https://github.com/dasmeta/terraform-aws-rds
Terraform Aws RDS module
https://github.com/dasmeta/terraform-aws-rds
aws database module rds terraform terraform-module
Last synced: about 1 year ago
JSON representation
Terraform Aws RDS module
- Host: GitHub
- URL: https://github.com/dasmeta/terraform-aws-rds
- Owner: dasmeta
- License: apache-2.0
- Created: 2022-11-02T14:07:24.000Z (over 3 years ago)
- Default Branch: main
- Last Pushed: 2025-06-05T16:11:21.000Z (about 1 year ago)
- Last Synced: 2025-06-13T21:05:22.694Z (about 1 year ago)
- Topics: aws, database, module, rds, terraform, terraform-module
- Language: HCL
- Homepage: www.dasmeta.com
- Size: 137 KB
- Stars: 0
- Watchers: 2
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
- Security: security-group.tf
Awesome Lists containing this project
README
## This terraform module allows to create aws rds cluster by using various engine types and configurations, it allows also to enable/create rds cluster attached rds proxy.
## NOTE: When creating rds with proxy, first create the rds only and then enable proxy and re-apply
## module upgrade guide
- from <1.4.0 versions to >=1.4.0 version upgrade
- make sure you moved the state of "db" underlying module by using command like following
```sh
terraform state mv module..module.db module..module.db[0]
```
- if you had no storage_type set explicitly then set it to "gp2"
- from version <1.6.5 to >=1.7.0
- the aurora cluster auto-scaling related configs have been moved under aurora_configs.autoscaling object so make sure to update old aurora_configs.autoscaling_* options into corresponding aurora_configs.autoscaling.* ones
- there is new options in aurora_configs.autoscaling to manage auto scaling related configs and also new ability to define scheduled autoscaling
- NOTE, that in case you have auto scaled instances created in cluster and want to destroy cluster via terraform code you have to scale down and remove those instances manually before applying cluster destruct code
## How to use (more examples/tests can be found in [./tests](./tests) folder)
### Case 1. Create Security group and create RDS
```terraform
data "aws_vpc" "main" {
id = "vpc-xxxxxxx"
}
module "rds" {
source = "dasmeta/rds/aws"
version = "1.4.0"
allocated_storage = 20
storage_type = "gp2"
engine = "mysql"
engine_version = "5.7.26"
instance_class = "db.t2.micro"
identifier = "db"
db_name = "db"
db_username = "root"
db_password = "some-password"
parameter_group_name = "default.mysql5.7"
vpc_id = "${data.aws_vpc.main.id}"
subnet_ids = ["subnet-xxxxxxxx","subnet-xxxxxx"]
}
```
### Case 2. Create RDS and pass custom/external created security group ids
```terraform
module "rds" {
source = "dasmeta/rds/aws"
version = "1.4.0"
allocated_storage = 20
storage_type = "gp2"
engine = "mysql"
engine_version = "5.7.26"
instance_class = "db.t2.micro"
identifier = "db"
db_name = "db"
db_username = "root"
db_password = "some-password"
parameter_group_name = "default.mysql5.7"
vpc_id = "vpc-xxxxxxxxxxxx"
subnet_ids = ["subnet-xxxxxxx","subnet-xxxxxxxx"]
create_security_group = false
vpc_security_group_ids = ["sg-xxxxxxxxx"]
}
```
## contribution
### please enable git hooks by running the following command
```sh
git config --global core.hooksPath ./githooks # enables git hooks globally
```
## Requirements
No requirements.
