type: user

role: user

content:
You are implementing Task 1 of an infrastructure plan. Your job is to create one specific file, verify its formatting, and report back.

## Context

We are building a new Terraform IAC module called `database-tools-db` in the `operations` repo. This module provisions an RDS PostgreSQL instance with KMS encryption and stores admin credentials in Vault. It is modeled after the existing `database-retool-app` module at `/Users/steve.briggs/projects/operations/terraform/iac-library/aws/storage/database-retool-app/`.

## Your Task

Create the file `/Users/steve.briggs/projects/operations/terraform/iac-library/aws/storage/database-tools-db/main.tf` with the exact content below, then verify formatting.

**Step 1: Create the directory and file**

Create `/Users/steve.briggs/projects/operations/terraform/iac-library/aws/storage/database-tools-db/main.tf` with this exact content:

```hcl
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# SET UP THE DATABASE FOR TOOLS
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

terraform {
  required_version = "~> 1.0"

  required_providers {
    aws = {
      source                = "hashicorp/aws"
      version               = "~> 4.0"
      configuration_aliases = [aws.backup]
    }
    vault = {
      source  = "hashicorp/vault"
      version = "~> 3.0"
    }
    random = {
      version = "~> 3.6.0"
    }
  }
}

locals {
  name         = var.name != "" ? var.name : "tools-database-${var.env}"
  kms_key_name = "${local.name}-db-key"
}

# ----------------------------------------------------------------------------------------------------------------------
# CREATE KMS KEYS
# ----------------------------------------------------------------------------------------------------------------------

module "database_kms" {
  source  = "crow.infrastructure.immuta.io/internal/security-kms-key/aws"
  version = "1.4.0"
  count   = var.storage_encrypted ? 1 : 0

  customer_master_keys = {
    (local.kms_key_name) = {
      allow_manage_key_permissions_with_iam = true
      deletion_window_in_days               = var.kms_key_deletion_window_in_days
      enable_key_rotation                   = false
      multi_region                          = true
      tags                                  = var.tags
    }
  }
}

resource "aws_kms_replica_key" "replica_key" {
  count = var.storage_encrypted && var.encrypt_replicas ? 1 : 0

  provider   = aws.backup
  depends_on = [module.database_kms]

  description             = "KMS Replica Key for tools database"
  deletion_window_in_days = var.kms_key_deletion_window_in_days
  primary_key_arn         = module.database_kms[0].key_arns[local.kms_key_name]

  tags = var.tags
}

# ----------------------------------------------------------------------------------------------------------------------
# CREATE THE RDS INSTANCE
# ----------------------------------------------------------------------------------------------------------------------

module "database" {
  source  = "crow.infrastructure.immuta.io/internal/data-database-rds/aws"
  version = "3.0.1"

  providers = {
    aws.backup = aws.backup
  }

  name               = local.name
  pg_version         = var.pg_version
  env                = var.env
  ca_cert_identifier = var.ca_cert_identifier

  db_name        = var.db_name
  admin_username = var.admin_username
  instance_class = var.rds_instance_size

  enhanced_monitoring_enabled  = var.enhanced_monitoring_enabled
  performance_insights_enabled = var.performance_insights_enabled
  multi_az                     = var.multi_az

  kms_key_arn             = var.storage_encrypted ? module.database_kms[0].key_arns[local.kms_key_name] : ""
  kms_replication_key_arn = var.storage_encrypted && var.encrypt_replicas ? aws_kms_replica_key.replica_key[0].arn : ""

  vpc_id              = var.vpc_id
  subnet_ids          = var.private_subnet_ids
  trusted_cidr_blocks = var.trusted_cidr_blocks

  subnet_group_name_override       = var.subnet_group_name_override
  dba_security_group_name_override = var.dba_security_group_name_override
  security_group_name_override     = var.security_group_name_override

  allocated_storage     = var.allocated_storage
  max_allocated_storage = var.max_allocated_storage
  storage_encrypted     = var.storage_encrypted
  storage_type          = var.storage_type

  backup_retention_period  = var.backup_retention_period
  replica_retention_period = var.replica_retention_period
  final_snapshot           = var.final_snapshot
  encrypt_replicas         = var.encrypt_replicas

  tags = var.tags

  depends_on = [module.database_kms, aws_kms_replica_key.replica_key]
}

# ----------------------------------------------------------------------------------------------------------------------
# STORE ADMIN CREDENTIALS IN VAULT
# ----------------------------------------------------------------------------------------------------------------------

resource "vault_generic_secret" "admin_credentials" {
  path = var.vault_secret_path

  data_json = jsonencode({
    username = module.database.admin_username
    password = module.database.admin_password
    endpoint = module.database.endpoint
    address  = module.database.address
    port     = module.database.port
    db_name  = module.database.name
  })
}
```

**Step 2: Verify formatting**

Run:
```bash
cd /Users/steve.briggs/projects/operations/terraform/iac-library/aws/storage/database-tools-db
terraform fmt -check main.tf
```

If there are diffs, run `terraform fmt main.tf` to fix them, then re-check.

