{"id":18566994,"url":"https://github.com/cyralinc/terraform-aws-sidecar-ec2","last_synced_at":"2025-07-05T03:09:38.898Z","repository":{"id":38235290,"uuid":"367122956","full_name":"cyralinc/terraform-aws-sidecar-ec2","owner":"cyralinc","description":"Cyral Sidecar module for AWS EC2","archived":false,"fork":false,"pushed_at":"2024-11-27T02:06:06.000Z","size":445,"stargazers_count":6,"open_issues_count":1,"forks_count":4,"subscribers_count":5,"default_branch":"main","last_synced_at":"2025-04-10T19:27:48.374Z","etag":null,"topics":["aws","cyral","terraform","terraform-module"],"latest_commit_sha":null,"homepage":"https://registry.terraform.io/modules/cyralinc/sidecar-ec2/aws/latest","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cyralinc.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-05-13T17:22:26.000Z","updated_at":"2024-11-25T22:43:26.000Z","dependencies_parsed_at":"2023-02-10T12:35:14.658Z","dependency_job_id":"b5ecd6e0-1071-4db1-951d-4e80f6687826","html_url":"https://github.com/cyralinc/terraform-aws-sidecar-ec2","commit_stats":null,"previous_names":[],"tags_count":75,"template":false,"template_full_name":null,"purl":"pkg:github/cyralinc/terraform-aws-sidecar-ec2","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cyralinc%2Fterraform-aws-sidecar-ec2","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cyralinc%2Fterraform-aws-sidecar-ec2/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cyralinc%2Fterraform-aws-sidecar-ec2/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cyralinc%2Fterraform-aws-sidecar-ec2/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cyralinc","download_url":"https://codeload.github.com/cyralinc/terraform-aws-sidecar-ec2/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cyralinc%2Fterraform-aws-sidecar-ec2/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":263674487,"owners_count":23494583,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","cyral","terraform","terraform-module"],"created_at":"2024-11-06T22:25:01.410Z","updated_at":"2025-07-05T03:09:38.880Z","avatar_url":"https://github.com/cyralinc.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Cyral sidecar module for AWS EC2\n\nUse this Terraform module to deploy a sidecar on AWS EC2 instances.\n\nRefer to the [quickstart guide](https://github.com/cyral-quickstart/quickstart-sidecar-terraform-aws-ec2#readme)\nfor more information on how to use this module or upgrade your sidecar.\n\n## Architecture\n\n![Deployment architecture](https://raw.githubusercontent.com/cyralinc/terraform-aws-sidecar-ec2/main/images/aws_architecture.png)\n\nThe elements shown in the architecture diagram above are deployed by this module.\nThe module requires existing VPC and subnets in order to create the necessary\ncomponents for the sidecar to run. In a high-level, these are the resources deployed:\n\n* EC2\n    * Auto scaling group (responsible for managing EC2 instances and EBS volumes)\n    * Network load balancer (optional)\n    * Security group\n* Secrets Manager\n    * Sidecar credentials\n    * Sidecar CA certificate\n    * Sidecar self-signed certificate\n* IAM\n    * Sidecar role\n* Cloudwatch\n    * Log group (optional)\n\n## Usage\n\n```hcl\nprovider \"aws\" {\n  # Define the target AWS region\n  region = \"us-east-1\"\n}\n\nmodule \"cyral_sidecar\" {\n  source  = \"cyralinc/sidecar-ec2/aws\"  \n  version = \"~\u003e 5.0\" # terraform module version\n\n  sidecar_id      = \"\"\n  control_plane   = \"\"\n  client_id          = \"\"\n  client_secret      = \"\"\n  \n  # Leave empty if you prefer to perform upgrades directly\n  # from the control plane.