Using aws docdb with account

Question

Pulumi · Accepted Answer

To work with AWS DocumentDB using Pulumi, you'll need to create the necessary resources to support a DocumentDB cluster. This typically involves:

1. Creating a VPC (if you don't have one already) to provide a secure and isolated network environment for your AWS resources.
2. Setting up subnet groups within the VPC to specify where your database instances can live. These subnets should be in different Availability Zones (AZs) for high availability.
3. Providing an AWS Identity and Access Management (IAM) role if you need to assign specific permissions to your DocumentDB resources for example, for backup or maintenance.
4. Defining security groups to control the inbound and outbound traffic for your DocumentDB instances for security.
5. Creating the actual DocumentDB cluster and instances within that cluster.

In the following Pulumi program, we'll set up an AWS DocumentDB cluster, assuming you have an existing VPC and subnets. If you're new to AWS or don't have these resources already, you'll need to create them either through the AWS Console or Pulumi as well.

In our example, we'll create:
- An AWS DocumentDB Cluster
- An AWS DocumentDB Cluster instance

Remember to set your AWS region with `pulumi config set aws:region YOUR_AWS_REGION`.

```typescript
import * as aws from "@pulumi/aws";

// Create a DocumentDB Cluster
const docdbCluster = new aws.docdb.Cluster("my-docdb-cluster", {
    availabilityZones: ["us-west-2a", "us-west-2b", "us-west-2c"], // Example AZs; modify based on your region
    clusterIdentifier: "my-docdb-cluster",
    engine: "docdb",
    masterUsername: "mongo_admin",
    masterPassword: "mysecurepassword", // In practice use secret management like Pulumi secrets
    skipFinalSnapshot: true, // Should be false in production to ensure backups are created before deletion
    dbSubnetGroupName: "my-docdb-subnet-group", // Replace with your subnet group name
    vpcSecurityGroupIds: ["sg-xxxxxxxxxxxx"], // Replace with your security group ID
});

// Create a DocumentDB Cluster Instance
const docdbClusterInstance = new aws.docdb.ClusterInstance("my-docdb-cluster-instance", {
    clusterIdentifier: docdbCluster.id,
    instanceClass: "db.r5.large", // Modify based on your required instance size
    engine: "docdb",
});

// Export the cluster endpoint to access your database
export const docdbClusterEndpoint = docdbCluster.endpoint;
```

### Explanation
- We import the AWS package from Pulumi.
- We create a `Cluster` resource for DocumentDB. You'll need to modify the parameters to match your AWS setup, such as the availability zones, master username, and password.
- Then, we create a `ClusterInstance` resource. This is where your DocumentDB will operate. The `clusterIdentifier` links it to the previously defined cluster, and `instanceClass` determines the compute and memory capacity of the instance.
- Lastly, we export the `docdbCluster.endpoint`. This value is the connection endpoint for your cluster which your application will use to connect to your DocumentDB instance.

Please ensure that you manage your secrets securely (e.g., `masterPassword`) using the Pulumi secrets manager or another secrets management system. Avoid hard-coding sensitive data in your Pulumi programs.

Before running the program, you will need to install the Pulumi AWS package if you haven't already:

```bash
npm install @pulumi/aws
```

And then, run the Pulumi program to provision your AWS resources:

```bash
pulumi up
```

This will show you a preview of the resources Pulumi will create. After reviewing the changes, you can confirm the deployment, and your AWS DocumentDB resources will be provisioned.