Terraform, RDS (Postgres) and Production - postgresql

Question

How does one use Terraform to deploy a Postgres database to RDS in Production?
I am currently running Terraform run locally, deploying my RDS instance to an AWS environment. However, in-order to create the Postgres resources (using the provider from cyrilgdn), I have to make my RDS instance publicly available. This is frowned upon in PROD environments, for obvious reasons. So how do people get around this for PROD Terraform deployed environments? I'm thinking the only way would be to run Terraform from within the RDS private subnet of the VPC... but how is that even possible?? Or am I missing something important :S
provider "aws" {
access_key = var.aws_access_key
secret_key = var.aws_secret_key
region = var.aws_region
default_tags {
tags = {
Owner = var.owner
Environment = var.env
}
}
}
resource "aws_security_group" "db-rules" {
name = "rds-sec-grp"
vpc_id = var.rds_vpc_id
tags = {
Name = "rds-sec-grp"
}
ingress {
from_port = "5432"
to_port = "5432"
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}
resource "aws_db_instance" "default" {
identifier = "db-instance"
allocated_storage = 10
engine = "postgres"
engine_version = "13.2"
port = 5432
instance_class = "db.t3.medium"
multi_az = false
name = "db_system_${var.env}"
username = var.db_master_username
password = var.db_master_password
publicly_accessible = true
skip_final_snapshot = true
db_subnet_group_name = var.rds_public_subnet_group
vpc_security_group_ids = [aws_security_group.db-rules.id]
tags = {
Name = "db-instance"
}
}
provider "postgresql" {
host = aws_db_instance.default.address
port = aws_db_instance.default.port
database = aws_db_instance.default.name
username = var.db_master_username
password = var.db_master_password
superuser = false
sslmode = "require"
connect_timeout = 15
expected_version = aws_db_instance.default.engine_version
}
resource "postgresql_database" "default" {
name = "db_${var.env}"
owner = var.db_master_username
}
resource "postgresql_role" "readonly" {
name = var.db_readonly_username
password = var.db_readonly_password
login = true
connection_limit = 5
}
resource "postgresql_role" "readwrite" {
name = var.db_readwrite_username
password = var.db_readwrite_password
login = true
connection_limit = 5
}
resource "postgresql_role" "migrator" {
name = var.db_migrator_username
password = var.db_migrator_password
login = true
connection_limit = 5
}
resource "postgresql_schema" "ps" {
name = "ps"
database = postgresql_database.default.name
owner = var.db_master_username
}
resource "postgresql_grant" "revoke_public_schema" {
database = postgresql_database.default.name
role = "public"
schema = "public"
object_type = "schema"
privileges = []
}
resource "postgresql_grant" "readonly_schema" {
database = postgresql_database.default.name
role = postgresql_role.readonly.name
schema = postgresql_schema.ps.name
object_type = "schema"
privileges = ["USAGE"]
depends_on = [
postgresql_grant.revoke_public_schema
]
}
resource "postgresql_grant" "readwrite_schema" {
database = postgresql_database.default.name
role = postgresql_role.readwrite.name
schema = postgresql_schema.ps.name
object_type = "schema"
privileges = ["USAGE"]
depends_on = [
postgresql_grant.readonly_schema
]
}
resource "postgresql_grant" "migrator_schema" {
database = postgresql_database.default.name
role = postgresql_role.migrator.name
schema = postgresql_schema.ps.name
object_type = "schema"
privileges = ["CREATE", "USAGE"]
depends_on = [
postgresql_grant.readwrite_schema
]
}
resource "postgresql_grant" "readonly" {
database = postgresql_database.default.name
role = postgresql_role.readonly.name
schema = postgresql_schema.ps.name
object_type = "table"
privileges = ["SELECT"]
depends_on = [
postgresql_grant.migrator_schema
]
}
resource "postgresql_grant" "readwrite" {
database = postgresql_database.default.name
role = postgresql_role.readwrite.name
schema = postgresql_schema.ps.name
object_type = "table"
privileges = ["SELECT", "INSERT", "UPDATE", "DELETE"]
depends_on = [
postgresql_grant.migrator_schema
]
}
resource "postgresql_grant" "migrator" {
database = postgresql_database.default.name
role = postgresql_role.migrator.name
schema = postgresql_schema.ps.name
object_type = "table"
privileges = ["INSERT"]
depends_on = [
postgresql_grant.migrator_schema
]
}
resource "aws_ecr_repository" "webapi" {
name = "webapi"
image_scanning_configuration {
scan_on_push = true
}
}
resource "aws_ecr_repository" "service" {
name = "pollingservice"
image_scanning_configuration {
scan_on_push = true
}
}
resource "aws_ecr_repository" "migration" {
name = "datamigrations"
image_scanning_configuration {
scan_on_push = true
}
}