{"id":20936904,"url":"https://github.com/datafold/terraform-aws-datafold","last_synced_at":"2026-04-01T21:28:47.521Z","repository":{"id":223913826,"uuid":"761702576","full_name":"datafold/terraform-aws-datafold","owner":"datafold","description":"A terraform module for deploying the Datafold infrastructure on AWS.","archived":false,"fork":false,"pushed_at":"2026-02-18T15:34:06.000Z","size":281,"stargazers_count":1,"open_issues_count":1,"forks_count":0,"subscribers_count":6,"default_branch":"main","last_synced_at":"2026-02-18T19:27:24.318Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/datafold.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2024-02-22T10:28:20.000Z","updated_at":"2026-02-04T16:30:45.000Z","dependencies_parsed_at":"2024-06-11T12:45:15.464Z","dependency_job_id":"5d31e3f1-e813-434d-af12-9f703193d28a","html_url":"https://github.com/datafold/terraform-aws-datafold","commit_stats":null,"previous_names":["datafold/terraform-aws-datafold"],"tags_count":62,"template":false,"template_full_name":null,"purl":"pkg:github/datafold/terraform-aws-datafold","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/datafold%2Fterraform-aws-datafold","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/datafold%2Fterraform-aws-datafold/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/datafold%2Fterraform-aws-datafold/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/datafold%2Fterraform-aws-datafold/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/datafold","download_url":"https://codeload.github.com/datafold/terraform-aws-datafold/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/datafold%2Fterraform-aws-datafold/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29599338,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-18T22:25:43.180Z","status":"ssl_error","status_checked_at":"2026-02-18T22:25:42.766Z","response_time":162,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-18T22:29:36.788Z","updated_at":"2026-02-19T00:04:15.133Z","avatar_url":"https://github.com/datafold.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"=======\n# Datafold AWS module\n\nThis repository provisions infrastructure resources on AWS for deploying Datafold using the datafold-operator.\n\n## About this module\n\n**⚠️ Important**: This module is now **optional**. If you already have EKS infrastructure in place, you can configure the required resources independently. This module is primarily intended for customers who need to set up the complete infrastructure stack for EKS deployment.\n\nThe module provisions AWS infrastructure resources that are required for Datafold deployment. Application configuration is now managed through the `datafoldapplication` custom resource on the cluster using the datafold-operator, rather than through Terraform application directories.\n\n## Breaking Changes\n\n### Load Balancer Deployment (Default Changed)\n\n**Breaking Change**: The load balancer is **no longer deployed by default**. The default behavior has been toggled to `deploy_lb = false`.\n\n- **Previous behavior**: Load balancer was deployed by default\n- **New behavior**: Load balancer deployment is disabled by default\n- **Action required**: If you need a load balancer, you must explicitly set `deploy_lb = true` in your configuration, so that you don't lose it. (in the case it does happen, you need to redeploy it and then update your DNS to the new LB CNAME).\n\n### Application Directory Removal\n\n- The \"application\" directory is no longer part of this repository\n- Application configuration is now managed through the `datafoldapplication` custom resource on the cluster\n\n## Prerequisites\n\n* An AWS account, preferably a new isolated one.\n* Terraform \u003e= 1.4.6\n* A customer contract with Datafold\n  * The application does not work without credentials supplied by sales\n* Access to our public helm-charts repository\n\nThe full deployment will create the following resources:\n\n* AWS VPC\n* AWS subnets\n* AWS S3 bucket for clickhouse backups\n* AWS Application Load Balancer (optional, disabled by default)\n* AWS ACM certificate (if load balancer is enabled)\n* Three EBS volumes for local data storage\n* AWS RDS Postgres database\n* An EKS cluster\n* Service accounts for the EKS cluster to perform actions outside of its cluster boundary:\n  * Provisioning existing EBS volumes\n  * Updating load balancer target group to point to specific pods in the cluster\n  * Rescaling the nodegroup between 1-2 nodes\n\n**Infrastructure Dependencies**: For a complete list of required infrastructure resources and detailed deployment guidance, see the [Datafold Dedicated Cloud AWS Deployment Documentation](https://docs.datafold.com/datafold-deployment/dedicated-cloud/aws).\n\n## Negative scope\n\n* This module will not provision DNS names in your zone.\n\n## How to use this module\n\n* See the example for a potential setup, which has dependencies on our helm-charts\n\nCreate the bucket and dynamodb table for terraform state file:\n\n* Use the files in `bootstrap` to create a terraform state bucket and a dynamodb lock table.\n* Run `./run_bootstrap.sh` to create them. Enter the deployment_name when the question is asked.\n  * The `deployment_name` is important. This is used for the k8s namespace and datadog unified logging tags and other places.\n  * Suggestion: `company-datafold`\n* Transfer the name of that bucket and table into the `backend.hcl`\n* Set the `target_account_profile` and `region` where the bucket / table are stored.\n* `backend.hcl` is only about where the terraform state file is located.\n\nThe example directory contains a single deployment example for infrastructure setup.\n\nSetting up the infrastructure:\n\n* It is easiest if you have full admin access in the target project.\n* Pre-create a symmetric encryption key that is used to encrypt/decrypt secrets of this deployment.\n  * Use the alias instead of the `mrk` link. Put that into `locals.tf`\n* **Certificate Requirements** (depends on load balancer deployment method):\n  * **If deploying load balancer from this Terraform module** (`deploy_lb = true`): Pre-create and validate the ACM certificate in your DNS, then refer to that certificate in main.tf using its domain name (Replace \"datafold.acme.com\")\n  * **If deploying load balancer from within Kubernetes**: The certificate will be created automatically, but you must wait for it to become available and then validate it in your DNS after the deployment is complete\n* Change the settings in locals.tf\n  * provider_region = which region you want to deploy in.\n  * aws_profile = The profile you want to use to issue the deployments. Targets the deployment account.\n  * kms_profile = Can be the same profile, unless you want the encryption key elsewhere.\n  * kms_key = A pre-created symmetric KMS key. It's only purpose is for encryption/decryption of deployment secrets.