## Report

End your response with one of:
- `STATUS: DONE` — file created and formatting verified clean
- `STATUS: DONE_WITH_CONCERNS` — done but something notable
- `STATUS: BLOCKED` — cannot proceed, explain why

userType: external

entrypoint: cli


content:
- obsidian-load: Load context from Obsidian notes in the `Claude/` directory into the current conversation.
- obsidian-save: Save current conversation context to an Obsidian note under the `Claude/` directory.
- mind:search: Search memories for specific content or patterns
- mind:stats: Show memory statistics and storage information
- mind:ask: Ask questions about memories and get context-aware answers
- mind:recent: Show recent memories and activity timeline
- mind:memory: Claude Mind - Search and manage Claude's persistent memory stored in a single portable .mv2 file
- mind:mind: Claude Mind - Search and manage Claude's persistent memory stored in a single portable .mv2 file
- superpowers:dispatching-parallel-agents: Use when facing 2+ independent tasks that can be worked on without shared state or sequential dependencies
- superpowers:test-driven-development: Use when implementing any feature or bugfix, before writing implementation code
- superpowers:systematic-debugging: Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes
- superpowers:executing-plans: Use when you have a written implementation plan to execute in a separate session with review checkpoints
- superpowers:using-superpowers: Use when starting any conversation - establishes how to find and use skills, requiring Skill tool invocation before ANY response including clarifying questions
- superpowers:using-git-worktrees: Use when starting feature work that needs isolation from current workspace or before executing implementation plans - ensures an isolated workspace exists via native tools or git worktree fallback
- superpowers:requesting-code-review: Use when completing tasks, implementing major features, or before merging to verify work meets requirements
- superpowers:finishing-a-development-branch: Use when implementation is complete, all tests pass, and you need to decide how to integrate the work - guides completion of development work by presenting structured options for merge, PR, or cleanup
- superpowers:brainstorming: You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
- superpowers:writing-plans: Use when you have a spec or requirements for a multi-step task, before touching code
- superpowers:receiving-code-review: Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation
- superpowers:verification-before-completion: Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always
- superpowers:writing-skills: Use when creating new skills, editing existing skills, or verifying skills work before deployment
- superpowers:subagent-driven-development: Use when executing implementation plans with independent tasks in the current session
- update-config: Use this skill to configure the Claude Code harness via settings.json. Automated behaviors ("from now on when X", "each time X", "whenever X", "before/after X") require hooks configured in settings.json - the harness executes these, not Claude, so memory/preferences cannot fulfill them. Also use for: permissions ("allow X", "add permission", "move permission to"), env vars ("set X=Y"), hook troubleshooting, or any changes to settings.json/settings.local.json files. Examples: "allow npm commands", "add bq permission to global settings", "move permission to user settings", "set DEBUG=true", "when claude stops show X". For simple settings like theme/model, suggest the /config command.
- keybindings-help: Use when the user wants to customize keyboard shortcuts, rebind keys, add chord bindings, or modify ~/.claude/keybindings.json. Examples: "rebind ctrl+s", "add a chord shortcut", "change the submit key", "customize keybindings".
- verify: Verify that a code change actually does what it's supposed to by running the app and observing behavior. Use when asked to verify a PR, confirm a fix works, test a change manually, check that a feature works, or validate local changes before pushing.
- simplify: Review changed code for reuse, quality, and efficiency, then fix any issues found.
- fewer-permission-prompts: Scan your transcripts for common read-only Bash and MCP tool calls, then add a prioritized allowlist to project .claude/settings.json to reduce permission prompts.
- loop: Run a prompt or slash command on a recurring interval (e.g. /loop 5m /foo). Omit the interval to let the model self-pace. - When the user wants to set up a recurring task, poll for status, or run something repeatedly on an interval (e.g. "check the deploy every 5 minutes", "keep running /babysit-prs"). Do NOT invoke for one-off tasks.
- schedule: Create, update, list, or run scheduled remote agents (routines) that execute on a cron schedule. - When the user wants to schedule a recurring remote agent, set up automated tasks, create a cron job for Claude Code, or manage their scheduled agents/routines. Also use when the user wants a one-time scheduled run ("run this once at 3pm", "remind me to check X tomorrow").
- claude-api: Build, debug, and optimize Claude API / Anthropic SDK apps. Apps built with this skill should include prompt caching. Also handles migrating existing Claude API code between Claude model versions (4.5 → 4.6, 4.6 → 4.7, retired-model replacements).
TRIGGER when: code imports `anthropic`/`@anthropic-ai/sdk`; user asks for the Claude API, Anthropic SDK, or Managed Agents; user adds/modifies/tunes a Claude feature (caching, thinking, compaction, tool use, batch, files, citations, memory) or model (Opus/Sonnet/Haiku) in a file; questions about prompt caching / cache hit rate in an Anthropic SDK project.
SKIP: file imports `openai`/other-provider SDK, filename like `*-openai.py`/`*-generic.py`, provider-neutral code, general programming/ML.
- run: Launch and drive this project's app to see a change working. Use when asked to run, start, or screenshot the app, or to confirm a change works in the real app (not just tests). First looks for a project skill that already covers launching the app; otherwise falls back to built-in patterns per project type (CLI, server, TUI, Electron, browser-driven, library).
- init: Initialize a new CLAUDE.md file with codebase documentation
- review: Review a pull request
- security-review: Complete a security review of the pending changes on the current branch