## Providers
| Name | Version |
|------|---------|
| [aws](#provider\_aws) | n/a |
## Modules
| Name | Source | Version |
|------|--------|---------|
| [cloudwatch\_metric\_filters](#module\_cloudwatch\_metric\_filters) | dasmeta/monitoring/aws//modules/cloudwatch-log-based-metrics | 1.13.2 |
| [cw\_alerts](#module\_cw\_alerts) | dasmeta/monitoring/aws//modules/alerts | 1.3.5 |
| [db](#module\_db) | terraform-aws-modules/rds/aws | 6.10.0 |
| [db\_aurora](#module\_db\_aurora) | terraform-aws-modules/rds-aurora/aws | 9.12.0 |
| [proxy](#module\_proxy) | ./modules/proxy | n/a |
| [scheduled\_scale](#module\_scheduled\_scale) | ./modules/scheduled-scale | n/a |
| [security\_group](#module\_security\_group) | terraform-aws-modules/security-group/aws | 5.2.0 |
## Resources
| Name | Type |
|------|------|
| [aws_db_instance.database](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/db_instance) | data source |
| [aws_ec2_instance_type.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ec2_instance_type) | data source |
| [aws_vpc.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc) | data source |
## Inputs
| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| [alarms](#input\_alarms) | n/a |
object({
enabled = optional(bool, true)
sns_topic = string
custom_values = optional(any, {})
}) | n/a | yes |
| [allocated\_storage](#input\_allocated\_storage) | The allocated storage in gigabytes | `number` | `20` | no |
| [apply\_immediately](#input\_apply\_immediately) | Specifies whether any database modifications are applied immediately, or during the next maintenance window | `bool` | `false` | no |
| [aurora\_configs](#input\_aurora\_configs) | The aws rd aurora specific configurations | object({
engine_mode = optional(string, "provisioned") # The database engine mode. Valid values: `global`, `multimaster`, `parallelquery`, `provisioned`, `serverless`(serverless is deprecated)
instances = optional(any, {}) # Cluster instances configs
autoscaling = optional(object({
enabled = optional(bool, false) # Whether autoscaling enabled
min_capacity = optional(number, 0) # Min number of read replicas
max_capacity = optional(number, 2) # Max number of read replicas permitted
predefined_metric_type = optional(string, "RDSReaderAverageCPUUtilization") # The metric type to scale on. Valid values are `RDSReaderAverageCPUUtilization` and `RDSReaderAverageDatabaseConnections`
scale_in_cooldown = optional(number, 300) # Cooldown in seconds before allowing further scaling operations after a scale in
scale_out_cooldown = optional(number, 300) # Cooldown in seconds before allowing further scaling operations after a scale out
target_cpu = optional(number, 70) # CPU threshold which will initiate autoscaling
target_connections = optional(number, 700) # Average number of connections threshold which will initiate autoscaling. Default value is 70% of db.r4/r5/r6g.large's default max_connections
schedules = optional(list(object({ # List of scheduled autoscale configs
name = string # The name of scheduled scale
schedule = string # The schedule time to apply auto scale, can be cron(min hour day month week-day year ), at(yyyy-mm-ddThh:mm:ss) or rate(value unit) formats
min_capacity = optional(number) # If not set defaults to aurora_configs.autoscaling_min_capacity
max_capacity = optional(number) # If not set defaults to aurora_configs.autoscaling_max_capacity
timezone = optional(string, null) # By default it uses UTC, available values can be found here: https://www.joda.org/joda-time/timezones.html
})), [])
scaling_configuration = optional(any, {}) # map of nested attributes with scaling properties. Only valid when `engine_mode` is set to `serverless`
serverlessv2_scaling_configuration = optional(any, {}) # for enabling serverless-2(the serverless-1(engine_mode=serverless, scaling_configuration is set) is deprecated), valid when `engine_mode` is set to `provisioned`
}), {})
}) | `{}` | no |
| [backup\_retention\_period](#input\_backup\_retention\_period) | The days to retain backups for | `number` | `35` | no |
| [backup\_window](#input\_backup\_window) | The daily time range (in UTC) during which automated backups are created if they are enabled. Example: '09:46-10:16'. Must not overlap with maintenance\_window | `string` | `"03:00-06:00"` | no |
| [cloudwatch\_log\_group\_retention\_in\_days](#input\_cloudwatch\_log\_group\_retention\_in\_days) | The number of days to retain CloudWatch logs for the DB instance | `number` | `30` | no |
| [create\_cloudwatch\_log\_group](#input\_create\_cloudwatch\_log\_group) | Determines whether a CloudWatch log group is created for each enabled\_cloudwatch\_logs\_exports | `bool` | `true` | no |
| [create\_db\_option\_group](#input\_create\_db\_option\_group) | Create a database option group | `bool` | `false` | no |
| [create\_db\_parameter\_group](#input\_create\_db\_parameter\_group) | Whether to create a database parameter group | `bool` | `false` | no |
| [create\_db\_subnet\_group](#input\_create\_db\_subnet\_group) | Whether to create a database subnet group | `bool` | `true` | no |
