awsblog-building-resilient-applications/multi-region/1-infra-stackset/stack-db.yml [106:193]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      KmsKeyId: !Ref DBKMSKey
      MasterUsername: !If [PrimaryRegion, !Sub '{{resolve:secretsmanager:${DBSecret}:SecretString:username}}', !Ref AWS::NoValue]
      MasterUserPassword: !If [PrimaryRegion, !Sub '{{resolve:secretsmanager:${DBSecret}:SecretString:password}}', !Ref AWS::NoValue]
      StorageEncrypted: true
      SourceRegion: !If [PrimaryRegion, !Ref AWS::NoValue, !Ref Region1]
      VpcSecurityGroupIds:
        - !Ref DBSG

  DBInstance1:
    Condition: CreateInstance1
    Type: AWS::RDS::DBInstance
    Description: Database Instance
    Properties:
      DBClusterIdentifier: !Ref DBCluster
      DBInstanceClass: !Ref DBInstanceClass
      DBInstanceIdentifier: !Sub ${ProjectId}-instance1-${AWS::Region}
      EnablePerformanceInsights: true
      Engine: aurora-postgresql
      PerformanceInsightsKMSKeyId: !Ref DBKMSKey
      PubliclyAccessible: false

  DBInstance2:
    Condition: CreateInstance2
    Type: AWS::RDS::DBInstance
    Description: Database Instance
    Properties:
      DBClusterIdentifier: !Ref DBCluster
      DBInstanceClass: !Ref DBInstanceClass
      DBInstanceIdentifier: !Sub ${ProjectId}-instance2-${AWS::Region}
      EnablePerformanceInsights: true
      Engine: aurora-postgresql
      PerformanceInsightsKMSKeyId: !Ref DBKMSKey
      PubliclyAccessible: false

  DBInstance3:
    Condition: CreateInstance3
    Type: AWS::RDS::DBInstance
    Description: Database Instance
    Properties:
      DBClusterIdentifier: !Ref DBCluster
      DBInstanceClass: !Ref DBInstanceClass
      DBInstanceIdentifier: !Sub ${ProjectId}-instance3-${AWS::Region}
      EnablePerformanceInsights: true
      Engine: aurora-postgresql
      PerformanceInsightsKMSKeyId: !Ref DBKMSKey
      PubliclyAccessible: false

  DBSubnetGroup:
    Type:  AWS::RDS::DBSubnetGroup
    Description: DB Subnet Group
    Properties:
      DBSubnetGroupDescription: !Sub ${ProjectId} DB Subnet Group
      SubnetIds:
        - !ImportValue stack-network-PrivateSubnet2A
        - !ImportValue stack-network-PrivateSubnet2B
        - !ImportValue stack-network-PrivateSubnet2C

  DBSG:
    Type: AWS::EC2::SecurityGroup
    Description: Security Group for Database servers
    Properties:
      GroupDescription: Security Group for Database servers
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 3306
          ToPort: 3306
          SourceSecurityGroupId: !ImportValue stack-appA-FrontEndSG
          Description: Allow inbound access from FrontEnd Security Group to database on Port 3306
        - IpProtocol: tcp
          FromPort: 3306
          ToPort: 3306
          SourceSecurityGroupId: !ImportValue stack-appB-FrontEndSG
          Description: Allow inbound access from FrontEnd Security Group to database on Port 3306
        - IpProtocol: tcp
          FromPort: 3306
          ToPort: 3306
          SourceSecurityGroupId: !ImportValue stack-appC-FrontEndSG
          Description: Allow inbound access from FrontEnd Security Group to database on Port 3306
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 0
          ToPort: 65535
          CidrIp: 0.0.0.0/0
          Description: Allow outbound access from Database instances for logging etc. WARNING this access should be restricted in a production environment.
      VpcId: !ImportValue stack-network-VpcID
      Tags:
        - Key: Name
          Value: !Sub '${ProjectId}-DBSG'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



