https://github.com/jameswoolfenden/terraform-aws-rds
Helps to deploy an RDS DB instance
https://github.com/jameswoolfenden/terraform-aws-rds
aws module rds terraform
Last synced: about 1 year ago
JSON representation
Helps to deploy an RDS DB instance
- Host: GitHub
- URL: https://github.com/jameswoolfenden/terraform-aws-rds
- Owner: JamesWoolfenden
- License: apache-2.0
- Created: 2019-11-26T11:07:10.000Z (over 6 years ago)
- Default Branch: master
- Last Pushed: 2023-08-31T11:03:30.000Z (almost 3 years ago)
- Last Synced: 2025-03-26T16:55:10.130Z (over 1 year ago)
- Topics: aws, module, rds, terraform
- Language: HCL
- Homepage:
- Size: 166 KB
- Stars: 4
- Watchers: 2
- Forks: 4
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
- Codeowners: .github/CODEOWNERS
Awesome Lists containing this project
README
# terraform-aws-rds
[](https://github.com/JamesWoolfenden/terraform-aws-rds)
[](https://github.com/JamesWoolfenden/terraform-aws-rds/releases/latest)
[](https://github.com/JamesWoolfenden/terraform-aws-rds/releases/latest)
[](https://www.bridgecrew.cloud/link/badge?vcs=github&fullRepo=JamesWoolfenden%2Fterraform-aws-rds&benchmark=CIS+AWS+V1.2)
[](https://github.com/pre-commit/pre-commit)
[](https://www.checkov.io/)
[](https://www.bridgecrew.cloud/link/badge?vcs=github&fullRepo=JamesWoolfenden%2Fterraform-aws-rds&benchmark=INFRASTRUCTURE+SECURITY)
Terraform module - creates an RDS instance. When you select tp create a Postgres DB, this module adds enables _pgaudit_, this is in line with Prowler and Bridgecrew AWS best practices.
---
It's 100% Open Source and licensed under the [APACHE2](LICENSE).
## Usage
Include this repository as a module in your existing Terraform code:
```terraform
module "rds" {
source = "JamesWoolfenden/rds/aws"
version = "0.2.4"
subnet_ids = var.subnets
instance = var.instance
instance_password = "Password123"
rds_role = data.aws_iam_role.rds
kms_key_id = data.aws_kms_key.rds.id
}
```
To find the parameter group family:
```cli
aws rds describe-db-engine-versions --query "DBEngineVersions[].DBParameterGroupFamily"
```
## Costs
Note: Costs start at this estimate based on the examplea values.
```text
Monthly cost estimate
Project: .
Name Monthly Qty Unit Monthly Cost
module.rds.aws_db_instance.instance
├─ Database instance 730 hours $27.74
└─ Database storage 20 GB-months $5.32
PROJECT TOTAL $33.06
```
## Requirements
No requirements.
## Providers
| Name | Version |
|------|---------|
| [aws](#provider\_aws) | n/a |
## Modules
No modules.
## Resources
| Name | Type |
|------|------|
| [aws_db_instance.instance](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance) | resource |
| [aws_db_parameter_group.custom](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_parameter_group) | resource |
| [aws_db_subnet_group.access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_subnet_group) | resource |
| [aws_iam_policy.dbaccess](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
| [aws_secretsmanager_secret.password](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret) | resource |
| [aws_secretsmanager_secret.username](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret) | resource |
| [aws_secretsmanager_secret_version.password](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_version) | resource |
| [aws_secretsmanager_secret_version.username](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_version) | resource |
| [aws_security_group.dbaccess](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
## Inputs
| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| [allowed\_cidr](#input\_allowed\_cidr) | n/a | `list(string)` | n/a | yes |
| [apply\_immediately](#input\_apply\_immediately) | Apply changes immediately | `bool` | `false` | no |
| [backup\_retention\_period](#input\_backup\_retention\_period) | n/a | `number` | `14` | no |
| [copy\_tags\_to\_snapshot](#input\_copy\_tags\_to\_snapshot) | n/a | `bool` | `true` | no |
| [custom\_db\_group\_name](#input\_custom\_db\_group\_name) | Your custom DB parameter group mane | `string` | `""` | no |
| [db\_subnet\_group\_name](#input\_db\_subnet\_group\_name) | The name of the subnet to use for the database | `string` | `"default"` | no |
| [deletion\_protection](#input\_deletion\_protection) | n/a | `bool` | `true` | no |
