week-7: fix subnet count and RDS security group reference

infra/terraform/rds.tf

@@ -4,9 +4,6 @@
 # ─────────────────────────────────────────────
 
 # ── DB Subnet Group ──────────────────────────
-# RDS needs to know which subnets it can live in.
-# We use the private subnets so it is never
-# reachable from the public internet.
 resource "aws_db_subnet_group" "tasks" {
   name       = "${var.project_name}-db-subnet-group"
   subnet_ids = aws_subnet.private[*].id
@@ -18,7 +15,7 @@ resource "aws_db_subnet_group" "tasks" {
 }
 
 # ── Security Group: RDS ──────────────────────
-# Only the EC2 instance security group may reach
+# Only the EC2 instance (nginx sg) may reach
 # the database on port 5432. No public access.
 resource "aws_security_group" "rds" {
   name        = "${var.project_name}-rds-sg"
@@ -30,7 +27,7 @@ resource "aws_security_group" "rds" {
     from_port       = 5432
     to_port         = 5432
     protocol        = "tcp"
-    security_groups = [aws_security_group.backend.id]
+    security_groups = [aws_security_group.nginx.id]
   }
 
   egress {
@@ -48,9 +45,6 @@ resource "aws_security_group" "rds" {
 }
 
 # ── RDS Parameter Group ──────────────────────
-# Explicit parameter group gives you a place to
-# tune Postgres settings later without replacing
-# the instance.
 resource "aws_db_parameter_group" "tasks" {
   name   = "${var.project_name}-pg16"
   family = "postgres16"
@@ -68,16 +62,15 @@ resource "aws_db_instance" "tasks" {
   # Engine
   engine         = "postgres"
   engine_version = "16"
-  instance_class = "db.t3.micro" # Free-tier eligible
+  instance_class = "db.t3.micro"
 
   # Storage
   allocated_storage     = 20
-  max_allocated_storage = 100 # Enable storage autoscaling up to 100 GB
+  max_allocated_storage = 100
   storage_type          = "gp2"
   storage_encrypted     = true
 
-  # Credentials — sourced from Terraform variables
+  # Credentials
-  # which are populated from GitHub Secrets via the pipeline
   db_name  = var.db_name
   username = var.db_username
   password = var.db_password
@@ -86,21 +79,20 @@ resource "aws_db_instance" "tasks" {
   db_subnet_group_name   = aws_db_subnet_group.tasks.name
   vpc_security_group_ids = [aws_security_group.rds.id]
   publicly_accessible    = false
-  multi_az               = false # Single-AZ is fine for this stage
+  multi_az               = false
 
   # Maintenance
   parameter_group_name    = aws_db_parameter_group.tasks.name
   backup_retention_period = 7
   backup_window           = "03:00-04:00"
   maintenance_window      = "Mon:04:00-Mon:05:00"
-  deletion_protection     = false # Set to true before production hardening (Week 10)
+  deletion_protection     = false
 
-  # Lifecycle — prevent accidental destroy on credential rotation
   lifecycle {
     ignore_changes = [password]
   }
 
-  skip_final_snapshot = true # Change to false and set final_snapshot_identifier for production
+  skip_final_snapshot = true
 
   tags = {
     Name    = "${var.project_name}-db"
@@ -109,8 +101,6 @@ resource "aws_db_instance" "tasks" {
 }
 
 # ── Outputs ───────────────────────────────────
-# The EC2 user-data script and any future modules
-# that need the DB endpoint will read these.
 output "rds_endpoint" {
   description = "RDS instance endpoint (host:port)"
   value       = aws_db_instance.tasks.endpoint

infra/terraform/variables.tf

@@ -32,11 +32,12 @@ variable "public_subnet_cidr" {
   default     = "10.0.1.0/24"
 }
 
-variable "private_subnet_cidr" {
+variable "private_subnet_cidrs" {
-  description = "CIDR block for the private subnet"
+  description = "CIDR blocks for the two private subnets across two AZs"
-  type        = string
+  type        = list(string)
-  default     = "10.0.2.0/24"
+  default     = ["10.0.2.0/24", "10.0.3.0/24"]
 }
+
 variable "db_name" {
   description = "PostgreSQL database name"
   type        = string
@@ -54,6 +55,7 @@ variable "db_password" {
   type        = string
   sensitive   = true
 }
+
 variable "db_host" {
   description = "RDS instance hostname — output from aws_db_instance.tasks.address"
   type        = string

infra/terraform/vpc.tf

@@ -29,13 +29,15 @@ resource "aws_subnet" "public" {
   }
 }
 
+# Two private subnets across two AZs — required by RDS
 resource "aws_subnet" "private" {
+  count             = 2
   vpc_id            = aws_vpc.main.id
-  cidr_block        = var.private_subnet_cidr
+  cidr_block        = var.private_subnet_cidrs[count.index]
-  availability_zone = "${var.aws_region}a"
+  availability_zone = "${var.aws_region}${count.index == 0 ? "a" : "b"}"
 
   tags = {
-    Name        = "${var.project_name}-private-subnet"
+    Name        = "${var.project_name}-private-subnet-${count.index + 1}"
     Project     = var.project_name
     Environment = var.environment
   }
@@ -75,4 +77,4 @@ resource "aws_route_table" "public" {
 resource "aws_route_table_association" "public" {
   subnet_id      = aws_subnet.public.id
   route_table_id = aws_route_table.public.id
-}
+}