Amazon RDS

Deploy and manage Amazon Relational Database Service (RDS)

View on GitHub

Reference

Inputs

• alarms_sns_topic_arns — The ARNs of SNS topics where CloudWatch alarms (e.g., for CPU, memory, and disk space usage) should send notifications. Also used for the alarms if the share snapshot backup job fails.

• allocated_storage — The amount of storage space the DB should use, in GB.

• allow_connections_from_cidr_blocks — The list of network CIDR blocks to allow network access to RDS from. One of allow_connections_from_cidr_blocks or allow_connections_from_security_groups must be specified for the database to be reachable.

• allow_connections_from_security_groups — The list of IDs or Security Groups to allow network access to RDS from. All security groups must either be in the VPC specified by vpc_id, or a peered VPC with the VPC specified by vpc_id. One of allow_connections_from_cidr_blocks or allow_connections_from_security_groups must be specified for the database to be reachable.

• allow_manage_key_permissions_with_iam — If true, both the CMK's Key Policy and IAM Policies (permissions) can be used to grant permissions on the CMK. If false, only the CMK's Key Policy can be used to grant permissions on the CMK. False is more secure (and generally preferred), but true is more flexible and convenient.

• apply_immediately — Specifies whether any cluster modifications are applied immediately, or during the next maintenance window. Note that cluster modifications may cause degraded performance or downtime.

• backup_job_alarm_period — How often, in seconds, the backup job is expected to run. This is the same as schedule_expression, but unfortunately, Terraform offers no way to convert rate expressions to seconds. We add a CloudWatch alarm that triggers if the metric in create_snapshot_cloudwatch_metric_namespace isn't updated within this time period, as that indicates the backup failed to run.

• backup_retention_period — How many days to keep backup snapshots around before cleaning them up. Must be 1 or greater to support read replicas.

• backup_window — The daily time range during which automated backups are created (e.g. 04:00-09:00). Time zone is UTC. Performance may be degraded while a backup runs.

• cmk_administrator_iam_arns — A list of IAM ARNs for users who should be given administrator access to this CMK (e.g. arn:aws:iam::<aws-account-id>:user/<iam-user-arn>). If this list is empty, and kms_key_arn is null, the ARN of the current user will be used.

• cmk_external_user_iam_arns — A list of IAM ARNs for users from external AWS accounts who should be given permissions to use this CMK (e.g. arn:aws:iam::<aws-account-id>:root).

• cmk_user_iam_arns — A list of IAM ARNs for users who should be given permissions to use this CMK (e.g. arn:aws:iam::<aws-account-id>:user/<iam-user-arn>). If this list is empty, and kms_key_arn is null, the ARN of the current user will be used.

• create_custom_kms_key — If set to true, create a KMS CMK and use it to encrypt data on disk in the database. The permissions for this CMK will be assigned by the following variables: cmk_administrator_iam_arns, cmk_user_iam_arns, cmk_external_user_iam_arns, allow_manage_key_permissions.

• create_snapshot_cloudwatch_metric_namespace — The namespace to use for the CloudWatch metric we report every time a new RDS snapshot is created. We add a CloudWatch alarm on this metric to notify us if the backup job fails to run for any reason. Defaults to the cluster name.

• custom_parameter_group — Configure a custom parameter group for the RDS DB. This will create a new parameter group with the given parameters. When null, the database will be launched with the default parameter group.

• custom_tags — A map of custom tags to apply to the RDS Instance and the Security Group created for it. The key is the tag name and the value is the tag value.

• dashboard_cpu_usage_widget_parameters — Parameters for the cpu usage widget to output for use in a CloudWatch dashboard.

• dashboard_db_connections_widget_parameters — Parameters for the database connections widget to output for use in a CloudWatch dashboard.

• dashboard_disk_space_widget_parameters — Parameters for the available disk space widget to output for use in a CloudWatch dashboard.

• dashboard_memory_widget_parameters — Parameters for the available memory widget to output for use in a CloudWatch dashboard.

• dashboard_read_latency_widget_parameters — Parameters for the read latency widget to output for use in a CloudWatch dashboard.

• dashboard_write_latency_widget_parameters — Parameters for the read latency widget to output for use in a CloudWatch dashboard.