type: attachment


type: message

role: assistant

type: text

text: Let me start by checking the existing module for reference and then create the new file.

service_tier: standard

attributionAgent: general-purpose

attributionPlugin: superpowers

type: assistant


Bash

command: ls /Users/steve.briggs/projects/operations/terraform/iac-library/aws/storage/database-retool-app/ 2>/dev/null && ls /Users/steve.briggs/projects/operations/terraform/iac-library/aws/storage/ 2>/dev/null

description: Check existing module structure and storage directory

type: direct

speed: standard


content:
.rw-r--r-- steve.briggs staff 8.5 KB Tue May 12 16:37:45 2026 README.md
.rw-r--r-- steve.briggs staff   6 B  Tue May 12 16:37:45 2026 VERSION
.rw-r--r-- steve.briggs staff 4.9 KB Tue May 12 16:37:45 2026 main.tf
.rw-r--r-- steve.briggs staff 1.5 KB Tue May 12 16:37:45 2026 output.tf
drwxr-xr-x steve.briggs staff 224 B  Tue May 12 16:37:45 2026 .
.rw-r--r-- steve.briggs staff 5.0 KB Tue May 12 16:37:45 2026 variables.tf
drwxr-xr-x steve.briggs staff 512 B  Tue May 12 16:37:45 2026 ..
drwxr-xr-x steve.briggs staff 320 B Tue May 12 16:37:45 2026 ..
drwxr-xr-x steve.briggs staff 224 B Tue May 12 16:37:45 2026 cross-account-s3-bucket
drwxr-xr-x steve.briggs staff 224 B Tue May 12 16:37:45 2026 database-cps
drwxr-xr-x steve.briggs staff 224 B Tue May 12 16:37:45 2026 database-retool-app
drwxr-xr-x steve.briggs staff 224 B Tue May 12 16:37:45 2026 database-retool
drwxr-xr-x steve.briggs staff 224 B Tue May 12 16:37:45 2026 databricks-workspace
drwxr-xr-x steve.briggs staff 224 B Tue May 12 16:37:45 2026 datadog-dbm-rds
drwxr-xr-x steve.briggs staff 224 B Tue May 12 16:37:45 2026 ebs-dlm-lifecycle-policy
drwxr-xr-x steve.briggs staff 224 B Tue May 12 16:37:45 2026 elasticache
drwxr-xr-x steve.briggs staff 224 B Tue May 12 16:37:45 2026 multitenant-rds-postgresql
drwxr-xr-x steve.briggs staff 224 B Tue May 12 16:37:45 2026 platform-artifacts-bucket
drwxr-xr-x steve.briggs staff 224 B Tue May 12 16:37:45 2026 redis-cps
drwxr-xr-x steve.briggs staff 192 B Tue May 12 16:37:45 2026 service-bucket
drwxr-xr-x steve.briggs staff 224 B Tue May 12 16:37:45 2026 tenant-backups-dr
drwxr-xr-x steve.briggs staff 512 B Tue May 12 16:37:45 2026 .
drwxr-xr-x steve.briggs staff 224 B Tue May 12 16:37:45 2026 tenant-backups


text: Good, the directory doesn't exist yet. Let me create it and the file.


description: Create the new module directory


content: (Bash completed with no output)


