	variable "multi_az" {
243	  description = "Specifies if the DB instance is multi-AZ"
244	  type        = bool
245	  default     = true
246	}
247
248	variable "parameters" {
249	  description = "A map of DB parameters to apply via a parameter group.  If map is empty, the default parameter group will be used"
250	  type        = set(map(string))
251	  default     = []
252	}
253
254	variable "snapshot_identifier" {
255	  description = "Optional identifier for a snapshot to be restored from. Leave blank to create a fresh DB instance"
256	  type        = string
257	  default     = null
258	}
259
260	variable "create_before_destroy" {
261	  description = "Optional value to indicate whether the paramater group should be create and then deleted"
262	  type        = bool
263	  default     = true
264	}

# ---------------------------------------------------------------------------------------------------------------------
# MODULE PARAMETERS
# These variables are expected to be passed in by the operator when calling this terraform module.
# ---------------------------------------------------------------------------------------------------------------------

# ---------------------------------------------------------------------------------------------------------------------
# REQUIRED PARAMETERS
# These variables must be set.
# ---------------------------------------------------------------------------------------------------------------------

variable "vpc_id" {
  description = "The VPC Id for the resources to be created in"
  type        = string
}

variable "subnet_ids" {
  description = "Subnet IDs to put this DB instance in"
  type        = list(string)
}

variable "env" {
  description = "The standard name for the running environment.  One of: dev, staging, prod"
  type        = string
}

variable "pg_version" {
  description = "Postgres database version prefix"
  type        = string
  # default     = "11.6"
}

variable "name" {
  description = "The name to use for the resources created"
  type        = string
}

# ---------------------------------------------------------------------------------------------------------------------
# OPTIONAL PARAMETERS
# These variables are configurable, but have reasonable defaults set.
# ---------------------------------------------------------------------------------------------------------------------
variable "db_name" {
  description = "Database name to create when creating the DB instance"
  type        = string
  default     = ""
}

variable "admin_username" {
  description = "Username for the initial database user"
  type        = string
  default     = ""
}

variable "tags" {
  description = "Tags to assign to the compute resources"
  type        = map(any)
  default     = {}
}

variable "subnet_group_name_override" {
  description = "Optional override for subnet group name. Can be used when moving DB Subnet Groups."
  type        = string
  default     = ""
}

variable "security_group_ids" {
  description = "An optional list of VPC security groups to attach to the DB instance.  These are in additional to the default security created."
  type        = list(string)
  default     = []
}

variable "allocated_storage" {
  description = "The initial storage allocated in gibibytes"
  type        = number
  default     = 100
}
variable "final_snapshot" {
  description = "Take a snapshot before tearing down this db instance"
  type        = bool
  default     = true
}
variable "trusted_cidr_blocks" {
  description = "A optional list of CIDR blocks to allow access to the DB."
  type        = list(string)
  default     = []
}
variable "port" {
  description = "The port on which the DB accepts connections."
  type        = number
  default     = 5432
}
variable "trusted_security_group_ids" {
  description = "A optional list of security groups to allow access to the DB."
  type        = list(string)
  default     = []
}

variable "backup_window" {
  description = "Window for DB to run database backups"
  type        = string
  default     = "19:15-20:15"
}

variable "backup_retention_period" {
  description = "The days to retain backups for. Must be between 0 and 35."
  type        = number
  default     = 21
}

variable "replica_retention_period" {
  description = "The retention period for backup replication in days. Must be between 0 and 35."
  type        = number
  default     = 21
}

variable "deletion_protection" {
  description = "When true, the DB instance cannot be deleted via the API util the flag is disabled"
  type        = bool
  default     = true
}

variable "cloudwatch_logs_exports" {
  description = "List of log types to enable for exporting to CloudWatch logs"
  type        = list(string)
  default     = ["upgrade"]
}

variable "name_prefix" {
  description = "An optional string that will be pre-pended to the beginning of the resource names or paths"
  type        = string
  default     = ""
}

variable "name_suffix" {
  description = "An optional string that will be appended to the end of the resource names"
  type        = string
  default     = ""
}

variable "iam_database_authentication_enabled" {
  description = "Enable IAM auth"
  type        = bool
  default     = true
}

variable "instance_class" {
  description = "DB instance class"
  type        = string
  default     = "db.m5.large"
}

variable "storage_encrypted" {
  description = "Specifies whether the DB instance is encrypted"
  type        = bool
  default     = true
}

variable "storage_type" {
  description = "Type of storage used for backend"
  type        = string
  default     = "gp2"
}

variable "iops" {
  description = "IOPS setting for gp3 volumes, only used when allocated_storage >= 400"
  type        = number
  default     = 12000
}

variable "storage_throughput" {
  description = "Throughput setting for gp3 volumes, only used when allocated_storage >= 400"
  type        = number
  default     = 500
}

variable "kms_key_arn" {
  description = "KMS Key ARN to be used for database encryption."
  type        = string
  default     = ""
}
variable "kms_key_id" {
  description = "KMS Key ID to be used for database encryption."
  type        = string
  default     = ""
}
variable "kms_replication_key_arn" {
  description = "KMS Key ARN to be used for database encryption of the replicated cross region backups"
  type        = string
  default     = ""
}
variable "kms_replication_key_id" {
  description = "KMS Key ID to be used for database encryption of the replicated cross region backups"
  type        = string
  default     = ""
}
variable "encrypt_replicas" {
  description = "Should backup replicas be encrypted?"
  type        = bool
  default     = true
}

variable "ca_cert_identifier" {
  description = "RDS CA cert identifier to use"
  type        = string
  default     = "rds-ca-rsa2048-g1"
}

variable "security_group_name_override" {
  description = "Optional override for local access sg name. Can be used when moving DB Subnet Groups."
  type        = string
  default     = ""
}

variable "dba_security_group_name_override" {
  description = "Optional override for external access SG name. Can be used when moving DB Subnet Groups."
  type        = string
  default     = ""
}
variable "maintenance_window" {
  description = "DB database automatic maintenance / upgrades window"
  type        = string
  default     = "Sat:05:00-Sat:07:00"
}

variable "enhanced_monitoring_enabled" {
  description = "Creates IAM Role and enables Enhanced Monitoring on DB"
  type        = bool
  default     = false
}

variable "performance_insights_enabled" {
  description = "Enables performance insights on DB"
  type        = bool
  default     = false
}

variable "max_allocated_storage" {
  description = "When configured, the upper limit to which Amazon DB can automatically scale the storage of the DB instance.  Set to 0 to turn off"
  type        = number
  default     = 1000
}

variable "multi_az" {
  description = "Specifies if the DB instance is multi-AZ"
  type        = bool
  default     = true
}

variable "parameters" {
  description = "A map of DB parameters to apply via a parameter group.  If map is empty, the default parameter group will be used"
  type        = set(map(string))
  default     = []
}

variable "snapshot_identifier" {
  description = "Optional identifier for a snapshot to be restored from. Leave blank to create a fresh DB instance"
  type        = string
  default     = null
}

variable "create_before_destroy" {
  description = "Optional value to indicate whether the paramater group should be create and then deleted"
  type        = bool
  default     = true
}


we should also probably create an iac module similar to https://github.com/immuta/operations/tree/master/terraform/iac-library/aws/storage/database-retool-app and setup vault to store the admin creden…