\n  * deployment_name = The name of the deployment, used in kubernetes namespace, container naming and datadog \"deployment\" Unified Tag)\n* Run `terraform init -backend-config=../backend.hcl` in the infra directory.\n\n* Run `terraform apply` in `infra` directory. This should complete ok. \n  * Check in the console if you see the EKS cluster, RDS database, etc.\n  * If you enabled load balancer deployment, check for the load balancer as well.\n  * The configuration values needed for application deployment will be output to the console after the apply completes.\n\n**Application Deployment**: After infrastructure is ready, deploy the application using the datafold-operator. Continue with the [Datafold Helm Charts repository](https://github.com/datafold/helm-charts) to deploy the operator manager and then the application through the operator. The operator is the default and recommended method for deploying Datafold.\n\n## Infrastructure Dependencies\n\nThis module is designed to provide the complete infrastructure stack for Datafold deployment. However, if you already have EKS infrastructure in place, you can choose to configure the required resources independently.\n\n**Required Infrastructure Components**:\n- EKS cluster with appropriate node groups\n- RDS PostgreSQL database\n- S3 bucket for ClickHouse backups\n- EBS volumes for persistent storage (ClickHouse data, ClickHouse logs, Redis data)\n- IAM roles and service accounts for cluster operations\n- Load balancer (optional, can be managed by AWS Load Balancer Controller)\n- VPC and networking components\n- SSL certificate (validation timing depends on deployment method):\n  - **Terraform-managed LB**: Certificate must be pre-created and validated\n  - **Kubernetes-managed LB**: Certificate created automatically, validated post-deployment\n\n**Alternative Approaches**:\n- **Use this module**: Provides complete infrastructure setup for new deployments\n- **Use existing infrastructure**: Configure required resources manually or through other means\n- **Hybrid approach**: Use this module for some components and existing infrastructure for others\n\nFor detailed specifications of each required component, see the [Datafold Dedicated Cloud AWS Deployment Documentation](https://docs.datafold.com/datafold-deployment/dedicated-cloud/aws). For application deployment instructions, continue with the [Datafold Helm Charts repository](https://github.com/datafold/helm-charts) to deploy the operator manager and then the application through the operator.\n\n## About subnets and where they get created\n\nThe module by default deploys in two availability zones. This is because by default, the subnets\nfor private and public CIDR ranges have a list of two cidr ranges specified.\n\nThe AZ in which things get deployed depends on which AZ's get selected and in which order. This is an\nalphabetical ordering. In us-east this could be as many as 6 AZ's.\n\nWhat the module does is sort the AZs and then it will iteratively deploy a public / private subnet specifying\nit's AZ in the module. Thus:\n\n- [10.0.0.0/24] will get deployed in us-east-1a\n- [10.0.1.0/24] will get deployed in us-east-1b\n\nTo deploy to three AZ's, you should override the public/private subnet settings. Then it will iterate \nacross 3 elements, but the order of the AZ's will be the same by default.\n\nYou can add an \"exclusion list\" to the AZ ID's. The AZ ID is not the same as the AZ name. The AZ name \non AWS is shuffled between their actual location across all AWS accounts. This means that your \nus-east-1a might be use1-az1 for you, but it might be use1-az4 for an account elsewhere. So if you \nneed to match AZ's, you should match Availability zone ID's, not Availability zone names. The AZ ID \nis visible in the EC2 screen in the \"settings\" screen. There you see a list of enabled AZ's, their \nID and their name.\n\nTo specifically select particular AZ ID's, exclude the ones you do not want in the \naz_id_exclude_filter. This is a list. That way, you can restrict this to only AZ's you want. \nUnfortunately it is an exclude filter and not an include filter. That means if AWS adds additional \nAZ's, it could create replacements for a future AZ.\n\nGood news is that when there letters in use, I'd expect those letters to be maintained per AZ ID \nonce they exist. Just for new accounts these can be shuffled all over again. So from terraform \nstate perspective, things should be consistent at least.\n\n### Upgrading to 1.15+\n\nIn this version the terraform providers were upgraded to newer versions and this introduces\nrole name changes and a lot of other things. This means that after the upgrade, you can expect\nissues with certain kube-system pods in a crashloop. \n\nThe reason this happens is that the role names have changed that infra creates. They're using a \nprefix and a suffix now.\n\nAWS authenticates the service accounts for certain kube-system pods like aws-loadbalancer-controller,\nbut after this change that role mapping breaks.\n\nThere are ways to fix that manually:\n* Apply the application again after applying the infra. This should fix the role names for two pods.\n* Go to the service account of the aws-load-balancer-controller pod.\n* The service account has a forward mapping to the role ARN they need to assume on the cloud in the annotations\n* Update that annotation.\n\nExample:\n\n```yaml\napiVersion: v1\nautomountServiceAccountToken: true\nkind: ServiceAccount\nmetadata:\n  annotations:\n    eks.amazonaws.com/role-arn: arn:aws:iam::1234567889:role/datafold-lb-controller\n  labels:\n    app.kubernetes.io/component: controller\n    app.kubernetes.io/name: aws-load-balancer-controller\n  name: aws-load-balancer-controller\n  namespace: kube-system\n```\n\nCheck kubernetes for any failing pods in the kube-system namespace, possibly these need updating in the same\nway if the pods continue in the crashloop backoff phase.\n\n* In the newest version of Amazon Linux 3, Datadog cannot determine the local hostname, which it needs for tagging. Updating to the most recent datadog operator solves this issue:\n\n```bash\n\u003e helm repo add datadog https://helm.datadoghq.com\n\u003e helm repo udpate datadog\n\u003e helm update datafold-datadog-operator datadog/datadog-operator\n```\n\n* The default version of kubernetes is now 1.33. Nodes will be replaced if you execute this upgrade.