Module Inputs

General

create

bool

default:"true"

Whether cluster should be created (affects nearly all resources).

region

string

default:"null"

Region where the resource(s) will be managed. Defaults to the Region set in the provider configuration.

name

string

default:"\"\""

Name used across resources created.

tags

map(string)

default:"{}"

A map of tags to add to all resources.

putin_khuylo

bool

default:"true"

Do you agree that Putin doesn’t respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo!

DB Subnet Group

create_db_subnet_group

bool

default:"false"

Determines whether to create the database subnet group or use existing.

db_subnet_group_name

string

default:"\"\""

The name of the subnet group name (existing or created).

subnets

list(string)

default:"[]"

List of subnet IDs used by database subnet group created.

Cluster

is_primary_cluster

bool

default:"true"

Determines whether cluster is primary cluster with writer instance (set to false for global cluster and replica clusters).

cluster_use_name_prefix

bool

default:"false"

Whether to use name as a prefix for the cluster.

allocated_storage

number

default:"null"

The amount of storage in gibibytes (GiB) to allocate to each DB instance in the Multi-AZ DB cluster. Required to create a Multi-AZ DB cluster.

allow_major_version_upgrade

bool

default:"false"

Enable to allow major engine version upgrades when changing engine versions.

apply_immediately

bool

default:"null"

Specifies whether any cluster modifications are applied immediately, or during the next maintenance window.

availability_zones

list(string)

default:"null"

List of EC2 Availability Zones for the DB cluster storage where DB cluster instances can be created. RDS automatically assigns 3 AZs if fewer than 3 are configured.

backup_retention_period

number

default:"null"

The days to retain backups for.

backtrack_window

number

default:"null"

The target backtrack window, in seconds. Only available for the aurora engine. To disable backtracking set to 0. Must be between 0 and 259200 (72 hours).

cluster_ca_cert_identifier

string

default:"null"

The CA certificate identifier to use for the DB cluster’s server certificate. Currently only supported for multi-AZ DB clusters.

cluster_members

list(string)

default:"null"

List of RDS Instances that are a part of this cluster.

cluster_scalability_type

string

default:"null"

Specifies the scalability mode of the Aurora DB cluster. When set to limitless, the cluster operates as an Aurora Limitless Database. When set to standard (the default), the cluster uses normal DB instance creation. Valid values: limitless, standard.

cluster_performance_insights_enabled

bool

default:"null"

Enables Performance Insights for the RDS Cluster.

cluster_performance_insights_kms_key_id

string

default:"null"

Specifies the KMS Key ID to encrypt Performance Insights data. If not specified, the default RDS KMS key (aws/rds) will be used.

cluster_performance_insights_retention_period

number

default:"null"

Specifies the amount of time to retain performance insights data. Defaults to 7 days if Performance Insights are enabled. Valid values are 7, month * 31 (where month is 1–23), and 731.

cluster_monitoring_interval

number

default:"0"

Interval, in seconds, between points when Enhanced Monitoring metrics are collected for the DB cluster. Set to 0 to disable. Valid values: 0, 1, 5, 10, 15, 30, 60.

copy_tags_to_snapshot

bool

default:"true"

Copy all Cluster tags to snapshots.

database_insights_mode

string

default:"null"

The mode of Database Insights to enable for the DB cluster. Valid values: standard, advanced.

database_name

string

default:"null"

Name for an automatically created database on cluster creation.

cluster_instance_class

string

default:"null"

The compute and memory capacity of each DB instance in the Multi-AZ DB cluster.

cluster_db_instance_parameter_group_name

string

default:"null"

Instance parameter group to associate with all instances of the DB cluster. Only valid in combination with allow_major_version_upgrade.

delete_automated_backups

bool

default:"null"

Specifies whether to remove automated backups immediately after the DB cluster is deleted.

deletion_protection

bool

default:"null"

If the DB instance should have deletion protection enabled. The database can’t be deleted when set to true.

enable_global_write_forwarding

bool

default:"null"

Whether cluster should forward writes to an associated global cluster. Applied to secondary clusters to forward writes to an aws_rds_global_cluster’s primary cluster.

enable_local_write_forwarding

bool

default:"null"

Whether read replicas can forward write operations to the writer DB instance in the DB cluster.

enable_http_endpoint

bool

default:"null"

Enable HTTP endpoint (data API). Only valid when engine_mode is set to serverless.

engine

string

default:"null"

The name of the database engine to be used for this DB cluster. Defaults to aurora. Valid values: aurora, aurora-mysql, aurora-postgresql.

engine_mode

string

default:"\"provisioned\""

The database engine mode. Valid values: global, multimaster, parallelquery, provisioned, serverless.