| [create\_monitoring\_role](#input\_create\_monitoring\_role) | Create IAM role with a defined name that permits RDS to send enhanced monitoring metrics to CloudWatch Logs | `bool` | `false` | no |
| [create\_security\_group](#input\_create\_security\_group) | Whether to create security group and attach ingress/egress rules which will be used for rds instances(and rds proxy if we enabled it), if you already have one and do not want to create new security group you can explicitly set this variable to false and pass group id by using var.vpc\_security\_group\_ids | `bool` | `true` | no |
| [db\_instance\_tags](#input\_db\_instance\_tags) | Additional tags for the DB instance | `map(any)` | `{}` | no |
| [db\_name](#input\_db\_name) | The DB name to create. If omitted, no database is created initially | `string` | `""` | no |
| [db\_option\_group\_tags](#input\_db\_option\_group\_tags) | Additional tags for the DB option group | `map(any)` | `{}` | no |
| [db\_parameter\_group\_tags](#input\_db\_parameter\_group\_tags) | n/a | `map(any)` | `{}` | no |
| [db\_password](#input\_db\_password) | Password for the master DB user. Note that this may show up in logs, and it will be stored in the state file | `string` | `""` | no |
| [db\_subnet\_group\_name](#input\_db\_subnet\_group\_name) | Name of DB subnet group. DB instance will be created in the VPC associated with the DB subnet group. If unspecified, will be created in the default VPC | `string` | `null` | no |
| [db\_subnet\_group\_tags](#input\_db\_subnet\_group\_tags) | Additional tags for the DB parameter group | `map(any)` | `{}` | no |
| [db\_subnet\_group\_use\_name\_prefix](#input\_db\_subnet\_group\_use\_name\_prefix) | Determines whether to use `subnet_group_name` as is or create a unique name beginning with the `subnet_group_name` as the prefix | `bool` | `false` | no |
| [db\_username](#input\_db\_username) | Username for the master DB user | `string` | `""` | no |
| [deletion\_protection](#input\_deletion\_protection) | The database can't be deleted when this value is set to true | `bool` | `false` | no |
| [egress\_with\_cidr\_blocks](#input\_egress\_with\_cidr\_blocks) | n/a | `list(map(string))` | `[]` | no |
| [enabled\_cloudwatch\_logs\_exports](#input\_enabled\_cloudwatch\_logs\_exports) | List of log types to enable for exporting to CloudWatch logs. If omitted, no logs will be exported. Valid values (depending on engine): alert, audit, error, general, listener, slowquery, trace, postgresql (PostgreSQL), upgrade (PostgreSQL) | `list(string)` | `[]` | no |
| [enforce\_client\_tls](#input\_enforce\_client\_tls) | parameter to enforce tls connections from clients | `bool` | `true` | no |
| [engine](#input\_engine) | The database engine to use | `string` | `"mysql"` | no |
| [engine\_version](#input\_engine\_version) | The engine version to use | `string` | `"5.7.26"` | no |
| [iam\_database\_authentication\_enabled](#input\_iam\_database\_authentication\_enabled) | Specifies whether or not the mappings of AWS Identity and Access Management (IAM) accounts to database accounts are enabled | `bool` | `true` | no |
| [identifier](#input\_identifier) | Specifies the identifier of the CA certificate for the DB instance | `string` | n/a | yes |
| [ingress\_with\_cidr\_blocks](#input\_ingress\_with\_cidr\_blocks) | n/a | `list(map(string))` | `[]` | no |
| [instance\_class](#input\_instance\_class) | The instance type of the RDS instance | `string` | `"db.t3.micro"` | no |
| [maintenance\_window](#input\_maintenance\_window) | The window to perform maintenance in. Syntax: 'ddd:hh24:mi-ddd:hh24:mi'. Eg: 'Mon:00:00-Mon:03:00' | `string` | `"Mon:00:00-Mon:03:00"` | no |
| [major\_engine\_version](#input\_major\_engine\_version) | Specifies the major version of the engine that this option group should be associated with | `string` | `"5.7"` | no |
| [manage\_master\_user\_password](#input\_manage\_master\_user\_password) | Set to true to allow RDS to manage the master user password in Secrets Manager | `bool` | `false` | no |
| [max\_allocated\_storage](#input\_max\_allocated\_storage) | Specifies the value for Storage Autoscaling | `number` | `100` | no |
| [monitoring\_interval](#input\_monitoring\_interval) | The interval, in seconds, between points when Enhanced Monitoring metrics are collected for the DB instance. To disable collecting Enhanced Monitoring metrics, specify 0. The default is 0. Valid Values: 0, 1, 5, 10, 15, 30, 60 | `number` | `0` | no |
| [monitoring\_role\_name](#input\_monitoring\_role\_name) | Name of the IAM role which will be created when create\_monitoring\_role is enabled | `string` | `null` | no |
| [multi\_az](#input\_multi\_az) | Specifies if the RDS instance is multi-AZ | `bool` | `true` | no |
| [options](#input\_options) | A list of Options to apply | `list(any)` | [
{
"option_name": "MARIADB_AUDIT_PLUGIN",
"option_settings": [
{
"name": "SERVER_AUDIT_EVENTS",
"value": "CONNECT"
},
{