\n* The AWS LB controller must make calls to the metadata servers. But doing this from a pod means that the hop limit that is in place\n  needs to be increased to 2. This avoids having explicit VPC ID's or regions in the configuration of the LB controller, but comes at a \n  limited security impact: \n\nhttps://aws.amazon.com/blogs/security/defense-in-depth-open-firewalls-reverse-proxies-ssrf-vulnerabilities-ec2-instance-metadata-service/\n\nhttps://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-data-retrieval.html#imds-considerations\n\n### Initializing the application\n\nAfter deploying the application through the operator (see the [Datafold Helm Charts repository](https://github.com/datafold/helm-charts)), establish a shell into the `\u003cdeployment\u003e-dfshell` container. \nIt is likely that the scheduler and server containers are crashing in a loop.\n\nAll we need to do is to run these commands:\n\n1. `./manage.py clickhouse create-tables`\n2. `./manage.py database create-or-upgrade`\n3. `./manage.py installation set-new-deployment-params`\n\nNow all containers should be up and running.\n\n## More information\n\nYou can get more information from our documentation site:\n\nhttps://docs.datafold.com/datafold-deployment/dedicated-cloud/aws\n\n\n\u003c!-- BEGIN_TF_DOCS --\u003e\n\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement\\_aws) | \u003e= 6.9.0 |\n| \u003ca name=\"requirement_dns\"\u003e\u003c/a\u003e [dns](#requirement\\_dns) | 3.2.1 |\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_aws\"\u003e\u003c/a\u003e [aws](#provider\\_aws) | \u003e= 6.9.0 |\n| \u003ca name=\"provider_null\"\u003e\u003c/a\u003e [null](#provider\\_null) | n/a |\n| \u003ca name=\"provider_random\"\u003e\u003c/a\u003e [random](#provider\\_random) | n/a |\n\n## Modules\n\n| Name | Source | Version |\n|------|--------|---------|\n| \u003ca name=\"module_clickhouse_backup\"\u003e\u003c/a\u003e [clickhouse\\_backup](#module\\_clickhouse\\_backup) | ./modules/clickhouse_backup | n/a |\n| \u003ca name=\"module_database\"\u003e\u003c/a\u003e [database](#module\\_database) | ./modules/database | n/a |\n| \u003ca name=\"module_eks\"\u003e\u003c/a\u003e [eks](#module\\_eks) | ./modules/eks | n/a |\n| \u003ca name=\"module_github_reverse_proxy\"\u003e\u003c/a\u003e [github\\_reverse\\_proxy](#module\\_github\\_reverse\\_proxy) | ./modules/github_reverse_proxy | n/a |\n| \u003ca name=\"module_load_balancer\"\u003e\u003c/a\u003e [load\\_balancer](#module\\_load\\_balancer) | ./modules/load_balancer | n/a |\n| \u003ca name=\"module_networking\"\u003e\u003c/a\u003e [networking](#module\\_networking) | ./modules/networking | n/a |\n| \u003ca name=\"module_private_access\"\u003e\u003c/a\u003e [private\\_access](#module\\_private\\_access) | ./modules/private_access | n/a |\n| \u003ca name=\"module_security\"\u003e\u003c/a\u003e [security](#module\\_security) | ./modules/security | n/a |\n| \u003ca name=\"module_vpc_peering\"\u003e\u003c/a\u003e [vpc\\_peering](#module\\_vpc\\_peering) | ./modules/vpc_peering | n/a |\n\n## Resources\n\n| Name | Type |\n|------|------|\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_alb_certificate_domain\"\u003e\u003c/a\u003e [alb\\_certificate\\_domain](#input\\_alb\\_certificate\\_domain) | Pass a domain name like example.com to this variable in order to enable ALB HTTPS listeners.\u003cbr/\u003eTerraform will try to find AWS certificate that is issued and matches asked domain,\u003cbr/\u003eso please make sure that you have issued a certificate for asked domain already. | `string` | n/a | yes |\n| \u003ca name=\"input_allowed_principals\"\u003e\u003c/a\u003e [allowed\\_principals](#input\\_allowed\\_principals) | List of allowed principals allowed to connect to this endpoint. | `list(string)` | `[]` | no |\n| \u003ca name=\"input_apply_major_upgrade\"\u003e\u003c/a\u003e [apply\\_major\\_upgrade](#input\\_apply\\_major\\_upgrade) | Sets the flag to allow AWS to apply major upgrade on the maintenance plan schedule. | `bool` | `false` | no |\n| \u003ca name=\"input_az_index\"\u003e\u003c/a\u003e [az\\_index](#input\\_az\\_index) | Index of the availability zone | `number` | `0` | no |\n| \u003ca name=\"input_backend_app_port\"\u003e\u003c/a\u003e [backend\\_app\\_port](#input\\_backend\\_app\\_port) | The target port to use for the backend services | `number` | `80` | no |\n| \u003ca name=\"input_backup_lifecycle_expiration_days\"\u003e\u003c/a\u003e [backup\\_lifecycle\\_expiration\\_days](#input\\_backup\\_lifecycle\\_expiration\\_days) | Number of days after which clickhouse backup objects will expire and be deleted. | `number` | `6` | no |\n| \u003ca name=\"input_ch_data_ebs_iops\"\u003e\u003c/a\u003e [ch\\_data\\_ebs\\_iops](#input\\_ch\\_data\\_ebs\\_iops) | IOPS of EBS volume | `number` | `3000` | no |\n| \u003ca name=\"input_ch_data_ebs_throughput\"\u003e\u003c/a\u003e [ch\\_data\\_ebs\\_throughput](#input\\_ch\\_data\\_ebs\\_throughput) | Throughput of EBS volume | `number` | `1000` | no |\n| \u003ca name=\"input_ch_logs_ebs_iops\"\u003e\u003c/a\u003e [ch\\_logs\\_ebs\\_iops](#input\\_ch\\_logs\\_ebs\\_iops) | IOPS of EBS volume | `number` | `3000` | no |\n| \u003ca name=\"input_ch_logs_ebs_throughput\"\u003e\u003c/a\u003e [ch\\_logs\\_ebs\\_throughput](#input\\_ch\\_logs\\_ebs\\_throughput) | Throughput of EBS volume | `number` | `250` | no |\n| \u003ca name=\"input_clickhouse_data_size\"\u003e\u003c/a\u003e [clickhouse\\_data\\_size](#input\\_clickhouse\\_data\\_size) | EBS volume size for clickhouse data in GB | `number` | `40` | no |\n| \u003ca name=\"input_clickhouse_logs_size\"\u003e\u003c/a\u003e [clickhouse\\_logs\\_size](#input\\_clickhouse\\_logs\\_size) | EBS volume size for clickhouse logs in GB | `number` | `40` | no |\n| \u003ca name=\"input_clickhouse_s3_bucket\"\u003e\u003c/a\u003e [clickhouse\\_s3\\_bucket](#input\\_clickhouse\\_s3\\_bucket) | Bucket where clickhouse backups are stored | `string` | `\"clickhouse-backups-abcguo23\"` | no |\n| \u003ca name=\"input_create_rds_kms_key\"\u003e\u003c/a\u003e [create\\_rds\\_kms\\_key](#input\\_create\\_rds\\_kms\\_key) | Set to true to create a separate KMS key (Recommended). | `bool` | `true` | no |\n| \u003ca name=\"input_create_ssl_cert\"\u003e\u003c/a\u003e [create\\_ssl\\_cert](#input\\_create\\_ssl\\_cert) | Creates an SSL certificate if set. | `bool` | n/a | yes |\n| \u003ca name=\"input_database_name\"\u003e\u003c/a\u003e [database\\_name](#input\\_database\\_name) | RDS database name | `string` | `\"datafold\"` | no |\n| \u003ca name=\"input_datadog_api_key\"\u003e\u003c/a\u003e [datadog\\_api\\_key](#input\\_datadog\\_api\\_key) | The API key for Datadog | `string` | `\"\"` | no |\n| \u003ca name=\"input_db_extra_parameters\"\u003e\u003c/a\u003e [db\\_extra\\_parameters](#input\\_db\\_extra\\_parameters) | List of map of extra variables to apply to the RDS database parameter group | `list` | `[]` | no |\n| \u003ca name=\"input_db_instance_tags\"\u003e\u003c/a\u003e [db\\_instance\\_tags](#input\\_db\\_instance\\_tags) | The extra tags to be applied to the RDS instance. | `map(any)` | `{}` | no |\n| \u003ca name=\"input_db_parameter_group_name\"\u003e\u003c/a\u003e [db\\_parameter\\_group\\_name](#input\\_db\\_parameter\\_group\\_name) | The specific parameter group