\n  sidecar_version = \"\"\n\n  # Considering MongoDB ports are from the range 27017 to 27019\n  sidecar_ports = [443, 3306, 5432, 27017, 27018, 27019]\n\n  vpc_id  = \"\"\n  subnets = [\"\"]\n\n  # Inbound CIDR to SSH into the EC2 instances\n  ssh_inbound_cidr        = [\"0.0.0.0/0\"]\n  # Inbound CIDR to access ports defined in `sidecar_ports`\n  db_inbound_cidr         = [\"0.0.0.0/0\"]\n  # Inbound CIDR to monitor the EC2 instances (port 9000)\n  monitoring_inbound_cidr = [\"0.0.0.0/0\"]\n}\n```\n**Note:**\n\n- `name_prefix` is defined automatically. If you wish to define a custom\n  `name_prefix`, please keep in mind that its length must be **at most 24\n  characters**.\n\n## Upgrade\n\n### Module upgrade\n\nIf you are coming from `v4` of this module, read the\n[upgrade notes](https://github.com/cyralinc/terraform-aws-sidecar-ec2/blob/main/docs/upgrade-notes.md) for specific\ninstructions on how to upgrade this module.\n\n### Sidecar upgrade\n\nThis module supports [1-click upgrade](https://cyral.com/docs/sidecars/manage/upgrade#1-click-upgrade).\n\nTo enable the 1-click upgrade feature, leave the variable `sidecar_version` empty and upgrade\nthe sidecar from Cyral control plane.\n\nIf you prefer to block upgrades from the Cyral control plane and use a **static version**, assign\nthe desired sidecar version to `sidecar_version`. To upgrade your sidecar, update this parameter\nwith the target version and run `terraform apply`.\n\nLearn more in the [sidecar upgrade procedures](https://cyral.com/docs/sidecars/manage/upgrade) page.\n\n## Advanced\n\nInstructions for advanced deployment configurations are available for the following topics:\n\n* [Advanced networking configuration](https://github.com/cyralinc/terraform-aws-sidecar-ec2/blob/main/docs/networking.md)\n* [Bring your own secret](https://github.com/cyralinc/terraform-aws-sidecar-ec2/blob/main/docs/byos.md)\n* [Customer initialization scripts](https://github.com/cyralinc/terraform-aws-sidecar-ec2/blob/main/docs/custom-user-data.md)\n* [Enable the S3 File Browser](https://github.com/cyralinc/terraform-aws-sidecar-ec2/blob/main/docs/s3-browser.md)\n* [Memory limits](https://github.com/cyralinc/terraform-aws-sidecar-ec2/blob/main/docs/memlim.md)\n* [Sidecar certificates](https://github.com/cyralinc/terraform-aws-sidecar-ec2/blob/main/docs/certificates.md)\n* [Sidecar instance metrics](https://github.com/cyralinc/terraform-aws-sidecar-ec2/blob/main/docs/metrics.md)\n\n\u003c!-- BEGIN_TF_DOCS --\u003e\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | \u003e= 1.9 |\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement\\_aws) | \u003e= 3.73.0, \u003c 6.0.0 |\n| \u003ca name=\"requirement_tls\"\u003e\u003c/a\u003e [tls](#requirement\\_tls) | ~\u003e 4.0.0 |\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_aws\"\u003e\u003c/a\u003e [aws](#provider\\_aws) | \u003e= 3.73.0, \u003c 6.0.0 |\n| \u003ca name=\"provider_tls\"\u003e\u003c/a\u003e [tls](#provider\\_tls) | ~\u003e 4.0.0 |\n\n## Modules\n\nNo modules.\n\n## Resources\n\n| Name | Type |\n|------|------|\n| [aws_autoscaling_group.asg](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/autoscaling_group) | resource |\n| [aws_cloudwatch_log_group.lg](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |\n| [aws_iam_instance_profile.sidecar_profile](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_instance_profile) | resource |\n| [aws_iam_policy.init_script_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |\n| [aws_iam_role.sidecar_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |\n| [aws_iam_role_policy_attachment.init_script_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_iam_role_policy_attachment.user_policies](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_launch_template.lt](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_template) | resource |\n| [aws_lb.lb](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb) | resource |\n| [aws_lb_listener.ls](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_listener) | resource |\n| [aws_lb_target_group.tg](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_target_group) | resource |\n| [aws_route53_record.cyral-sidecar-dns-record](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_record) | resource |\n| [aws_secretsmanager_secret.self_signed_ca](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret) | resource |\n| [aws_secretsmanager_secret.self_signed_tls_cert](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret) | resource |\n| [aws_secretsmanager_secret.sidecar_secrets](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret) | resource |\n| [aws_secretsmanager_secret_version.self_signed_ca](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_version) | resource |\n| [aws_secretsmanager_secret_version.self_signed_tls_cert](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_version) | resource |\n| [aws_secretsmanager_secret_version.sidecar_secrets](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_version) | resource |\n| [aws_security_group.instance](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |\n| [tls_private_key.ca](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/private_key) | resource |\n| [tls_private_key.tls](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/private_key) | resource |\n| [tls_self_signed_cert.ca](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/self_signed_cert) | resource |\n| [tls_self_signed_cert.tls](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/self_signed_cert) | resource |\n| [aws_ami.amazon_linux](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ami) | data source |\n| [aws_arn.cw_lg](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) | data source |\n| [aws_availability_zones.all](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |\n| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |\n| [aws_iam_policy_document.init_script_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |\n| [aws_iam_policy_document.kms](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |\n| [aws_iam_policy_document.sidecar](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |\n| [aws_lbs.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/lbs) | data source |\n| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |\n| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_additional_security_groups\"\u003e\u003c/a\u003e [additional\\_security\\_groups](#input\\_additional\\_security\\_groups) | List of the IDs of the additional security groups that will be attached to the sidecar instances. If providing\u003cbr/\u003e`additional_target_groups`, use this parameter to provide security groups with the inbound rules to allow\u003cbr/\u003einbound traffic from the target groups to the instances. | `list(string)` | `[]` | no |\n| \u003ca name=\"input_additional_target_groups\"\u003e\u003c/a\u003e [additional\\_target\\_groups](#input\\_additional\\_target\\_groups) | List of the ARNs of the additional target groups that will be attached to the sidecar instances. Use it in\u003cbr/\u003econjunction with `additional_security_groups` to provide the inbound rules for the ports associated with \u003cbr/\u003ethem, otherwise the incoming traffic from the target groups will not be allowed to access the EC2 instances. | `list(string)` | `[]` | no |\n| \u003ca name=\"input_ami_id\"\u003e\u003c/a\u003e [ami\\_id](#input\\_ami\\_id) | AMI ID that will be used for the EC2 instances. If not provided,\u003cbr/\u003ewill use the latest Amazon Linux 2 AMI available. | `string` | `\"\"` | no |\n| \u003ca name=\"input_asg_desired\"\u003e\u003c/a\u003e [asg\\_desired](#input\\_asg\\_desired) | The desired number of hosts to create in the auto scaling group | `number` | `1` | no |\n| \u003ca name=\"input_asg_max\"\u003e\u003c/a\u003e [asg\\_max](#input\\_asg\\_max) | The maximum number of hosts to create in the auto scaling group | `number` | `3` | no |\n| \u003ca name=\"input_asg_min\"\u003e\u003c/a\u003e [asg\\_min](#input\\_asg\\_min) | The minimum number of hosts to create in the auto scaling group | `number` | `1` | no |\n| \u003ca name=\"input_asg_min_healthy_percentage\"\u003e\u003c/a\u003e [asg\\_min\\_healthy\\_percentage](#input\\_asg\\_min\\_healthy\\_percentage) | The minimum percentage of healthy instances during an ASG refresh | `number` | `100` | no |\n| \u003ca name=\"input_associate_public_ip_address\"\u003e\u003c/a\u003e [associate\\_public\\_ip\\_address](#input\\_associate\\_public\\_ip\\_address) | Associates a public IP to sidecar EC2 instances | `bool` | `false` | no |\n| \u003ca name=\"input_ca_certificate_role_arn\"\u003e\u003c/a\u003e [ca\\_certificate\\_role\\_arn](#input\\_ca\\_certificate\\_role\\_arn) | (Optional) ARN of an AWS IAM Role to assume when reading the CA certificate. | `string` | `\"\"` | no |\n| \u003ca name=\"input_ca_certificate_secret_arn\"\u003e\u003c/a\u003e [ca\\_certificate\\_secret\\_arn](#input\\_ca\\_certificate\\_secret\\_arn) | (Optional) ARN of secret in AWS Secrets Manager that contains a CA certificate to sign sidecar-generated certs. | `string` | `\"\"` | no |\n| \u003ca name=\"input_client_id\"\u003e\u003c/a\u003e [client\\_id](#input\\_client\\_id) | (Optional) The client id assigned to the sidecar. If not provided, must provide a secret containing the respective client id using `secret_arn`. | `string` | `\"\"` | no |\n| \u003ca name=\"input_client_secret\"\u003e\u003c/a\u003e [client\\_secret](#input\\_client\\_secret) | (Optional) The client secret assigned to the sidecar. If not provided, must provide a secret containing the respective client secret using `secret_arn`. | `string` | `\"\"` | no |\n| \u003ca name=\"input_cloudwatch_log_group_name\"\u003e\u003c/a\u003e [cloudwatch\\_log\\_group\\_name](#input\\_cloudwatch\\_log\\_group\\_name) | (Optional) Cloudwatch log group name. | `string` | `\"\"` | no |\n| \u003ca name=\"input_cloudwatch_logs_retention\"\u003e\u003c/a\u003e [cloudwatch\\_logs\\_retention](#input\\_cloudwatch\\_logs\\_retention) | Cloudwatch logs retention in days | `number` | `14` | no |\n| \u003ca name=\"input_container_registry\"\u003e\u003c/a\u003e [container\\_registry](#input\\_container\\_registry) | Address of the container registry where Cyral images are stored. | `string` | `\"public.ecr.aws/cyral\"` | no |\n| \u003ca name=\"input_control_plane\"\u003e\u003c/a\u003e [control\\_plane](#input\\_control\\_plane) | Address of the control plane - \u003ctenant\u003e.cyral.com | `string` | n/a | yes |\n| \u003ca name=\"input_curl_connect_timeout\"\u003e\u003c/a\u003e [curl\\_connect\\_timeout](#input\\_curl\\_connect\\_timeout) | (Optional) The maximum time in seconds that curl connections are allowed to take. | `number` | `60` | no |\n| \u003ca name=\"input_custom_host_role\"\u003e\u003c/a\u003e [custom\\_host\\_role](#input\\_custom\\_host\\_role) | (Optional) Name of an AWS IAM Role to attach to the EC2 instance profile. | `string` | `\"\"` | no |\n| \u003ca name=\"input_custom_tags\"\u003e\u003c/a\u003e [custom\\_tags](#input\\_custom\\_tags) | Custom tags to be added to all AWS resources created | `map(any)` | `{}` | no |\n| \u003ca name=\"input_custom_user_data\"\u003e\u003c/a\u003e [custom\\_user\\_data](#input\\_custom\\_user\\_data) | Ancillary consumer supplied user-data script. Bash scripts must be added to a map as a value of the key `pre`, `pre_sidecar_start`, `post` denoting execution order with respect to sidecar installation. (Approx Input Size = 19KB) | `map(any)` | \u003cpre\u003e{\u003cbr/\u003e  \"post\": \"\",\u003cbr/\u003e  \"pre\": \"\",\u003cbr/\u003e  \"pre_sidecar_start\": \"\"\u003cbr/\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_db_inbound_cidr\"\u003e\u003c/a\u003e [db\\_inbound\\_cidr](#input\\_db\\_inbound\\_cidr) | Allowed CIDR blocks for database access to the sidecar. Can't be combined with 