| [description](#input\_description) | n/a | `string` | `"Some description"` | no |
| [family](#input\_family) | Needs to be set to your specific db | `string` | `"aurora-postgresql14"` | no |
| [instance](#input\_instance) | Map of all the variables | `any` | n/a | yes |
| [instance\_password](#input\_instance\_password) | Instance Password | `string` | n/a | yes |
| [kms\_key\_arn](#input\_kms\_key\_arn) | The ARN of a KMS key | `string` | n/a | yes |
| [monitoring\_interval](#input\_monitoring\_interval) | Monitoring\_interval in seconds | `number` | `60` | no |
| [monitoring\_role\_arn](#input\_monitoring\_role\_arn) | Role for Monitoring - the ARN | `string` | `""` | no |
| [multi\_az](#input\_multi\_az) | Controls multi az | `bool` | `true` | no |
| [publicly\_accessible](#input\_publicly\_accessible) | To comply with security rules CKV\_AWS\_17 this defaults to false | `bool` | `false` | no |
| [rds\_role](#input\_rds\_role) | The IAM ARN of the role for RDS monitoring | `string` | `""` | no |
| [recovery\_window\_in\_days](#input\_recovery\_window\_in\_days) | The number of days for schedule of deletion of secret | `number` | `0` | no |
| [subnet\_group](#input\_subnet\_group) | n/a | `list` |
[
{
"description": "",
"name": "database-1"
}
]
| no |
| [subnet\_ids](#input\_subnet\_ids) | A list of Subnet ids | `list(any)` | n/a | yes |
| [vpc\_id](#input\_vpc\_id) | The id of the VPC for the security group and db | `string` | n/a | yes |
## Outputs
| Name | Description |
|------|-------------|
| [db\_subnet\_group](#output\_db\_subnet\_group) | n/a |
| [instance](#output\_instance) | n/a |
| [password\_location](#output\_password\_location) | n/a |
| [policy](#output\_policy) | n/a |
| [security\_group](#output\_security\_group) | n/a |
| [username\_location](#output\_username\_location) | n/a |
## Policy
This is the policy required to build this project:
The Terraform resource required is:
```golang
resource "aws_iam_policy" "terraform_pike" {
name_prefix = "terraform_pike"
path = "/"
description = "Pike Autogenerated policy from IAC"
policy = jsonencode({
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"ec2:AuthorizeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:CreateSecurityGroup",
"ec2:DeleteSecurityGroup",
"ec2:DescribeAccountAttributes",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribeSecurityGroups",
"ec2:RevokeSecurityGroupEgress",
"ec2:RevokeSecurityGroupIngress"
],
"Resource": [
"*"
]
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": [
"iam:CreatePolicy",
"iam:DeletePolicy",
"iam:GetPolicy",
"iam:GetPolicyVersion",
"iam:ListPolicyVersions",
"iam:PassRole"
],
"Resource": [
"*"
]
},
{
"Sid": "VisualEditor2",
"Effect": "Allow",
"Action": [
"rds:CreateDBInstance",
"rds:CreateDBParameterGroup",
"rds:CreateDBSubnetGroup",
"rds:DeleteDBInstance",
"rds:DeleteDBParameterGroup",
"rds:DeleteDBSubnetGroup",
"rds:DescribeDBInstances",
"rds:DescribeDBParameterGroups",
"rds:DescribeDBParameters",
"rds:DescribeDBSubnetGroups",
"rds:ListTagsForResource",
"rds:ModifyDBInstance",
"rds:ModifyDBParameterGroup"
],
"Resource": [
"*"
]
},
{
"Sid": "VisualEditor3",
"Effect": "Allow",
"Action": [
"secretsmanager:CreateSecret",
"secretsmanager:DeleteSecret",
"secretsmanager:DescribeSecret",
"secretsmanager:GetResourcePolicy",
"secretsmanager:GetSecretValue",
"secretsmanager:PutSecretValue"
],
"Resource": [
"*"
]
}
]
})
}
```
## Related Projects
Check out these related projects.
- [terraform-aws-s3](https://github.com/jameswoolfenden/terraform-aws-s3) - S3 buckets
## Help
**Got a question?**
File a GitHub [issue](https://github.com/JamesWoolfenden/terraform-aws-rds/issues).
## Contributing
### Bug Reports & Feature Requests
Please use the [issue tracker](https://github.com/JamesWoolfenden/terraform-aws-rds/issues) to report any bugs or file feature requests.
## Copyrights
Copyright © 2019-2023 James Woolfenden
## License
[](https://opensource.org/licenses/Apache-2.0)
See [LICENSE](LICENSE) for full details.
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
### Contributors
[![James Woolfenden][jameswoolfenden_avatar]][jameswoolfenden_homepage]
[James Woolfenden][jameswoolfenden_homepage]
[jameswoolfenden_homepage]: https://github.com/jameswoolfenden
[jameswoolfenden_avatar]: https://github.com/jameswoolfenden.png?size=150