name to associate | `string` | `\"\"` | no |\n| \u003ca name=\"input_db_parameter_group_tags\"\u003e\u003c/a\u003e [db\\_parameter\\_group\\_tags](#input\\_db\\_parameter\\_group\\_tags) | The extra tags to be applied to the parameter group | `map(any)` | `{}` | no |\n| \u003ca name=\"input_db_subnet_group_name\"\u003e\u003c/a\u003e [db\\_subnet\\_group\\_name](#input\\_db\\_subnet\\_group\\_name) | The specific subnet group name to use | `string` | `\"\"` | no |\n| \u003ca name=\"input_db_subnet_group_tags\"\u003e\u003c/a\u003e [db\\_subnet\\_group\\_tags](#input\\_db\\_subnet\\_group\\_tags) | The extra tags to be applied to the parameter group | `map(any)` | `{}` | no |\n| \u003ca name=\"input_default_node_disk_size\"\u003e\u003c/a\u003e [default\\_node\\_disk\\_size](#input\\_default\\_node\\_disk\\_size) | Disk size for a node in GB | `number` | `40` | no |\n| \u003ca name=\"input_deploy_github_reverse_proxy\"\u003e\u003c/a\u003e [deploy\\_github\\_reverse\\_proxy](#input\\_deploy\\_github\\_reverse\\_proxy) | Determines that the github reverse proxy should be deployed | `bool` | `false` | no |\n| \u003ca name=\"input_deploy_lb\"\u003e\u003c/a\u003e [deploy\\_lb](#input\\_deploy\\_lb) | Allows a deploy without a load balancer | `bool` | `true` | no |\n| \u003ca name=\"input_deploy_private_access\"\u003e\u003c/a\u003e [deploy\\_private\\_access](#input\\_deploy\\_private\\_access) | Determines that the cluster should be 100% private | `bool` | `false` | no |\n| \u003ca name=\"input_deploy_vpc_flow_logs\"\u003e\u003c/a\u003e [deploy\\_vpc\\_flow\\_logs](#input\\_deploy\\_vpc\\_flow\\_logs) | Activates the VPC flow logs if set. | `bool` | `false` | no |\n| \u003ca name=\"input_deploy_vpc_peering\"\u003e\u003c/a\u003e [deploy\\_vpc\\_peering](#input\\_deploy\\_vpc\\_peering) | Determines that the VPC peering should be deployed | `bool` | `false` | no |\n| \u003ca name=\"input_deployment_name\"\u003e\u003c/a\u003e [deployment\\_name](#input\\_deployment\\_name) | Name of the current deployment. | `string` | n/a | yes |\n| \u003ca name=\"input_dhcp_options_domain_name\"\u003e\u003c/a\u003e [dhcp\\_options\\_domain\\_name](#input\\_dhcp\\_options\\_domain\\_name) | Specifies DNS name for DHCP options set | `string` | `\"\"` | no |\n| \u003ca name=\"input_dhcp_options_domain_name_servers\"\u003e\u003c/a\u003e [dhcp\\_options\\_domain\\_name\\_servers](#input\\_dhcp\\_options\\_domain\\_name\\_servers) | Specify a list of DNS server addresses for DHCP options set | `list(string)` | \u003cpre\u003e[\u003cbr/\u003e  \"AmazonProvidedDNS\"\u003cbr/\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_dhcp_options_tags\"\u003e\u003c/a\u003e [dhcp\\_options\\_tags](#input\\_dhcp\\_options\\_tags) | Tags applied to the DHCP options set. | `map(string)` | `{}` | no |\n| \u003ca name=\"input_dns_egress_cidrs\"\u003e\u003c/a\u003e [dns\\_egress\\_cidrs](#input\\_dns\\_egress\\_cidrs) | List of Internet addresses to which the application has access | `list(string)` | `[]` | no |\n| \u003ca name=\"input_ebs_extra_tags\"\u003e\u003c/a\u003e [ebs\\_extra\\_tags](#input\\_ebs\\_extra\\_tags) | The extra tags to be applied to the EBS volumes | `map(any)` | `{}` | no |\n| \u003ca name=\"input_ebs_type\"\u003e\u003c/a\u003e [ebs\\_type](#input\\_ebs\\_type) | Type for all EBS volumes | `string` | `\"gp3\"` | no |\n| \u003ca name=\"input_enable_dhcp_options\"\u003e\u003c/a\u003e [enable\\_dhcp\\_options](#input\\_enable\\_dhcp\\_options) | Flag to use custom DHCP options for DNS resolution. | `bool` | `false` | no |\n| \u003ca name=\"input_environment\"\u003e\u003c/a\u003e [environment](#input\\_environment) | Global environment tag to apply on all datadog logs, metrics, etc. | `string` | n/a | yes |\n| \u003ca name=\"input_github_cidrs\"\u003e\u003c/a\u003e [github\\_cidrs](#input\\_github\\_cidrs) | List of CIDRs that are allowed to connect to the github reverse proxy | `list(string)` | `[]` | no |\n| \u003ca name=\"input_host_override\"\u003e\u003c/a\u003e [host\\_override](#input\\_host\\_override) | Overrides the default domain name used to send links in invite emails and page links. Useful if the application is behind cloudflare for example. | `string` | `\"\"` | no |\n| \u003ca name=\"input_ingress_enable_http_sg\"\u003e\u003c/a\u003e [ingress\\_enable\\_http\\_sg](#input\\_ingress\\_enable\\_http\\_sg) | Whether regular HTTP traffic should be allowed to access the load balancer | `bool` | `false` | no |\n| \u003ca name=\"input_initial_apply_complete\"\u003e\u003c/a\u003e [initial\\_apply\\_complete](#input\\_initial\\_apply\\_complete) | Indicates if this infra is deployed or not. Helps to resolve dependencies. | `bool` | `false` | no |\n| \u003ca name=\"input_k8s_access_bedrock\"\u003e\u003c/a\u003e [k8s\\_access\\_bedrock](#input\\_k8s\\_access\\_bedrock) | Allow cluster to access bedrock in this region | `bool` | `false` | no |\n| \u003ca name=\"input_k8s_api_access_roles\"\u003e\u003c/a\u003e [k8s\\_api\\_access\\_roles](#input\\_k8s\\_api\\_access\\_roles) | Set of roles that are allowed to access the EKS API | `set(string)` | `[]` | no |\n| \u003ca name=\"input_k8s_cluster_version\"\u003e\u003c/a\u003e [k8s\\_cluster\\_version](#input\\_k8s\\_cluster\\_version) | Ref. https://docs.aws.amazon.com/eks/latest/userguide/kubernetes-versions.html | `string` | `\"1.33\"` | no |\n| \u003ca name=\"input_k8s_module_version\"\u003e\u003c/a\u003e [k8s\\_module\\_version](#input\\_k8s\\_module\\_version) | EKS terraform module version | `string` | `\"~\u003e 19.7\"` | no |\n| \u003ca name=\"input_k8s_public_access_cidrs\"\u003e\u003c/a\u003e [k8s\\_public\\_access\\_cidrs](#input\\_k8s\\_public\\_access\\_cidrs) | List of CIDRs that are allowed to connect to the EKS control plane | `list(string)` | n/a | yes |\n| \u003ca name=\"input_lb_access_logs\"\u003e\u003c/a\u003e [lb\\_access\\_logs](#input\\_lb\\_access\\_logs) | Load balancer access logs configuration. | `map(string)` | `{}` | no |\n| \u003ca name=\"input_lb_deletion_protection\"\u003e\u003c/a\u003e [lb\\_deletion\\_protection](#input\\_lb\\_deletion\\_protection) | Flag if the load balancer can be deleted or not. | `bool` | `true` | no |\n| \u003ca name=\"input_lb_deploy_nlb\"\u003e\u003c/a\u003e [lb\\_deploy\\_nlb](#input\\_lb\\_deploy\\_nlb) | Flag if the network load balancer should be deployed (usually for incoming private link). | `bool` | `false` | no |\n| \u003ca name=\"input_lb_idle_timeout\"\u003e\u003c/a\u003e [lb\\_idle\\_timeout](#input\\_lb\\_idle\\_timeout) | The time in seconds that the connection is allowed to be idle. | `number` | `120` | no |\n| \u003ca name=\"input_lb_internal\"\u003e\u003c/a\u003e [lb\\_internal](#input\\_lb\\_internal) | Set to true to make the load balancer internal and not exposed to the internet. | `bool` | `false` | no |\n| \u003ca name=\"input_lb_name_override\"\u003e\u003c/a\u003e [lb\\_name\\_override](#input\\_lb\\_name\\_override) | An optional override for the name of the load balancer | `string` | `\"\"` | no |\n| \u003ca name=\"input_lb_nlb_internal\"\u003e\u003c/a\u003e [lb\\_nlb\\_internal](#input\\_lb\\_nlb\\_internal) | Set to true to make the load balancer internal and not exposed to the internet. | `bool` | `true` | no |\n| \u003ca name=\"input_lb_subnets_override\"\u003e\u003c/a\u003e [lb\\_subnets\\_override](#input\\_lb\\_subnets\\_override) | Override subnets to deploy ALB into, otherwise use default logic. | `list(string)` | `[]` | no |\n| \u003ca name=\"input_lb_vpces_details\"\u003e\u003c/a\u003e [lb\\_vpces\\_details](#input\\_lb\\_vpces\\_details) | Endpoint service to define for internal traffic over private link | \u003cpre\u003eobject({\u003cbr/\u003e    allowed_principals  = list(string)\u003cbr/\u003e    private_dns_name    = optional(string)\u003cbr/\u003e    acceptance_required = bool\u003cbr/\u003e\u003cbr/\u003e    supported_ip_address_types = list(string)\u003cbr/\u003e  })\u003c/pre\u003e | `null` | no |\n| \u003ca name=\"input_managed_node_grp1\"\u003e\u003c/a\u003e [managed\\_node\\_grp1](#input\\_managed\\_node\\_grp1) | Ref. https://registry.terraform.io/modules/terraform-aws-modules/eks/aws/latest/submodules/eks-managed-node-group | `any` | n/a | yes |\n| \u003ca name=\"input_managed_node_grp2\"\u003e\u003c/a\u003e [managed\\_node\\_grp2](#input\\_managed\\_node\\_grp2) | Ref. https://registry.terraform.io/modules/terraform-aws-modules/eks/aws/latest/submodules/eks-managed-node-group | `any` | `null` | no |\n| \u003ca name=\"input_managed_node_grp3\"\u003e\u003c/a\u003e [managed\\_node\\_grp3](#input\\_managed\\_node\\_grp3) | Ref. https://registry.terraform.io/modules/terraform-aws-modules/eks/aws/latest/submodules/eks-managed-node-group | `any` | `null` | no |\n| \u003ca name=\"input_monitor_lambda_datadog\"\u003e\u003c/a\u003e [monitor\\_lambda\\_datadog](#input\\_monitor\\_lambda\\_datadog) | Whether to monitor the Lambda with Datadog | `bool` | `false` | no |\n| \u003ca name=\"input_nat_gateway_public_ip\"\u003e\u003c/a\u003e [nat\\_gateway\\_public\\_ip](#input\\_nat\\_gateway\\_public\\_ip) | Public IP of the NAT gateway when reusing the NAT gateway instead of recreating | `string` | `\"\"` | no |\n| \u003ca name=\"input_peer_region\"\u003e\u003c/a\u003e [peer\\_region](#input\\_peer\\_region) | The region of the peer VPC | `string` | `\"\"` | no |\n| \u003ca name=\"input_peer_vpc_additional_whitelisted_ingress_cidrs\"\u003e\u003c/a\u003e [peer\\_vpc\\_additional\\_whitelisted\\_ingress\\_cidrs](#input\\_peer\\_vpc\\_additional\\_whitelisted\\_ingress\\_cidrs) | List of CIDRs that can pass through the load balancer | `set(string)` | `[]` | no |\n| \u003ca name=\"input_peer_vpc_cidr_block\"\u003e\u003c/a\u003e [peer\\_vpc\\_cidr\\_block](#input\\_peer\\_vpc\\_cidr\\_block) | The CIDR block of the peer VPC | `string` | `\"\"` | no |\n| \u003ca name=\"input_peer_vpc_id\"\u003e\u003c/a\u003e [peer\\_vpc\\_id](#input\\_peer\\_vpc\\_id) | The VPC ID to peer with | `string` | `\"\"` | no |\n| \u003ca name=\"input_peer_vpc_owner_id\"\u003e\u003c/a\u003e [peer\\_vpc\\_owner\\_id](#input\\_peer\\_vpc\\_owner\\_id) | The AWS account ID of the owner of the peer VPC | `string` | `\"\"` | no |\n| \u003ca name=\"input_private_subnet_index\"\u003e\u003c/a\u003e [private\\_subnet\\_index](#input\\_private\\_subnet\\_index) | Index of the private subnet | `number` | `0` | no |\n| \u003ca name=\"input_private_subnet_tags\"\u003e\u003c/a\u003e [private\\_subnet\\_tags](#input\\_private\\_subnet\\_tags) | The extra tags to be applied to the private subnets | `map(any)` | \u003cpre\u003e{\u003cbr/\u003e  \"Tier\": \"private\"\u003cbr/\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_propagate_intra_route_tables_vgw\"\u003e\u003c/a\u003e [propagate\\_intra\\_route\\_tables\\_vgw](#input\\_propagate\\_intra\\_route\\_tables\\_vgw) | If intra subnets should propagate traffic. | `bool` | `false` | no |\n| \u003ca name=\"input_propagate_private_route_tables_vgw\"\u003e\u003c/a\u003e [propagate\\_private\\_route\\_tables\\_vgw](#input\\_propagate\\_private\\_route\\_tables\\_vgw) | If private subnets should propagate traffic. | `bool` | `false` | no |\n| \u003ca name=\"input_propagate_public_route_tables_vgw\"\u003e\u003c/a\u003e [propagate\\_public\\_route\\_tables\\_vgw](#input\\_propagate\\_public\\_route\\_tables\\_vgw) | If public subnets should propagate traffic. | `bool` | `false` | no |\n| \u003ca name=\"input_provider_azs\"\u003e\u003c/a\u003e [provider\\_azs](#input\\_provider\\_azs) | List of availability zones to consider. If empty, the modules will determine this dynamically. | `list(string)` | `[]` | no |\n| \u003ca name=\"input_provider_region\"\u003e\u003c/a\u003e [provider\\_region](#input\\_provider\\_region) | The AWS region in which the infrastructure should be deployed | `string` | n/a | yes |\n| \u003ca name=\"input_public_subnet_index\"\u003e\u003c/a\u003e [public\\_subnet\\_index](#input\\_public\\_subnet\\_index) | Index of the public subnet | `number` | `0` | no |\n| \u003ca name=\"input_public_subnet_tags\"\u003e\u003c/a\u003e [public\\_subnet\\_tags](#input\\_public\\_subnet\\_tags) | The extra tags to be applied to the public subnets | `map(any)` | \u003cpre\u003e{\u003cbr/\u003e  \"Tier\": \"public\"\u003cbr/\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_rds_allocated_storage\"\u003e\u003c/a\u003e [rds\\_allocated\\_storage](#input\\_rds\\_allocated\\_storage) | The size of RDS allocated storage in GB | `number` | `20` | no |\n| \u003ca name=\"input_rds_auto_minor_version_upgrade\"\u003e\u003c/a\u003e [rds\\_auto\\_minor\\_version\\_upgrade](#input\\_rds\\_auto\\_minor\\_version\\_upgrade) | Sets a flag to upgrade automatically all minor versions | `bool` | `false` | no |\n| \u003ca name=\"input_rds_backup_window\"\u003e\u003c/a\u003e [rds\\_backup\\_window](#input\\_rds\\_backup\\_window) | RDS backup window | `string` | `\"03:00-06:00\"` | no |\n| \u003ca name=\"input_rds_backups_replication_retention_period\"\u003e\u003c/a\u003e [rds\\_backups\\_replication\\_retention\\_period](#input\\_rds\\_backups\\_replication\\_retention\\_period) | RDS backup replication retention period | `number` | `14` | no |\n| \u003ca name=\"input_rds_backups_replication_target_region\"\u003e\u003c/a\u003e [rds\\_backups\\_replication\\_target\\_region](#input\\_rds\\_backups\\_replication\\_target\\_region) | RDS backup replication target region | `string` | `null` | no |\n| \u003ca name=\"input_rds_copy_tags_to_snapshot\"\u003e\u003c/a\u003e [rds\\_copy\\_tags\\_to\\_snapshot](#input\\_rds\\_copy\\_tags\\_to\\_snapshot) | To copy tags to snapshot or not | `bool` | `false` | no |\n| \u003ca name=\"input_rds_extra_tags\"\u003e\u003c/a\u003e [rds\\_extra\\_tags](#input\\_rds\\_extra\\_tags) | The extra tags to be applied to the RDS instance | `map(any)` | `{}` | no |\n| \u003ca name=\"input_rds_identifier\"\u003e\u003c/a\u003e [rds\\_identifier](#input\\_rds\\_identifier) | Name of the RDS instance | `string` | `\"\"` | no |\n| \u003ca name=\"input_rds_instance\"\u003e\u003c/a\u003e [rds\\_instance](#input\\_rds\\_instance) | EC2 insance type for PostgreSQL RDS database.