Write

content:
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# SET UP THE DATABASE FOR TOOLS
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

terraform {
  required_version = "~> 1.0"

  required_providers {
    aws = {
      source                = "hashicorp/aws"
      version               = "~> 4.0"
      configuration_aliases = [aws.backup]
    }
    vault = {
      source  = "hashicorp/vault"
      version = "~> 3.0"
    }
    random = {
      version = "~> 3.6.0"
    }
  }
}

locals {
  name         = var.name != "" ? var.name : "tools-database-${var.env}"
  kms_key_name = "${local.name}-db-key"
}

# ----------------------------------------------------------------------------------------------------------------------
# CREATE KMS KEYS
# ----------------------------------------------------------------------------------------------------------------------

module "database_kms" {
  source  = "crow.infrastructure.immuta.io/internal/security-kms-key/aws"
  version = "1.4.0"
  count   = var.storage_encrypted ? 1 : 0

  customer_master_keys = {
    (local.kms_key_name) = {
      allow_manage_key_permissions_with_iam = true
      deletion_window_in_days               = var.kms_key_deletion_window_in_days
      enable_key_rotation                   = false
      multi_region                          = true
      tags                                  = var.tags
    }
  }
}

resource "aws_kms_replica_key" "replica_key" {
  count = var.storage_encrypted && var.encrypt_replicas ? 1 : 0

  provider   = aws.backup
  depends_on = [module.database_kms]

  description             = "KMS Replica Key for tools database"
  deletion_window_in_days = var.kms_key_deletion_window_in_days
  primary_key_arn         = module.database_kms[0].key_arns[local.kms_key_name]

  tags = var.tags
}

# ----------------------------------------------------------------------------------------------------------------------
# CREATE THE RDS INSTANCE
# ----------------------------------------------------------------------------------------------------------------------

module "database" {
  source  = "crow.infrastructure.immuta.io/internal/data-database-rds/aws"
  version = "3.0.1"

  providers = {
    aws.backup = aws.backup
  }

  name               = local.name
  pg_version         = var.pg_version
  env                = var.env
  ca_cert_identifier = var.ca_cert_identifier

  db_name        = var.db_name
  admin_username = var.admin_username
  instance_class = var.rds_instance_size

  enhanced_monitoring_enabled  = var.enhanced_monitoring_enabled
  performance_insights_enabled = var.performance_insights_enabled
  multi_az                     = var.multi_az

  kms_key_arn             = var.storage_encrypted ? module.database_kms[0].key_arns[local.kms_key_name] : ""
  kms_replication_key_arn = var.storage_encrypted && var.encrypt_replicas ? aws_kms_replica_key.replica_key[0].arn : ""

  vpc_id              = var.vpc_id
  subnet_ids          = var.private_subnet_ids
  trusted_cidr_blocks = var.trusted_cidr_blocks

  subnet_group_name_override       = var.subnet_group_name_override
  dba_security_group_name_override = var.dba_security_group_name_override
  security_group_name_override     = var.security_group_name_override

  allocated_storage     = var.allocated_storage
  max_allocated_storage = var.max_allocated_storage
  storage_encrypted     = var.storage_encrypted
  storage_type          = var.storage_type

  backup_retention_period  = var.backup_retention_period
  replica_retention_period = var.replica_retention_period
  final_snapshot           = var.final_snapshot
  encrypt_replicas         = var.encrypt_replicas

  tags = var.tags

  depends_on = [module.database_kms, aws_kms_replica_key.replica_key]
}

# ----------------------------------------------------------------------------------------------------------------------
# STORE ADMIN CREDENTIALS IN VAULT
# ----------------------------------------------------------------------------------------------------------------------

resource "vault_generic_secret" "admin_credentials" {
  path = var.vault_secret_path

  data_json = jsonencode({
    username = module.database.admin_username
    password = module.database.admin_password
    endpoint = module.database.endpoint
    address  = module.database.address
    port     = module.database.port
    db_name  = module.database.name
  })
}


content: File created successfully at: /Users/steve.briggs/projects/operations/terraform/iac-library/aws/storage/database-tools-db/main.tf (file state is current in your context — no need to Read it back)


Bash

command: cd /Users/steve.briggs/projects/operations/terraform/iac-library/aws/storage/database-tools-db && terraform fmt -check main.tf; echo "exit_code=$?"

description: Check terraform formatting on main.tf


text:
Formatting check passed with exit code 0 — no diffs, the file is already properly formatted. Here's a summary of what was done:

- Created directory `/Users/steve.briggs/projects/operations/terraform/iac-library/aws/storage/database-tools-db/`
- Created `/Users/steve.briggs/projects/operations/terraform/iac-library/aws/storage/database-tools-db/main.tf` with the specified HCL content
- `terraform fmt -check main.tf` returned exit code 0 — no formatting changes needed

STATUS: DONE