[ISSUE 502]: Create DMS Internal Networking components (#694)

* Some networking for security groups

* Add egress rule

* Add dms module

* add vpc rules

* typo

* add peering connection ref

* add more descriptive comments

---------

Co-authored-by: Alsia Plybeah <[email protected]>

infra/modules/database/networking.tf

@@ -13,6 +13,14 @@ resource "aws_security_group" "role_manager" {
   vpc_id      = var.vpc_id
 }
 
+# We need to attach this security group to our DMS instance when created
+resource "aws_security_group" "dms" {
+  # checkov:skip= CKV2_AWS_5:DMS instance not created yet
+  name_prefix = "${var.name}-dms"
+  description = "Database DMS security group"
+  vpc_id      = var.vpc_id
+}
+
 resource "aws_vpc_security_group_egress_rule" "role_manager_egress_to_db" {
   security_group_id = aws_security_group.role_manager.id
   description       = "Allow role manager to access database"
@@ -33,6 +41,26 @@ resource "aws_vpc_security_group_ingress_rule" "db_ingress_from_role_manager" {
   referenced_security_group_id = aws_security_group.role_manager.id
 }
 
+resource "aws_vpc_security_group_egress_rule" "db_egress_from_dms" {
+  security_group_id = aws_security_group.db.id
+  description       = "Allow outbound requests to database from DMS"
+
+  from_port                    = 5432
+  to_port                      = 5432
+  ip_protocol                  = "tcp"
+  referenced_security_group_id = aws_security_group.dms.id
+}
+
+resource "aws_vpc_security_group_ingress_rule" "db_ingress_from_dms" {
+  security_group_id = aws_security_group.db.id
+  description       = "Allow inbound requests to database from DMS"
+
+  from_port                    = 5432
+  to_port                      = 5432
+  ip_protocol                  = "tcp"
+  referenced_security_group_id = aws_security_group.dms.id
+}
+
 resource "aws_vpc_security_group_egress_rule" "role_manager_egress_to_vpc_endpoints" {
   security_group_id = aws_security_group.role_manager.id
   description       = "Allow outbound requests from role manager to VPC endpoints"

infra/modules/dms/networking.tf

@@ -0,0 +1,10 @@
+# Add Security Groups for VPC -> DMS here
+data "aws_caller_identity" "current" {}
+data "aws_region" "current" {}
+
+# This connection was created in the console, the provided arguments act more as a query than a reference
+data "aws_vpc_peering_connection" "dms" {
+  owner_id        = data.aws_caller_identity.current.account_id
+  cidr_block      = "172.31.0.0/16" # our cidr block, where the target database for the DMS is located
+  peer_cidr_block = "10.220.0.0/16" # their cidr block, where the origin database for the DMS is located
+}

infra/modules/dms/variables.tf

@@ -0,0 +1 @@
+