• db_config_secrets_manager_id — The friendly name or ARN of an AWS Secrets Manager secret that contains database configuration information in the format outlined by this document: https://docs.aws.amazon.com/secretsmanager/latest/userguide/best-practices.html. The engine, username, password, dbname, and port fields must be included in the JSON. Note that even with this precaution, this information will be stored in plaintext in the Terraform state file! See the following blog post for more details: https://blog.gruntwork.io/a-comprehensive-guide-to-managing-secrets-in-your-terraform-code-1d586955ace1. If you do not wish to use Secrets Manager, leave this as null, and use the master_username, master_password, db_name, engine, and port variables.

• db_name — The name for your database of up to 8 alpha-numeric characters. If you do not provide a name, Amazon RDS will not create an empty database on the RDS instance. This can also be provided via AWS Secrets Manager. See the description of db_config_secrets_manager_id.

• delete_automated_backups — Specifies whether to remove automated backups immediately after the DB instance is deleted

• enable_cloudwatch_alarms — Set to true to enable several basic CloudWatch alarms around CPU usage, memory usage, and disk space usage. If set to true, make sure to specify SNS topics to send notifications to using alarms_sns_topic_arn.

• enable_cloudwatch_metrics — When true, enable CloudWatch metrics for the manual snapshots created for the purpose of sharing with another account.

• enable_deletion_protection — Enable deletion protection on the RDS instance. If this is enabled, the database cannot be deleted prior to disabling

• enable_perf_alarms — Set to true to enable alarms related to performance, such as read and write latency alarms. Set to false to disable those alarms if you aren't sure what would be reasonable perf numbers for your RDS set up or if those numbers are too unpredictable.

• enable_share_snapshot_cloudwatch_alarms — When true, enable CloudWatch alarms for the manual snapshots created for the purpose of sharing with another account. Only used if share_snapshot_with_another_account is true.

• enabled_cloudwatch_logs_exports — List of log types to enable for exporting to CloudWatch logs. If omitted, no logs will be exported. Valid values (depending on engine): alert, audit, error, general, listener, slowquery, trace, postgresql (PostgreSQL) and upgrade (PostgreSQL).

• engine — The DB engine to use (e.g. mysql). This can also be provided via AWS Secrets Manager. See the description of db_config_secrets_manager_id.

• engine_version — The version of var.engine to use (e.g. 8.0.17 for mysql).

• high_cpu_utilization_period — The period, in seconds, over which to measure the CPU utilization percentage.

• high_cpu_utilization_threshold — Trigger an alarm if the DB instance has a CPU utilization percentage above this threshold.

• high_read_latency_period — The period, in seconds, over which to measure the read latency.

• high_read_latency_threshold — Trigger an alarm if the DB instance read latency (average amount of time taken per disk I/O operation), in seconds, is above this threshold.

• high_write_latency_period — The period, in seconds, over which to measure the write latency.

• high_write_latency_threshold — Trigger an alarm if the DB instance write latency (average amount of time taken per disk I/O operation), in seconds, is above this threshold.

• iam_database_authentication_enabled — Specifies whether mappings of AWS Identity and Access Management (IAM) accounts to database accounts is enabled. Disabled by default.

• instance_type — The instance type to use for the db (e.g. db.t3.micro)

• kms_key_arn — The Amazon Resource Name (ARN) of an existing KMS customer master key (CMK) that will be used to encrypt/decrypt backup files. If you leave this blank, the default RDS KMS key for the account will be used. If you set create_custom_kms_key to true, this value will be ignored and a custom key will be created and used instead.

• license_model — The license model to use for this DB. Check the docs for your RDS DB for available license models. Set to an empty string to use the default.

• low_disk_space_available_period — The period, in seconds, over which to measure the available free disk space.

• low_disk_space_available_threshold — Trigger an alarm if the amount of disk space, in Bytes, on the DB instance drops below this threshold.

• low_memory_available_period — The period, in seconds, over which to measure the available free memory.

• low_memory_available_threshold — Trigger an alarm if the amount of free memory, in Bytes, on the DB instance drops below this threshold.

• master_password — The value to use for the master password of the database. This can also be provided via AWS Secrets Manager. See the description of db_config_secrets_manager_id.

• master_username — The value to use for the master username of the database. This can also be provided via AWS Secrets Manager. See the description of db_config_secrets_manager_id.

