resource "google_sql_database_instance" "main" {
  name             = "my-db-name"
  database_version = "POSTGRES_17"
  region           = "region"
  project          = "my-project-id"

  settings {
    tier              = "db-custom-2-8192"
    availability_type = "REGIONAL"

    ip_configuration {
      # SAP Hardening 8.3-4
      ipv4_enabled = false
      # SAP Hardening 8.3-12
      ssl_mode     = "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"
      # SAP Hardening 8.3-2
      private_network = "projects/${var.network_project}/global/networks/vpc"
      # 100.64/10 is not implicity enabled in Cloud SQL
      authorized_networks {
        name = "gap-primary-pod-range"
        value = "100.65.0.0/16"
      }
      # authorized_networks {
      #   name = "gap-secondary-pod-range"
      #   value = "100.73.0.0/16"
      # }
    }

    # https://docs.cloud.google.com/sql/docs/postgres/iam-authentication#instance-config-iam-auth
    database_flags {
      name  = "cloudsql.iam_authentication"
      value = "on"
    }
    # https://docs.cloud.google.com/sql/docs/postgres/pg-audit#setting-up-database-auditing
    database_flags {
      name  = "cloudsql.enable_pgaudit"
      value = "on"
    }
    database_flags {
      name  = "pgaudit.log"
      value = "all"
    }
    # (...)
  }
  # lifecycle {
  #   prevent_destroy = true
  # }
}

    ip_configuration {
      ipv4_enabled    = false
      private_network = var.private_network
      ssl_mode        = "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"

      dynamic "authorized_networks" {
        for_each = var.has_allowed_networks ? [1] : []
        content {
          name  = "gap-primary-pod-range"
          value = "100.65.0.0/16"
        }
      }
    }

resource "google_service_account" "cloudsql_user" {
  account_id   = "my-app"
  display_name = "Cloud SQL user for my-app"
  project      = "my-gcp-project"
}

resource "google_service_account_iam_member" "workload_identity_binding" {
  service_account_id = google_service_account.cloudsql_user.name
  role               = "roles/iam.workloadIdentityUser"
  member             = "serviceAccount:<cluster-project-id>.svc.id.goog[my-namespace/my-app]"
}

resource "google_project_iam_member" "cloudsql_client" {
  project = "my-gcp-project"
  role    = "roles/cloudsql.client"
  member  = "serviceAccount:${google_service_account.cloudsql_user.email}"
}

resource "google_project_iam_member" "cloudsql_instance_user" {
  project = "my-gcp-project"
  role    = "roles/cloudsql.instanceUser"
  member  = "serviceAccount:${google_service_account.cloudsql_user.email}"
}

resource "google_sql_user" "iam_user" {
  name     = replace(google_service_account.cloudsql_user.email, ".gserviceaccount.com", "")
  instance = google_sql_database_instance.main.name
  type     = "CLOUD_IAM_SERVICE_ACCOUNT"
  project  = "my-gcp-project"
  database_roles = ["cloudsqlsuperuser"]
}

# https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/sql_database_instance#disk_size-1
resource "google_sql_database_instance" "main" {
  # (...)
  settings {
    tier = "db-custom-4-16384"  # 4 vCPUs, 16GB RAM

    disk_size       = 100  # GB
    disk_autoresize = true
  }
  # (...)
}

# https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/sql_database_instance#enabled-2
# https://wiki.one.int.sap/wiki/spaces/itsec/pages/1916766708/Google+Cloud+Platform+-+Security+Hardening#GoogleCloudPlatformSecurityHardening-8.8SecureConfigurationofBackupServices
resource "google_sql_database_instance" "main" {
  settings {
    backup_configuration {
      enabled                        = true
      point_in_time_recovery_enabled = true
      start_time                     = "08:00"
      
      backup_retention_settings {
        retained_backups = 7
        retention_unit   = "COUNT"
      }
    }
  }
}

-- Connect as old user
GRANT {OLD_USER} TO "{IAM_USER}@{PROJECT}.iam";

-- Connect as IAM user
REASSIGN OWNED BY {OLD_USER} TO "{IAM_USER}@{PROJECT}.iam";

status: {
  code: 13
}