'db\\_inbound\\_security\\_group'. | `list(string)` | n/a | yes |\n| \u003ca name=\"input_db_inbound_security_group\"\u003e\u003c/a\u003e [db\\_inbound\\_security\\_group](#input\\_db\\_inbound\\_security\\_group) | Pre-existing security group IDs allowed to connect to db in the EC2 host. Can't be combined with 'db\\_inbound\\_cidr'. | `list(string)` | `[]` | no |\n| \u003ca name=\"input_deploy_load_balancer\"\u003e\u003c/a\u003e [deploy\\_load\\_balancer](#input\\_deploy\\_load\\_balancer) | Deploy or not the load balancer and target groups. This option makes the ASG have only one replica, irrelevant of the Asg Min Max and Desired | `bool` | `true` | no |\n| \u003ca name=\"input_dns_hosted_zone_id\"\u003e\u003c/a\u003e [dns\\_hosted\\_zone\\_id](#input\\_dns\\_hosted\\_zone\\_id) | (Optional) Route53 hosted zone ID for the corresponding 'dns\\_name' provided | `string` | `\"\"` | no |\n| \u003ca name=\"input_dns_name\"\u003e\u003c/a\u003e [dns\\_name](#input\\_dns\\_name) | (Optional) Fully qualified domain name that will be automatically created/updated to reference the sidecar LB | `string` | `\"\"` | no |\n| \u003ca name=\"input_dns_overwrite\"\u003e\u003c/a\u003e [dns\\_overwrite](#input\\_dns\\_overwrite) | (Optional) Update an existing DNS name informed in `dns_name`. | `bool` | `false` | no |\n| \u003ca name=\"input_ec2_ebs_kms_arn\"\u003e\u003c/a\u003e [ec2\\_ebs\\_kms\\_arn](#input\\_ec2\\_ebs\\_kms\\_arn) | ARN of the KMS key used to encrypt/decrypt EBS volumes. If unset, EBS will use the default KMS key. Make sure the KMS key allows the principal `arn:aws:iam::ACCOUNT_NUMBER:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling`, otherwise the ASG will not be able to launch the new instances. | `string` | `\"\"` | no |\n| \u003ca name=\"input_enable_cross_zone_load_balancing\"\u003e\u003c/a\u003e [enable\\_cross\\_zone\\_load\\_balancing](#input\\_enable\\_cross\\_zone\\_load\\_balancing) | Enable cross zone load balancing | `bool` | `true` | no |\n| \u003ca name=\"input_health_check_grace_period\"\u003e\u003c/a\u003e [health\\_check\\_grace\\_period](#input\\_health\\_check\\_grace\\_period) | The minimum amount of time (in seconds) to keep a new instance in service before terminating it if it's found to be unhealthy | `number` | `300` | no |\n| \u003ca name=\"input_iam_policies\"\u003e\u003c/a\u003e [iam\\_policies](#input\\_iam\\_policies) | (Optional) List of IAM policies ARNs that will be attached to the sidecar IAM role | `list(string)` | `[]` | no |\n| \u003ca name=\"input_idp_certificate\"\u003e\u003c/a\u003e [idp\\_certificate](#input\\_idp\\_certificate) | (Optional) The certificate used to verify SAML assertions from the IdP being used with Snowflake. Enter this value as a one-line string with literal new line characters (\\n) specifying the line breaks. | `string` | `\"\"` | no |\n| \u003ca name=\"input_idp_sso_login_url\"\u003e\u003c/a\u003e [idp\\_sso\\_login\\_url](#input\\_idp\\_sso\\_login\\_url) | (Optional) The IdP SSO URL for the IdP being used with Snowflake. | `string` | `\"\"` | no |\n| \u003ca name=\"input_instance_metadata_token\"\u003e\u003c/a\u003e [instance\\_metadata\\_token](#input\\_instance\\_metadata\\_token) | Instance Metadata Service token requirement | `string` | `\"required\"` | no |\n| \u003ca name=\"input_instance_type\"\u003e\u003c/a\u003e [instance\\_type](#input\\_instance\\_type) | Amazon EC2 instance type for the sidecar instances | `string` | `\"t3.medium\"` | no |\n| \u003ca name=\"input_key_name\"\u003e\u003c/a\u003e [key\\_name](#input\\_key\\_name) | AWS key name | `string` | `\"\"` | no |\n| \u003ca name=\"input_launch_template_tags_resource_types\"\u003e\u003c/a\u003e [launch\\_template\\_tags\\_resource\\_types](#input\\_launch\\_template\\_tags\\_resource\\_types) | Set of resource types to be used to add custom tags to the launch template. See also `custom_tags`. | `set(string)` | \u003cpre\u003e[\u003cbr/\u003e  \"instance\",\u003cbr/\u003e  \"volume\",\u003cbr/\u003e  \"network-interface\"\u003cbr/\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_load_balancer_certificate_arn\"\u003e\u003c/a\u003e [load\\_balancer\\_certificate\\_arn](#input\\_load\\_balancer\\_certificate\\_arn) | (Optional) ARN of SSL certificate that will be used for client connections to Snowflake. | `string` | `\"\"` | no |\n| \u003ca name=\"input_load_balancer_scheme\"\u003e\u003c/a\u003e [load\\_balancer\\_scheme](#input\\_load\\_balancer\\_scheme) | EC2 network load balancer scheme (`internal` or `internet-facing`)\u003cbr/\u003eParameter has no effect in case `deploy_load_balancer = false`. | `string` | `\"internal\"` | no |\n| \u003ca name=\"input_load_balancer_security_groups\"\u003e\u003c/a\u003e [load\\_balancer\\_security\\_groups](#input\\_load\\_balancer\\_security\\_groups) | List of the IDs of the additional security groups that will be attached to the load balancer.\u003cbr/\u003eParameter has no effect in case `deploy_load_balancer = false`. | `list(string)` | `[]` | no |\n| \u003ca name=\"input_load_balancer_sticky_ports\"\u003e\u003c/a\u003e [load\\_balancer\\_sticky\\_ports](#input\\_load\\_balancer\\_sticky\\_ports) | List of ports that will have session stickiness enabled.\u003cbr/\u003eThis parameter must be a subset of 'sidecar\\_ports'. | `list(number)` | `[]` | no |\n| \u003ca name=\"input_load_balancer_subnets\"\u003e\u003c/a\u003e [load\\_balancer\\_subnets](#input\\_load\\_balancer\\_subnets) | Subnets to add load balancer to. If not provided, the load balancer will assume the subnets\u003cbr/\u003especified in the `subnets` parameter.\u003cbr/\u003eParameter has no effect in case `deploy_load_balancer = false`. | `list(string)` | `[]` | no |\n| \u003ca name=\"input_load_balancer_tls_ports\"\u003e\u003c/a\u003e [load\\_balancer\\_tls\\_ports](#input\\_load\\_balancer\\_tls\\_ports) | List of ports that will have TLS terminated at load balancer level\u003cbr/\u003e(snowflake support, for example). If assigned, 'load\\_balancer\\_certificate\\_arn' \u003cbr/\u003emust also be provided. This parameter must be a subset of 'sidecar\\_ports'. | `list(number)` | `[]` | no |\n| \u003ca name=\"input_monitoring_inbound_cidr\"\u003e\u003c/a\u003e [monitoring\\_inbound\\_cidr](#input\\_monitoring\\_inbound\\_cidr) | Allowed CIDR blocks for health check and metric requests to the sidecar. If restricting the access, consider setting to the VPC CIDR or an equivalent to cover the assigned subnets as the load balancer performs health checks on the EC2 instances. | `list(string)` | n/a | yes |\n| \u003ca name=\"input_name_prefix\"\u003e\u003c/a\u003e [name\\_prefix](#input\\_name\\_prefix) | Prefix for names of created resources in AWS. Maximum length is 24 characters. | `string` | `\"\"` | no |\n| \u003ca name=\"input_recycle_health_check_interval_sec\"\u003e\u003c/a\u003e [recycle\\_health\\_check\\_interval\\_sec](#input\\_recycle\\_health\\_check\\_interval\\_sec) | (Optional) The interval (in seconds) in which the sidecar instance checks whether it has been marked or recycling. | `number` | `30` | no |\n| \u003ca name=\"input_reduce_security_group_rules_count\"\u003e\u003c/a\u003e [reduce\\_security\\_group\\_rules\\_count](#input\\_reduce\\_security\\_group\\_rules\\_count) | If set to `false`, each port in `sidecar_ports` will be used individually for each CIDR in `db_inbound_cidr` to create inbound rules in the sidecar security group, resulting in a number of inbound rules that is equal to the number of `sidecar_ports` * `db_inbound_cidr`. If set to `true`, the entire sidecar port range from `min(sidecar_ports)` to `max(sidecar_ports)` will be used to configure each inbound rule for each CIDR in `db_inbound_cidr` for the sidecar security group. Setting it to `true` can