Merge pull request #22 from elizabeth-ikechukwu/feat/week8-auth-ui-ssm

fix: add DB_SSL=true permanently to SSM, ec2 startup, and deploy job

.github/workflows/ci-cd.yml

@@ -344,7 +344,7 @@ jobs:
               "DB_PASSWORD=$(aws ssm get-parameter --name /scalable-task-platform/db_password --with-decryption --query Parameter.Value --output text --region us-east-1)",
               "JWT_SECRET=$(aws ssm get-parameter --name /scalable-task-platform/jwt_secret --with-decryption --query Parameter.Value --output text --region us-east-1)",
               "echo \"--- Starting backend ---\"",
-              "docker run -d --name task-backend --restart unless-stopped -p 3000:3000 -e DB_HOST=$DB_HOST -e DB_PORT=5432 -e DB_NAME=$DB_NAME -e DB_USER=$DB_USER -e DB_PASSWORD=$DB_PASSWORD -e JWT_SECRET=$JWT_SECRET 424522917561.dkr.ecr.us-east-1.amazonaws.com/task-backend:latest",
+              "docker run -d --name task-backend --restart unless-stopped -p 3000:3000 -e DB_HOST=$DB_HOST -e DB_PORT=5432 -e DB_NAME=$DB_NAME -e DB_USER=$DB_USER -e DB_PASSWORD=$DB_PASSWORD -e DB_SSL=true -e JWT_SECRET=$JWT_SECRET 424522917561.dkr.ecr.us-east-1.amazonaws.com/task-backend:latest",
               "sleep 5",
               "echo \"--- Starting frontend ---\"",
               "docker run -d --name task-frontend --restart unless-stopped -p 80:80 --link task-backend:backend 424522917561.dkr.ecr.us-east-1.amazonaws.com/task-frontend:latest",

infra/terraform/ec2.tf

@@ -87,6 +87,12 @@ resource "aws_instance" "app" {
       --output text \
       --region ${var.aws_region})
 
+    DB_SSL=$(aws ssm get-parameter \
+      --name "/${var.project_name}/db_ssl" \
+      --query "Parameter.Value" \
+      --output text \
+      --region ${var.aws_region})
+
     # Authenticate to ECR
     aws ecr get-login-password --region ${var.aws_region} | \
       docker login --username AWS --password-stdin \
@@ -106,6 +112,7 @@ resource "aws_instance" "app" {
       -e DB_NAME=$DB_NAME \
       -e DB_USER=$DB_USER \
       -e DB_PASSWORD=$DB_PASSWORD \
+      -e DB_SSL=$DB_SSL \
       -e JWT_SECRET=$JWT_SECRET \
       ${var.aws_account_id}.dkr.ecr.${var.aws_region}.amazonaws.com/task-backend:latest
 

infra/terraform/ssm.tf

@@ -3,13 +3,11 @@
 # Stores all runtime secrets for the EC2 instance.
 # EC2 fetches these at startup - no secrets in user data.
 # --------------------------------------------------
-
 resource "aws_ssm_parameter" "db_host" {
   name        = "/${var.project_name}/db_host"
   description = "RDS instance hostname"
   type        = "SecureString"
   value       = var.db_host
-
   tags = {
     Project     = var.project_name
     Environment = var.environment
@@ -21,7 +19,6 @@ resource "aws_ssm_parameter" "db_name" {
   description = "PostgreSQL database name"
   type        = "SecureString"
   value       = var.db_name
-
   tags = {
     Project     = var.project_name
     Environment = var.environment
@@ -33,7 +30,6 @@ resource "aws_ssm_parameter" "db_username" {
   description = "PostgreSQL master username"
   type        = "SecureString"
   value       = var.db_username
-
   tags = {
     Project     = var.project_name
     Environment = var.environment
@@ -45,7 +41,6 @@ resource "aws_ssm_parameter" "db_password" {
   description = "PostgreSQL master password"
   type        = "SecureString"
   value       = var.db_password
-
   tags = {
     Project     = var.project_name
     Environment = var.environment
@@ -57,7 +52,17 @@ resource "aws_ssm_parameter" "jwt_secret" {
   description = "JWT signing secret for authentication"
   type        = "SecureString"
   value       = var.jwt_secret
-
+  tags = {
+    Project     = var.project_name
+    Environment = var.environment
+  }
+}
+
+resource "aws_ssm_parameter" "db_ssl" {
+  name        = "/${var.project_name}/db_ssl"
+  description = "Enable SSL for RDS connection"
+  type        = "String"
+  value       = "true"
   tags = {
     Project     = var.project_name
     Environment = var.environment