awsblog-building-resilient-applications/single-region/1-infra-stack/stack-db.yml [88:175]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      KmsKeyId: !Ref DBKMSKey
      MasterUsername: !If [PrimaryRegion, !Sub '{{resolve:secretsmanager:${DBSecret}:SecretString:username}}', !Ref AWS::NoValue]
      MasterUserPassword: !If [PrimaryRegion, !Sub '{{resolve:secretsmanager:${DBSecret}:SecretString:password}}', !Ref AWS::NoValue]
      StorageEncrypted: true
      SourceRegion: !If [PrimaryRegion, !Ref AWS::NoValue, !Ref Region1]
      VpcSecurityGroupIds:
        - !Ref DBSG

  DBInstance1:
    Condition: CreateInstance1
    Type: AWS::RDS::DBInstance
    Description: Database Instance
    Properties:
      DBClusterIdentifier: !Ref DBCluster
      DBInstanceClass: !Ref DBInstanceClass
      DBInstanceIdentifier: !Sub ${ProjectId}-instance1-${AWS::Region}
      EnablePerformanceInsights: true
      Engine: aurora-postgresql
      PerformanceInsightsKMSKeyId: !Ref DBKMSKey
      PubliclyAccessible: false

  DBInstance2:
    Condition: CreateInstance2
    Type: AWS::RDS::DBInstance
    Description: Database Instance
    Properties:
      DBClusterIdentifier: !Ref DBCluster
      DBInstanceClass: !Ref DBInstanceClass
      DBInstanceIdentifier: !Sub ${ProjectId}-instance2-${AWS::Region}
      EnablePerformanceInsights: true
      Engine: aurora-postgresql
      PerformanceInsightsKMSKeyId: !Ref DBKMSKey
      PubliclyAccessible: false

  DBInstance3:
    Condition: CreateInstance3
    Type: AWS::RDS::DBInstance
    Description: Database Instance
    Properties:
      DBClusterIdentifier: !Ref DBCluster
      DBInstanceClass: !Ref DBInstanceClass
      DBInstanceIdentifier: !Sub ${ProjectId}-instance3-${AWS::Region}
      EnablePerformanceInsights: true
      Engine: aurora-postgresql
      PerformanceInsightsKMSKeyId: !Ref DBKMSKey
      PubliclyAccessible: false

  DBSubnetGroup:
    Type:  AWS::RDS::DBSubnetGroup
    Description: DB Subnet Group
    Properties:
      DBSubnetGroupDescription: !Sub ${ProjectId} DB Subnet Group
      SubnetIds:
        - !ImportValue stack-network-PrivateSubnet2A
        - !ImportValue stack-network-PrivateSubnet2B
        - !ImportValue stack-network-PrivateSubnet2C

  DBSG:
    Type: AWS::EC2::SecurityGroup
    Description: Security Group for Database servers
    Properties:
      GroupDescription: Security Group for Database servers
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 3306
          ToPort: 3306
          SourceSecurityGroupId: !ImportValue stack-appA-FrontEndSG
          Description: Allow inbound access from FrontEnd Security Group to database on Port 3306
        - IpProtocol: tcp
          FromPort: 3306
          ToPort: 3306
          SourceSecurityGroupId: !ImportValue stack-appB-FrontEndSG
          Description: Allow inbound access from FrontEnd Security Group to database on Port 3306
        - IpProtocol: tcp
          FromPort: 3306
          ToPort: 3306
          SourceSecurityGroupId: !ImportValue stack-appC-FrontEndSG
          Description: Allow inbound access from FrontEnd Security Group to database on Port 3306
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 0
          ToPort: 65535
          CidrIp: 0.0.0.0/0
          Description: Allow outbound access from Database instances for logging etc. WARNING this access should be restricted in a production environment.
      VpcId: !ImportValue stack-network-VpcID
      Tags:
        - Key: Name
          Value: !Sub '${ProjectId}-DBSG'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