be useful if you need to use multiple sequential sidecar ports and different CIDRs for DB inbound (`db_inbound_cidr`) since it will significantly reduce the number of inbound rules and avoid hitting AWS quotas. As a side effect, it will open all the ports between `min(sidecar_ports)` and `max(sidecar_ports)` in the security group created by this module. | `bool` | `false` | no |\n| \u003ca name=\"input_repositories_supported\"\u003e\u003c/a\u003e [repositories\\_supported](#input\\_repositories\\_supported) | List of all repositories that will be supported by the sidecar (lower case only) | `list(string)` | \u003cpre\u003e[\u003cbr/\u003e  \"denodo\",\u003cbr/\u003e  \"dremio\",\u003cbr/\u003e  \"dynamodb\",\u003cbr/\u003e  \"mongodb\",\u003cbr/\u003e  \"mysql\",\u003cbr/\u003e  \"oracle\",\u003cbr/\u003e  \"postgresql\",\u003cbr/\u003e  \"redshift\",\u003cbr/\u003e  \"snowflake\",\u003cbr/\u003e  \"sqlserver\",\u003cbr/\u003e  \"s3\"\u003cbr/\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_secret_arn\"\u003e\u003c/a\u003e [secret\\_arn](#input\\_secret\\_arn) | Full ARN of the AWS Secrets Manager secret used to store the sidecar secrets. If unset, sidecar will manage its own secret. See the topic `Bring Your Own Secret` in the `Advanced` documentation section. | `string` | `\"\"` | no |\n| \u003ca name=\"input_secret_role_arn\"\u003e\u003c/a\u003e [secret\\_role\\_arn](#input\\_secret\\_role\\_arn) | (Optional) ARN of an AWS IAM Role to assume when reading the secret informed in `secret_arn`. | `string` | `\"\"` | no |\n| \u003ca name=\"input_secrets_kms_arn\"\u003e\u003c/a\u003e [secrets\\_kms\\_arn](#input\\_secrets\\_kms\\_arn) | ARN of the KMS key used to encrypt/decrypt secrets. If unset, secrets will use the default KMS key. | `string` | `\"\"` | no |\n| \u003ca name=\"input_sidecar_id\"\u003e\u003c/a\u003e [sidecar\\_id](#input\\_sidecar\\_id) | Sidecar identifier | `string` | n/a | yes |\n| \u003ca name=\"input_sidecar_ports\"\u003e\u003c/a\u003e [sidecar\\_ports](#input\\_sidecar\\_ports) | List of ports allowed to connect to the sidecar through the load balancer and security group. The maximum number of ports is limited to Network Load Balancers quotas (listeners and target groups). See also 'load\\_balancer\\_tls\\_ports'. Avoid port `9000` as it is reserved for instance monitoring. | `list(number)` | n/a | yes |\n| \u003ca name=\"input_sidecar_private_idp_key\"\u003e\u003c/a\u003e [sidecar\\_private\\_idp\\_key](#input\\_sidecar\\_private\\_idp\\_key) | (Optional) The private key used to sign SAML Assertions generated by the sidecar. Enter this value as a one-line string with literal new line characters (\u003cbr/\u003e) specifying the line breaks. | `string` | `\"\"` | no |\n| \u003ca name=\"input_sidecar_public_idp_certificate\"\u003e\u003c/a\u003e [sidecar\\_public\\_idp\\_certificate](#input\\_sidecar\\_public\\_idp\\_certificate) | (Optional) The public certificate used to verify signatures for SAML Assertions generated by the sidecar. Enter this value as a one-line string with literal new line characters (\u003cbr/\u003e) specifying the line breaks. | `string` | `\"\"` | no |\n| \u003ca name=\"input_sidecar_version\"\u003e\u003c/a\u003e [sidecar\\_version](#input\\_sidecar\\_version) | (Optional, but required for Control Planes \u003c v4.10) The version of the sidecar. If unset and the Control Plane version is \u003e= v4.10, the sidecar version will be dynamically retrieved from the Control Plane, otherwise an error will occur and this value must be provided. | `string` | `\"\"` | no |\n| \u003ca name=\"input_ssh_inbound_cidr\"\u003e\u003c/a\u003e [ssh\\_inbound\\_cidr](#input\\_ssh\\_inbound\\_cidr) | Allowed CIDR blocks for SSH access to the sidecar. Can't be combined with 'ssh\\_inbound\\_security\\_group'. | `list(string)` | n/a | yes |\n| \u003ca name=\"input_ssh_inbound_security_group\"\u003e\u003c/a\u003e [ssh\\_inbound\\_security\\_group](#input\\_ssh\\_inbound\\_security\\_group) | Pre-existing security group IDs allowed to ssh into the EC2 host. Can't be combined with 'ssh\\_inbound\\_cidr'. | `list(string)` | `[]` | no |\n| \u003ca name=\"input_subnets\"\u003e\u003c/a\u003e [subnets](#input\\_subnets) | Subnets to add sidecar to (list of string) | `list(string)` | n/a | yes |\n| \u003ca name=\"input_tls_certificate_role_arn\"\u003e\u003c/a\u003e [tls\\_certificate\\_role\\_arn](#input\\_tls\\_certificate\\_role\\_arn) | (Optional) ARN of an AWS IAM Role to assume when reading the TLS certificate. | `string` | `\"\"` | no |\n| \u003ca name=\"input_tls_certificate_secret_arn\"\u003e\u003c/a\u003e [tls\\_certificate\\_secret\\_arn](#input\\_tls\\_certificate\\_secret\\_arn) | (Optional) ARN of secret in AWS Secrets Manager that contains a certificate to terminate TLS connections. | `string` | `\"\"` | no |\n| \u003ca name=\"input_tls_skip_verify\"\u003e\u003c/a\u003e [tls\\_skip\\_verify](#input\\_tls\\_skip\\_verify) | (Optional) Skip TLS verification for HTTPS communication with the control plane and during sidecar initialization | `bool` | `false` | no |\n| \u003ca name=\"input_volume_size\"\u003e\u003c/a\u003e [volume\\_size](#input\\_volume\\_size) | Size of the sidecar disk | `number` | `15` | no |\n| \u003ca name=\"input_volume_type\"\u003e\u003c/a\u003e [volume\\_type](#input\\_volume\\_type) | Type of the sidecar disk | `string` | `\"gp3\"` | no |\n| \u003ca name=\"input_vpc_id\"\u003e\u003c/a\u003e [vpc\\_id](#input\\_vpc\\_id) | AWS VPC ID to deploy sidecar to | `string` | n/a | yes |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_ami_id\"\u003e\u003c/a\u003e [ami\\_id](#output\\_ami\\_id) | EC2 AMI id |\n| \u003ca name=\"output_autoscaling_group_arn\"\u003e\u003c/a\u003e [autoscaling\\_group\\_arn](#output\\_autoscaling\\_group\\_arn) | Auto scaling group ARN |\n| \u003ca name=\"output_ca_certificate_secret_arn\"\u003e\u003c/a\u003e [ca\\_certificate\\_secret\\_arn](#output\\_ca\\_certificate\\_secret\\_arn) | ARN of the CA certificate secret used by the sidecar |\n| \u003ca name=\"output_cloudwatch_log_group_name\"\u003e\u003c/a\u003e [cloudwatch\\_log\\_group\\_name](#output\\_cloudwatch\\_log\\_group\\_name) | Name of the CloudWatch log group where sidecar logs are stored |\n| \u003ca name=\"output_dns\"\u003e\u003c/a\u003e [dns](#output\\_dns) | Sidecar DNS endpoint |\n| \u003ca name=\"output_iam_role_arn\"\u003e\u003c/a\u003e [iam\\_role\\_arn](#output\\_iam\\_role\\_arn) | Sidecar IAM role ARN |\n| \u003ca name=\"output_launch_template_arn\"\u003e\u003c/a\u003e [launch\\_template\\_arn](#output\\_launch\\_template\\_arn) | Launch template ARN |\n| \u003ca name=\"output_load_balancer_arn\"\u003e\u003c/a\u003e [load\\_balancer\\_arn](#output\\_load\\_balancer\\_arn) | Load balancer ARN |\n| \u003ca name=\"output_load_balancer_dns\"\u003e\u003c/a\u003e [load\\_balancer\\_dns](#output\\_load\\_balancer\\_dns) | Sidecar load balancer DNS endpoint |\n| \u003ca name=\"output_secret_arn\"\u003e\u003c/a\u003e [secret\\_arn](#output\\_secret\\_arn) | ARN of the secret with the credentials used by the sidecar |\n| \u003ca name=\"output_security_group_id\"\u003e\u003c/a\u003e [security\\_group\\_id](#output\\_security\\_group\\_id) | Sidecar security group id |\n| \u003ca name=\"output_tls_certificate_secret_arn\"\u003e\u003c/a\u003e [tls\\_certificate\\_secret\\_arn](#output\\_tls\\_certificate\\_secret\\_arn) | ARN of the TLS certificate secret used by the sidecar |\n\u003c!-- END_TF_DOCS --\u003e","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcyralinc%2Fterraform-aws-sidecar-ec2","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcyralinc%2Fterraform-aws-sidecar-ec2","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcyralinc%2Fterraform-aws-sidecar-ec2/lists"}