\u003cbr/\u003eAvailable instance groups: t3, m4, m5, r6i, m6i\u003cbr/\u003eAvailable instance classes: medium and higher. | `string` | `\"db.t3.medium\"` | no |\n| \u003ca name=\"input_rds_kms_key_alias\"\u003e\u003c/a\u003e [rds\\_kms\\_key\\_alias](#input\\_rds\\_kms\\_key\\_alias) | RDS KMS key alias. | `string` | `\"datafold-rds\"` | no |\n| \u003ca name=\"input_rds_maintenance_window\"\u003e\u003c/a\u003e [rds\\_maintenance\\_window](#input\\_rds\\_maintenance\\_window) | RDS maintenance window | `string` | `\"Mon:00:00-Mon:03:00\"` | no |\n| \u003ca name=\"input_rds_max_allocated_storage\"\u003e\u003c/a\u003e [rds\\_max\\_allocated\\_storage](#input\\_rds\\_max\\_allocated\\_storage) | The upper limit the database can grow in GB | `number` | `100` | no |\n| \u003ca name=\"input_rds_monitoring_interval\"\u003e\u003c/a\u003e [rds\\_monitoring\\_interval](#input\\_rds\\_monitoring\\_interval) | RDS monitoring interval | `number` | `0` | no |\n| \u003ca name=\"input_rds_monitoring_role_arn\"\u003e\u003c/a\u003e [rds\\_monitoring\\_role\\_arn](#input\\_rds\\_monitoring\\_role\\_arn) | The IAM role allowed to send RDS metrics to cloudwatch | `string` | `null` | no |\n| \u003ca name=\"input_rds_multi_az\"\u003e\u003c/a\u003e [rds\\_multi\\_az](#input\\_rds\\_multi\\_az) | RDS instance in multiple AZ's | `bool` | `false` | no |\n| \u003ca name=\"input_rds_param_group_family\"\u003e\u003c/a\u003e [rds\\_param\\_group\\_family](#input\\_rds\\_param\\_group\\_family) | The DB parameter group family to use | `string` | `\"postgres15\"` | no |\n| \u003ca name=\"input_rds_password_override\"\u003e\u003c/a\u003e [rds\\_password\\_override](#input\\_rds\\_password\\_override) | Password override | `string` | `null` | no |\n| \u003ca name=\"input_rds_performance_insights_enabled\"\u003e\u003c/a\u003e [rds\\_performance\\_insights\\_enabled](#input\\_rds\\_performance\\_insights\\_enabled) | RDS performance insights enabled or not | `bool` | `false` | no |\n| \u003ca name=\"input_rds_performance_insights_retention_period\"\u003e\u003c/a\u003e [rds\\_performance\\_insights\\_retention\\_period](#input\\_rds\\_performance\\_insights\\_retention\\_period) | RDS performance insights retention period | `number` | `7` | no |\n| \u003ca name=\"input_rds_port\"\u003e\u003c/a\u003e [rds\\_port](#input\\_rds\\_port) | The port the RDS database should be listening on. | `number` | `5432` | no |\n| \u003ca name=\"input_rds_ro_username\"\u003e\u003c/a\u003e [rds\\_ro\\_username](#input\\_rds\\_ro\\_username) | RDS read-only user name (not currently used). | `string` | `\"datafold_ro\"` | no |\n| \u003ca name=\"input_rds_username\"\u003e\u003c/a\u003e [rds\\_username](#input\\_rds\\_username) | Overrides the default RDS user name that is provisioned. | `string` | `\"datafold\"` | no |\n| \u003ca name=\"input_rds_version\"\u003e\u003c/a\u003e [rds\\_version](#input\\_rds\\_version) | Postgres RDS version to use. | `string` | `\"15.5\"` | no |\n| \u003ca name=\"input_redis_data_size\"\u003e\u003c/a\u003e [redis\\_data\\_size](#input\\_redis\\_data\\_size) | Redis EBS volume size in GB | `number` | `50` | no |\n| \u003ca name=\"input_redis_ebs_iops\"\u003e\u003c/a\u003e [redis\\_ebs\\_iops](#input\\_redis\\_ebs\\_iops) | IOPS of EBS redis volume | `number` | `3000` | no |\n| \u003ca name=\"input_redis_ebs_throughput\"\u003e\u003c/a\u003e [redis\\_ebs\\_throughput](#input\\_redis\\_ebs\\_throughput) | Throughput of EBS redis volume | `number` | `125` | no |\n| \u003ca name=\"input_s3_backup_bucket_name_override\"\u003e\u003c/a\u003e [s3\\_backup\\_bucket\\_name\\_override](#input\\_s3\\_backup\\_bucket\\_name\\_override) | Bucket name override. | `string` | `\"\"` | no |\n| \u003ca name=\"input_s3_clickhouse_backup_tags\"\u003e\u003c/a\u003e [s3\\_clickhouse\\_backup\\_tags](#input\\_s3\\_clickhouse\\_backup\\_tags) | The extra tags to be applied to the S3 clickhouse backup bucket | `map(any)` | `{}` | no |\n| \u003ca name=\"input_self_managed_node_grp_instance_type\"\u003e\u003c/a\u003e [self\\_managed\\_node\\_grp\\_instance\\_type](#input\\_self\\_managed\\_node\\_grp\\_instance\\_type) | Ref. https://github.com/awslabs/amazon-eks-ami/blob/master/files/eni-max-pods.txt | `string` | `\"THe instance type for the self managed node group.\"` | no |\n| \u003ca name=\"input_self_managed_node_grps\"\u003e\u003c/a\u003e [self\\_managed\\_node\\_grps](#input\\_self\\_managed\\_node\\_grps) | Ref. https://registry.terraform.io/modules/terraform-aws-modules/eks/aws/latest/submodules/self-managed-node-group | `any` | `{}` | no |\n| \u003ca name=\"input_service_account_prefix\"\u003e\u003c/a\u003e [service\\_account\\_prefix](#input\\_service\\_account\\_prefix) | Prefix for service account names to match Helm chart naming (e.g., 'datafold-' for 'datafold-server', or '' for no prefix) | `string` | `\"\"` | no |\n| \u003ca name=\"input_sg_tags\"\u003e\u003c/a\u003e [sg\\_tags](#input\\_sg\\_tags) | The extra tags to be applied to the security group | `map(any)` | `{}` | no |\n| \u003ca name=\"input_tags\"\u003e\u003c/a\u003e [tags](#input\\_tags) | Tags to apply to the general module | `any` | `{}` | no |\n| \u003ca name=\"input_use_default_rds_kms_key\"\u003e\u003c/a\u003e [use\\_default\\_rds\\_kms\\_key](#input\\_use\\_default\\_rds\\_kms\\_key) | Flag weither or not to use the default RDS KMS encryption key. Not recommended. | `bool` | `false` | no |\n| \u003ca name=\"input_vpc_cidr\"\u003e\u003c/a\u003e [vpc\\_cidr](#input\\_vpc\\_cidr) | The CIDR of the new VPC, if the vpc\\_cidr is not set | `string` | `\"10.0.0.0/16\"` | no |\n| \u003ca name=\"input_vpc_exclude_az_ids\"\u003e\u003c/a\u003e [vpc\\_exclude\\_az\\_ids](#input\\_vpc\\_exclude\\_az\\_ids) | AZ IDs to exclude from availability zones | `list(string)` | `[]` | no |\n| \u003ca name=\"input_vpc_id\"\u003e\u003c/a\u003e [vpc\\_id](#input\\_vpc\\_id) | The VPC ID of an existing VPC to deploy the cluster in. Creates a new VPC if not set. | `string` | `\"\"` | no |\n| \u003ca name=\"input_vpc_private_subnets\"\u003e\u003c/a\u003e [vpc\\_private\\_subnets](#input\\_vpc\\_private\\_subnets) | The private subnet CIDR ranges when a new VPC is created. | `list(string)` | \u003cpre\u003e[\u003cbr/\u003e  \"10.0.0.0/24\",\u003cbr/\u003e  \"10.0.1.0/24\"\u003cbr/\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_vpc_propagating_vgws\"\u003e\u003c/a\u003e [vpc\\_propagating\\_vgws](#input\\_vpc\\_propagating\\_vgws) | ID's of