"name": "SERVER_AUDIT_FILE_ROTATIONS",
"value": "37"
}
]
}
]
| no |
| [parameter\_group\_name](#input\_parameter\_group\_name) | Name of the DB parameter group to associate or create | `string` | `"default.mysql5.7"` | no |
| [parameters](#input\_parameters) | A list of DB parameters (map) to apply | list(object({
name = string
value = string
context = optional(string, "instance") # The context where parameter will be used, supported values are "instance" and "cluster"
apply_method = optional(string, "immediate") # The apply method for parameter, supported values are "immediate" and "pending-reboot"
})) | `[]` | no |
| [performance\_insights\_enabled](#input\_performance\_insights\_enabled) | Specifies whether Performance Insights is enabled or not, the default is false | `bool` | `null` | no |
| [performance\_insights\_kms\_key\_arn](#input\_performance\_insights\_kms\_key\_arn) | Specifies the KMS Key ID to encrypt Performance Insights data. If not specified, the default RDS KMS key will be used (aws/rds) | `string` | `null` | no |
| [performance\_insights\_retention\_period](#input\_performance\_insights\_retention\_period) | Specifies the amount of time to retain performance insights data for. Defaults to 7 days if Performance Insights are enabled. Valid values are 7, month * 31 (where month is a number of months from 1-23), and 731 | `number` | `null` | no |
| [port](#input\_port) | The port on which the DB accepts connections | `number` | `null` | no |
| [proxy](#input\_proxy) | The aws rds proxy specific configurations | object({
enabled = optional(bool, false) # whether rds proxy is enabled
endpoints = optional(any, {}) # map of {: } additional proxy endpoints(by default we have already one read/write endpoint), for more info check resource doc https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_proxy_endpoint
client_auth_type = optional(string, "MYSQL_NATIVE_PASSWORD") # The type of authentication the proxy uses for connections from clients
iam_auth = optional(string, "DISABLED") # Whether IAM auth enabled
target_db_cluster = optional(bool, true) # Whether the target db is cluster
debug_logging = optional(bool, false) # Whether enhanced logging is enabled
idle_client_timeout = optional(number, 1800) # The timeout of idle connections, default is 30 minutes
}) | `{}` | no |
| [publicly\_accessible](#input\_publicly\_accessible) | Whether the database is accessible publicly. Note that if you need to enable this you have to place db on public subnets | `bool` | `false` | no |
| [replication\_source\_identifier](#input\_replication\_source\_identifier) | ARN of a source DB cluster or DB instance if this DB cluster is to be created as a Read Replica | `string` | `null` | no |
| [security\_group\_description](#input\_security\_group\_description) | n/a | `string` | `"MySQL security group"` | no |
| [security\_group\_name](#input\_security\_group\_name) | n/a | `string` | `"db_security_group"` | no |
| [set\_vpc\_security\_group\_rules](#input\_set\_vpc\_security\_group\_rules) | Whether to automatically add security group rules allowing access to db from vpc network | `bool` | `true` | no |
| [skip\_final\_snapshot](#input\_skip\_final\_snapshot) | Determines whether a final DB snapshot is created before the DB instance is deleted. If true is specified, no DBSnapshot is created. If false is specified, a DB snapshot is created before the DB instance is deleted | `bool` | `false` | no |
| [slow\_queries](#input\_slow\_queries) | n/a | object({
enabled = optional(bool, true)
query_duration = optional(number, 3)
}) | {
"enabled": true,
"query_duration": 3
} | no |
| [storage\_encrypted](#input\_storage\_encrypted) | Specifies whether the DB instance is encrypted | `bool` | `true` | no |
| [storage\_type](#input\_storage\_type) | One of 'standard' (magnetic), 'gp2' (general purpose SSD), gp3, or 'io1' (provisioned IOPS SSD). The default is 'io1' if iops is specified, 'gp2' if not | `string` | `null` | no |
| [subnet\_ids](#input\_subnet\_ids) | A list of VPC subnet IDs | `list(string)` | n/a | yes |
| [tags](#input\_tags) | A mapping of tags to assign to all resources | `map(any)` | `{}` | no |
| [vpc\_id](#input\_vpc\_id) | n/a | `string` | `""` | no |
| [vpc\_security\_group\_ids](#input\_vpc\_security\_group\_ids) | List of VPC security groups to associate | `list(string)` | `[]` | no |
## Outputs
| Name | Description |
|------|-------------|
| [db\_instance\_address](#output\_db\_instance\_address) | The address of the RDS instance |
| [db\_instance\_arn](#output\_db\_instance\_arn) | The ARN of the RDS instance |
| [db\_instance\_cloudwatch\_log\_groups](#output\_db\_instance\_cloudwatch\_log\_groups) | Map of CloudWatch log groups created and their attributes |
| [db\_instance\_endpoint](#output\_db\_instance\_endpoint) | The connection endpoint |
| [db\_instance\_port](#output\_db\_instance\_port) | The database port |
| [db\_password](#output\_db\_password) | DB password |
| [db\_username](#output\_db\_username) | DB username |