The module creates an AWS security group for your Aurora cluster by default and attaches it automatically. You can control every aspect of the security group — from ingress and egress rules to whether the group is created at all.
Automatic security group creation
By default, the module creates one security group and associates it with the cluster:
# main.tf (simplified)
resource "aws_security_group" "this" {
count = local.create_security_group ? 1 : 0
name = var.security_group_use_name_prefix ? null : local.security_group_name
name_prefix = var.security_group_use_name_prefix ? "${local.security_group_name}-" : null
vpc_id = var.vpc_id
description = coalesce(var.security_group_description, "Control traffic to/from RDS Aurora ${local.security_group_name}")
}
module "aurora" {
source = "terraform-aws-modules/rds-aurora/aws"
# ...
create_security_group = false
vpc_security_group_ids = ["sg-0abc1234def56789"] # provide your own SG
}
Core variables
Determines whether to create a security group for the RDS cluster.
ID of the VPC where the security group will be created. Required when create_security_group is true.
Name for the security group. Defaults to the module name variable.
security_group_use_name_prefix
When true, the value of security_group_name is used as a name prefix, resulting in a unique name. When false, the exact name is used.
Additional existing security groups to associate with the cluster, alongside any created by the module.
Ingress and egress rules
Use security_group_ingress_rules and security_group_egress_rules to define traffic rules. Each is a map of rule objects keyed by an arbitrary name.
Ingress rule attributes
IPv4 CIDR block to allow traffic from.
IPv6 CIDR block to allow traffic from.
Human-readable description for the rule.
Start of the port range. Defaults to the cluster port when omitted (5432 for PostgreSQL, 3306 for MySQL).
End of the port range. Defaults to from_port or the cluster port when omitted.
IP protocol. Defaults to tcp.
ID of a managed prefix list to allow traffic from.
referenced_security_group_id
ID of another security group to allow traffic from. Use the special value "self" to reference the security group created by this module.
When from_port and to_port are omitted, the module automatically resolves the correct database port: 5432 for aurora-postgresql/postgres engines, and 3306 for all other engines.
Examples
CIDR-based ingress
Security group reference
Allow traffic from each private subnet CIDR in your VPC — the pattern used in the autoscaling and postgresql examples:module "aurora" {
source = "terraform-aws-modules/rds-aurora/aws"
name = "my-aurora-pg"
engine = "aurora-postgresql"
vpc_id = module.vpc.vpc_id
db_subnet_group_name = module.vpc.database_subnet_group_name
security_group_ingress_rules = {
private-az1 = {
cidr_ipv4 = element(module.vpc.private_subnets_cidr_blocks, 0)
description = "Access from private subnet AZ1"
}
private-az2 = {
cidr_ipv4 = element(module.vpc.private_subnets_cidr_blocks, 1)
description = "Access from private subnet AZ2"
}
private-az3 = {
cidr_ipv4 = element(module.vpc.private_subnets_cidr_blocks, 2)
description = "Access from private subnet AZ3"
}
}
}
Allow traffic from an application security group. Use "self" to allow the cluster’s own security group to connect to itself (useful in multi-node setups):module "aurora" {
source = "terraform-aws-modules/rds-aurora/aws"
name = "my-aurora-pg"
engine = "aurora-postgresql"
vpc_id = module.vpc.vpc_id
db_subnet_group_name = module.vpc.database_subnet_group_name
security_group_ingress_rules = {
app_sg = {
referenced_security_group_id = aws_security_group.app.id
description = "Access from application layer"
}
self = {
referenced_security_group_id = "self"
description = "Allow cluster nodes to communicate with each other"
}
}
security_group_egress_rules = {
all = {
cidr_ipv4 = "0.0.0.0/0"
ip_protocol = "-1"
description = "Allow all outbound traffic"
}
}
}
Network type
The network stack for the cluster. Valid values:
IPV4 — IPv4 only (default behavior)DUAL — dual-stack (IPv4 and IPv6)
module "aurora" {
source = "terraform-aws-modules/rds-aurora/aws"
# ...
network_type = "DUAL"
}
IAM database authentication
iam_database_authentication_enabled
Enables IAM-based authentication to the database. When enabled, AWS IAM users and roles can authenticate to the database using an IAM token instead of a password.
module "aurora" {
source = "terraform-aws-modules/rds-aurora/aws"
# ...
iam_database_authentication_enabled = true
}
Storage encryption
Storage encryption is enabled by default.
Whether the DB cluster storage is encrypted. The default is true.
The ARN of a KMS key to use for storage encryption. When specified, storage_encrypted must be true. If omitted, the default RDS KMS key (aws/rds) is used.
module "aurora" {
source = "terraform-aws-modules/rds-aurora/aws"
# ...
storage_encrypted = true
kms_key_id = "arn:aws:kms:us-east-1:123456789012:key/mrk-1234abcd..."
}