virtual private gateways to propagate. | `list(any)` | `[]` | no |\n| \u003ca name=\"input_vpc_public_subnets\"\u003e\u003c/a\u003e [vpc\\_public\\_subnets](#input\\_vpc\\_public\\_subnets) | The public network CIDR ranges | `list(string)` | \u003cpre\u003e[\u003cbr/\u003e  \"10.0.100.0/24\",\u003cbr/\u003e  \"10.0.101.0/24\"\u003cbr/\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_vpc_tags\"\u003e\u003c/a\u003e [vpc\\_tags](#input\\_vpc\\_tags) | The extra tags to be applied to the VPC | `map(any)` | `{}` | no |\n| \u003ca name=\"input_vpc_vpn_gateway_id\"\u003e\u003c/a\u003e [vpc\\_vpn\\_gateway\\_id](#input\\_vpc\\_vpn\\_gateway\\_id) | ID of the VPN gateway to attach to the VPC | `string` | `\"\"` | no |\n| \u003ca name=\"input_vpce_details\"\u003e\u003c/a\u003e [vpce\\_details](#input\\_vpce\\_details) | Endpoint names to define with security group rule definitions | \u003cpre\u003emap(object({\u003cbr/\u003e    vpces_service_name  = string\u003cbr/\u003e    subnet_ids          = optional(list(string), [])\u003cbr/\u003e    private_dns_enabled = optional(bool, true)\u003cbr/\u003e\u003cbr/\u003e    input_rules        = list(object({\u003cbr/\u003e       description = string\u003cbr/\u003e       from_port   = number\u003cbr/\u003e       to_port     = number\u003cbr/\u003e       protocol    = string\u003cbr/\u003e       cidr_blocks = string\u003cbr/\u003e    }))\u003cbr/\u003e    output_rules = list(object({\u003cbr/\u003e       description = string\u003cbr/\u003e       from_port   = number\u003cbr/\u003e       to_port     = number\u003cbr/\u003e       protocol    = string\u003cbr/\u003e       cidr_blocks = string\u003cbr/\u003e    }))\u003cbr/\u003e  }))\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_vpn_cidr\"\u003e\u003c/a\u003e [vpn\\_cidr](#input\\_vpn\\_cidr) | CIDR range for administrative access | `string` | `\"\"` | no |\n| \u003ca name=\"input_whitelisted_egress_cidrs\"\u003e\u003c/a\u003e [whitelisted\\_egress\\_cidrs](#input\\_whitelisted\\_egress\\_cidrs) | List of Internet addresses the application can access going outside | `list(string)` | n/a | yes |\n| \u003ca name=\"input_whitelisted_ingress_cidrs\"\u003e\u003c/a\u003e [whitelisted\\_ingress\\_cidrs](#input\\_whitelisted\\_ingress\\_cidrs) | List of CIDRs that can pass through the load balancer | `list(string)` | n/a | yes |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_clickhouse_backup_role_name\"\u003e\u003c/a\u003e [clickhouse\\_backup\\_role\\_name](#output\\_clickhouse\\_backup\\_role\\_name) | The name of the role for clickhouse backups |\n| \u003ca name=\"output_clickhouse_data_size\"\u003e\u003c/a\u003e [clickhouse\\_data\\_size](#output\\_clickhouse\\_data\\_size) | The size in GB of the clickhouse EBS data volume |\n| \u003ca name=\"output_clickhouse_data_volume_id\"\u003e\u003c/a\u003e [clickhouse\\_data\\_volume\\_id](#output\\_clickhouse\\_data\\_volume\\_id) | The EBS volume ID where clickhouse data will be stored. |\n| \u003ca name=\"output_clickhouse_logs_size\"\u003e\u003c/a\u003e [clickhouse\\_logs\\_size](#output\\_clickhouse\\_logs\\_size) | The size in GB of the clickhouse EBS logs volume |\n| \u003ca name=\"output_clickhouse_logs_volume_id\"\u003e\u003c/a\u003e [clickhouse\\_logs\\_volume\\_id](#output\\_clickhouse\\_logs\\_volume\\_id) | The EBS volume ID where clickhouse logs will be stored. |\n| \u003ca name=\"output_clickhouse_password\"\u003e\u003c/a\u003e [clickhouse\\_password](#output\\_clickhouse\\_password) | The generated clickhouse password to be used in the application deployment |\n| \u003ca name=\"output_clickhouse_s3_bucket\"\u003e\u003c/a\u003e [clickhouse\\_s3\\_bucket](#output\\_clickhouse\\_s3\\_bucket) | The location of the S3 bucket where clickhouse backups are stored |\n| \u003ca name=\"output_clickhouse_s3_region\"\u003e\u003c/a\u003e [clickhouse\\_s3\\_region](#output\\_clickhouse\\_s3\\_region) | The region where the S3 bucket is created |\n| \u003ca name=\"output_cloud_provider\"\u003e\u003c/a\u003e [cloud\\_provider](#output\\_cloud\\_provider) | A string describing the type of cloud provider to be passed onto the helm charts |\n| \u003ca name=\"output_cluster_endpoint\"\u003e\u003c/a\u003e [cluster\\_endpoint](#output\\_cluster\\_endpoint) | The URL to the EKS cluster endpoint |\n| \u003ca name=\"output_cluster_name\"\u003e\u003c/a\u003e [cluster\\_name](#output\\_cluster\\_name) | The name of the EKS cluster |\n| \u003ca name=\"output_cluster_scaler_role_arn\"\u003e\u003c/a\u003e [cluster\\_scaler\\_role\\_arn](#output\\_cluster\\_scaler\\_role\\_arn) | The ARN of the role that is able to scale the EKS cluster nodes. |\n| \u003ca name=\"output_db_instance_id\"\u003e\u003c/a\u003e [db\\_instance\\_id](#output\\_db\\_instance\\_id) | The ID of the RDS database instance |\n| \u003ca name=\"output_deployment_name\"\u003e\u003c/a\u003e [deployment\\_name](#output\\_deployment\\_name) | The name of the deployment |\n| \u003ca name=\"output_dfshell_role_arn\"\u003e\u003c/a\u003e [dfshell\\_role\\_arn](#output\\_dfshell\\_role\\_arn) | The ARN of the AWS Bedrock role |\n| \u003ca name=\"output_dfshell_service_account_name\"\u003e\u003c/a\u003e [dfshell\\_service\\_account\\_name](#output\\_dfshell\\_service\\_account\\_name) | The name of the service account for dfshell |\n| \u003ca name=\"output_dma_role_arn\"\u003e\u003c/a\u003e [dma\\_role\\_arn](#output\\_dma\\_role\\_arn) | The ARN of the AWS Bedrock role |\n| \u003ca name=\"output_dma_service_account_name\"\u003e\u003c/a\u003e [dma\\_service\\_account\\_name](#output\\_dma\\_service\\_account\\_name) | The name of the service account for dma |\n| \u003ca name=\"output_domain_name\"\u003e\u003c/a\u003e [domain\\_name](#output\\_domain\\_name) | The domain name to be used in DNS configuration |\n| \u003ca name=\"output_github_reverse_proxy_url\"\u003e\u003c/a\u003e [github\\_reverse\\_proxy\\_url](#output\\_github\\_reverse\\_proxy\\_url) | The URL of the API Gateway that acts as a reverse proxy to the GitHub API |\n| \u003ca name=\"output_k8s_load_balancer_controller_role_arn\"\u003e\u003c/a\u003e [k8s\\_load\\_balancer\\_controller\\_role\\_arn](#output\\_k8s\\_load\\_balancer\\_controller\\_role\\_arn) | The ARN of the role provisioned so the k8s cluster can edit the target group through the AWS load balancer controller. |\n| \u003ca name=\"output_lb_name\"\u003e\u003c/a\u003e [lb\\_name](#output\\_lb\\_name) | The name of the external load balancer |\n| \u003ca name=\"output_load_balancer_ips\"\u003e\u003c/a\u003e [load\\_balancer\\_ips](#output\\_load\\_balancer\\_ips) | The load balancer IP when it was provisioned. |\n| \u003ca name=\"output_operator_role_arn\"\u003e\u003c/a\u003e [operator\\_role\\_arn](#output\\_operator\\_role\\_arn) | The ARN of the AWS Bedrock role |\n| \u003ca name=\"output_operator_service_account_name\"\u003e\u003c/a\u003e [operator\\_service\\_account\\_name](#output\\_operator\\_service\\_account\\_name) | The name of the service account for operator |\n| \u003ca name=\"output_postgres_database_name\"\u003e\u003c/a\u003e [postgres\\_database\\_name](#output\\_postgres\\_database\\_name) | The name of the pre-provisioned database. |\n| \u003ca name=\"output_postgres_host\"\u003e\u003c/a\u003e [postgres\\_host](#output\\_postgres\\_host) | The DNS name for the postgres database |\n| \u003ca name=\"output_postgres_password\"\u003e\u003c/a\u003e [postgres\\_password](#output\\_postgres\\_password) | The generated postgres password to be used by the application |\n| \u003ca name=\"output_postgres_port\"\u003e\u003c/a\u003e [postgres\\_port](#output\\_postgres\\_port) | The port configured for the RDS database |\n| \u003ca name=\"output_postgres_username\"\u003e\u003c/a\u003e [postgres\\_username](#output\\_postgres\\_username) | The postgres username to be used by the application |\n| \u003ca name=\"output_private_access_vpces_name\"\u003e\u003c/a\u003e [private\\_access\\_vpces\\_name](#output\\_private\\_access\\_vpces\\_name) | Name of the VPCE service that allows private access to the cluster endpoint |\n| \u003ca name=\"output_redis_data_size\"\u003e\u003c/a\u003e [redis\\_data\\_size](#output\\_redis\\_data\\_size) | The size in GB of the Redis data volume. |\n| \u003ca name=\"output_redis_data_volume_id\"\u003e\u003c/a\u003e [redis\\_data\\_volume\\_id](#output\\_redis\\_data\\_volume\\_id) | The EBS volume ID of the Redis data volume. |\n| \u003ca name=\"output_redis_password\"\u003e\u003c/a\u003e [redis\\_password](#output\\_redis\\_password) | The generated redis password to be used in the application deployment |\n| \u003ca name=\"output_scheduler_role_arn\"\u003e\u003c/a\u003e [scheduler\\_role\\_arn](#output\\_scheduler\\_role\\_arn) | The ARN of the AWS Bedrock role |\n| \u003ca name=\"output_scheduler_service_account_name\"\u003e\u003c/a\u003e [scheduler\\_service\\_account\\_name](#output\\_scheduler\\_service\\_account\\_name) | The name of the service account for scheduler |\n| \u003ca name=\"output_security_group_id\"\u003e\u003c/a\u003e [security\\_group\\_id](#output\\_security\\_group\\_id) | The security group ID managing ingress from the load balancer |\n| \u003ca name=\"output_server_role_arn\"\u003e\u003c/a\u003e [server\\_role\\_arn](#output\\_server\\_role\\_arn) | The ARN of the AWS Bedrock role |\n| \u003ca name=\"output_server_service_account_name\"\u003e\u003c/a\u003e [server\\_service\\_account\\_name](#output\\_server\\_service\\_account\\_name) | The name of the service account for server |\n| \u003ca name=\"output_storage_worker_role_arn\"\u003e\u003c/a\u003e [storage\\_worker\\_role\\_arn](#output\\_storage\\_worker\\_role\\_arn) | The ARN of the AWS Bedrock role |\n| \u003ca name=\"output_storage_worker_service_account_name\"\u003e\u003c/a\u003e [storage\\_worker\\_service\\_account\\_name](#output\\_storage\\_worker\\_service\\_account\\_name) | The name of the service account for storage\\_worker |\n| \u003ca name=\"output_target_group_arn\"\u003e\u003c/a\u003e [target\\_group\\_arn](#output\\_target\\_group\\_arn) | The ARN to the target group where the pods need to be registered as targets. |\n| \u003ca name=\"output_vpc_cidr\"\u003e\u003c/a\u003e [vpc\\_cidr](#output\\_vpc\\_cidr) | The CIDR of the entire VPC |\n| \u003ca name=\"output_vpc_id\"\u003e\u003c/a\u003e [vpc\\_id](#output\\_vpc\\_id) | The ID of the VPC |\n| \u003ca name=\"output_vpces_azs\"\u003e\u003c/a\u003e [vpces\\_azs](#output\\_vpces\\_azs) | Set of availability zones where the VPCES is available. |\n| \u003ca name=\"output_worker_catalog_role_arn\"\u003e\u003c/a\u003e [worker\\_catalog\\_role\\_arn](#output\\_worker\\_catalog\\_role\\_arn) | The ARN of the AWS Bedrock role |\n| \u003ca name=\"output_worker_catalog_service_account_name\"\u003e\u003c/a\u003e [worker\\_catalog\\_service\\_account\\_name](#output\\_worker\\_catalog\\_service\\_account\\_name) | The name of the service account for worker\\_catalog |\n| \u003ca name=\"output_worker_interactive_role_arn\"\u003e\u003c/a\u003e [worker\\_interactive\\_role\\_arn](#output\\_worker\\_interactive\\_role\\_arn) | The ARN of the AWS Bedrock role |\n| \u003ca name=\"output_worker_interactive_service_account_name\"\u003e\u003c/a\u003e [worker\\_interactive\\_service\\_account\\_name](#output\\_worker\\_interactive\\_service\\_account\\_name) | The name of the service account for worker\\_interactive |\n| \u003ca name=\"output_worker_lineage_role_arn\"\u003e\u003c/a\u003e [worker\\_lineage\\_role\\_arn](#output\\_worker\\_lineage\\_role\\_arn) | The ARN of the AWS Bedrock role |\n| \u003ca name=\"output_worker_lineage_service_account_name\"\u003e\u003c/a\u003e [worker\\_lineage\\_service\\_account\\_name](#output\\_worker\\_lineage\\_service\\_account\\_name) | The name of the service account for worker\\_lineage |\n| \u003ca name=\"output_worker_monitor_role_arn\"\u003e\u003c/a\u003e [worker\\_monitor\\_role\\_arn](#output\\_worker\\_monitor\\_role\\_arn) | The ARN of the AWS Bedrock role |\n| \u003ca name=\"output_worker_monitor_service_account_name\"\u003e\u003c/a\u003e [worker\\_monitor\\_service\\_account\\_name](#output\\_worker\\_monitor\\_service\\_account\\_name) | The name of the service account for worker\\_monitor |\n| \u003ca name=\"output_worker_portal_role_arn\"\u003e\u003c/a\u003e [worker\\_portal\\_role\\_arn](#output\\_worker\\_portal\\_role\\_arn) | The ARN of the AWS Bedrock role |\n| \u003ca name=\"output_worker_portal_service_account_name\"\u003e\u003c/a\u003e [worker\\_portal\\_service\\_account\\_name](#output\\_worker\\_portal\\_service\\_account\\_name) | The name of the service account for worker\\_portal |\n| \u003ca name=\"output_worker_role_arn\"\u003e\u003c/a\u003e [worker\\_role\\_arn](#output\\_worker\\_role\\_arn) | The ARN of the AWS Bedrock role |\n| \u003ca name=\"output_worker_service_account_name\"\u003e\u003c/a\u003e [worker\\_service\\_account\\_name](#output\\_worker\\_service\\_account\\_name) | The name of the service account for worker |\n| \u003ca name=\"output_worker_singletons_role_arn\"\u003e\u003c/a\u003e [worker\\_singletons\\_role\\_arn](#output\\_worker\\_singletons\\_role\\_arn) | The ARN of the AWS Bedrock role |\n| \u003ca name=\"output_worker_singletons_service_account_name\"\u003e\u003c/a\u003e [worker\\_singletons\\_service\\_account\\_name](#output\\_worker\\_singletons\\_service\\_account\\_name) | The name of the service account for worker\\_singletons |\n\n\u003c!-- END_TF_DOCS --\u003e\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdatafold%2Fterraform-aws-datafold","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdatafold%2Fterraform-aws-datafold","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdatafold%2Fterraform-aws-datafold/lists"}