• max_allocated_storage — When configured, the upper limit to which Amazon RDS can automatically scale the storage of the DB instance. Configuring this will automatically ignore differences to allocated_storage. Must be greater than or equal to allocated_storage or 0 to disable Storage Autoscaling.

• multi_az — Specifies if a standby instance should be deployed in another availability zone. If the primary fails, this instance will automatically take over.

• name — The name used to namespace all the RDS resources created by these templates, including the cluster and cluster instances (e.g. mysql-stage). Must be unique in this region. Must be a lowercase string.

• num_read_replicas — The number of read replicas to deploy

• port — The port the DB will listen on (e.g. 3306). Alternatively, this can be provided via AWS Secrets Manager. See the description of db_config_secrets_manager_id.

• publicly_accessible — If you wish to make your database accessible from the public Internet, set this flag to true (WARNING: NOT RECOMMENDED FOR REGULAR USAGE!!). The default is false, which means the database is only accessible from within the VPC, which is much more secure. This flag MUST be false for serverless mode.

• replica_backup_retention_period — How many days to keep backup snapshots around before cleaning them up on the read replicas. Must be 1 or greater to support read replicas. 0 means disable automated backups.

• share_snapshot_max_snapshots — The maximum number of snapshots to keep around for the purpose of cross account sharing. Once this number is exceeded, a lambda function will delete the oldest snapshots. Only used if share_snapshot_with_another_account is true.

• share_snapshot_schedule_expression — An expression that defines how often to run the lambda function to take snapshots for the purpose of cross account sharing. For example, cron(0 20 * ? ) or rate(5 minutes). Required if share_snapshot_with_another_account is true

• share_snapshot_with_account_id — The ID of the AWS Account that the snapshot should be shared with. Required if share_snapshot_with_another_account is true.

• share_snapshot_with_another_account — If set to true, take periodic snapshots of the RDS DB that should be shared with another account.

• skip_final_snapshot — Determines whether a final DB snapshot is created before the DB instance is deleted. Be very careful setting this to true; if you do, and you delete this DB instance, you will not have any backups of the data! You almost never want to set this to true, unless you are doing automated or manual testing.

• snapshot_identifier — If non-null, the RDS Instance will be restored from the given Snapshot ID. This is the Snapshot ID you'd find in the RDS console, e.g: rds:production-2015-06-26-06-05.

• storage_encrypted — Specifies whether the DB instance is encrypted.

• subnet_ids — The list of IDs of the subnets in which to deploy RDS. The list must only contain subnets in vpc_id.

• too_many_db_connections_threshold — Trigger an alarm if the number of connections to the DB instance goes above this threshold.

• vpc_id — The ID of the VPC in which to deploy RDS.

Outputs

• all_metric_widgets — A list of all the CloudWatch Dashboard metric widgets available in this module.

• db_name — The name of the empty database created on this RDS DB instance.

• metric_widget_rds_cpu_usage — A CloudWatch Dashboard widget that graphs CPU usage (percentage) on the RDS DB instance.

• metric_widget_rds_db_connections — A CloudWatch Dashboard widget that graphs the number of active database connections on the RDS DB Instance.

• metric_widget_rds_disk_space — A CloudWatch Dashboard widget that graphs available disk space (in bytes) on the RDS DB instance.

• metric_widget_rds_memory — A CloudWatch Dashboard widget that graphs available memory (in bytes) on the RDS DB instance.

• metric_widget_rds_read_latency — A CloudWatch Dashboard widget that graphs the average amount of time taken per disk I/O operation on reads.

• metric_widget_rds_write_latency — A CloudWatch Dashboard widget that graphs the average amount of time taken per disk I/O operation on writes.

• name — The name of the RDS DB instance.

• num_read_replicas — The number of read replicas for the RDS DB instance.

• port — The port of the RDS DB instance.

• primary_arn — The ARN of the RDS DB instance.

• primary_endpoint — The endpoint of the RDS DB instance that you can make requests to.

• primary_host — The host portion of the RDS DB instance endpoint. primary_endpoint is in the form '<host>:<port>', and this output returns just the host part.

• primary_id — The ID of the RDS DB instance.

• read_replica_arns — A list of ARNs of the RDS DB instance's read replicas.

• read_replica_endpoints — A list of endpoints of the RDS DB instance's read replicas.

• read_replica_ids — A list of IDs of the RDS DB instance's read replicas.

• security_group_id — The ID of the Security Group that controls access to the RDS DB instance.