engine_version

string

default:"null"

The database engine version. Updating this argument results in an outage.

engine_lifecycle_support

string

default:"null"

The life cycle type for this DB instance. Valid values: open-source-rds-extended-support, open-source-rds-extended-support-disabled. Default value is open-source-rds-extended-support.

final_snapshot_identifier

string

default:"null"

The name of your final DB snapshot when this DB cluster is deleted. If omitted, no final snapshot will be made.

global_cluster_identifier

string

default:"null"

The global cluster identifier specified on aws_rds_global_cluster.

iam_database_authentication_enabled

bool

default:"null"

Specifies whether mappings of AWS IAM accounts to database accounts is enabled.

domain

string

default:"null"

The ID of the Directory Service Active Directory domain to create the instance in.

domain_iam_role_name

string

default:"null"

(Required if domain is provided) The name of the IAM role to be used when making API calls to the Directory Service.

iops

number

default:"null"

The amount of Provisioned IOPS to be initially allocated for each DB instance in the Multi-AZ DB cluster.

kms_key_id

string

default:"null"

The ARN for the KMS encryption key. When specifying kms_key_id, storage_encrypted needs to be set to true.

manage_master_user_password

bool

default:"true"

Set to true to allow RDS to manage the master user password in Secrets Manager. Cannot be set if master_password_wo is provided.

master_user_secret_kms_key_id

string

default:"null"

The AWS KMS key identifier (key ARN, key ID, alias ARN, or alias name) for the KMS key used to encrypt the master user secret.

master_password_wo

string

default:"null"

Write-only password for the master DB user. Required unless manage_master_user_password is true, a snapshot_identifier, replication_source_identifier, or global_cluster_identifier is provided. This field is sensitive and ephemeral.

master_password_wo_version

number

default:"null"

Used together with master_password_wo to trigger a password update. Increment this value when an update to master_password_wo is required.

master_username

string

default:"null"

Username for the master DB user. Required unless snapshot_identifier, replication_source_identifier, or global_cluster_identifier is provided (secondary cluster).

network_type

string

default:"null"

The type of network stack to use. Valid values: IPV4, DUAL.

port

string

default:"null"

The port on which the DB accepts connections.

preferred_backup_window

string

default:"null"

Daily time range during which automated backups are created if enabled. Time in UTC, e.g. 04:00-09:00.

preferred_maintenance_window

string

default:"null"

Weekly time range during which system maintenance can occur (UTC), e.g. wed:04:00-wed:04:30.

replication_source_identifier

string

default:"null"

ARN of a source DB cluster or DB instance if this DB cluster is to be created as a Read Replica.

restore_to_point_in_time

object

default:"null"

Map of nested attributes for cloning an Aurora cluster.

Show restore_to_point_in_time attributes

restore_to_time

string

The date and time to restore the DB cluster to (RFC 3339 format).

restore_type

string

Type of restore to be performed. Valid values: full-copy, copy-on-write.

source_cluster_identifier

string

Identifier of the source DB cluster from which to restore.

source_cluster_resource_id

string

Cluster resource ID of the source DB cluster from which to restore.

use_latest_restorable_time

bool

Set to true to restore the DB cluster to the latest restorable backup time.

s3_import

object

default:"null"

Configuration map used to restore from a Percona Xtrabackup in S3. Only MySQL is supported.

Show s3_import attributes

bucket_name

string

required

The bucket name where your backup is stored.

bucket_prefix

string

Can be blank, but is the path to your backup.

ingestion_role

string

required

Role applied to load the data.

source_engine_version

string

required

Version of the source engine used to make the backup.

scaling_configuration

object

default:"null"

Map of nested attributes with scaling properties. Only valid when engine_mode is set to serverless.

Show scaling_configuration attributes

auto_pause

bool

Whether to enable automatic pause for a Serverless Aurora DB cluster (when inactive).

max_capacity

number

Maximum capacity for the Aurora DB cluster in serverless DB engine mode.

min_capacity

number

Minimum capacity for the Aurora DB cluster in serverless DB engine mode.

seconds_before_timeout

number

Time, in seconds, before an Aurora DB cluster in serverless mode is paused.

seconds_until_auto_pause

number

Time, in seconds, before an Aurora DB cluster in serverless mode is paused.

timeout_action

string

Action to take when the timeout is reached. Valid values: ForceApplyCapacityChange, RollbackCapacityChange.

serverlessv2_scaling_configuration

object

default:"null"

Map of nested attributes with serverless v2 scaling properties. Only valid when engine_mode is set to provisioned.

Show serverlessv2_scaling_configuration attributes

max_capacity

number

required

Maximum capacity for the Aurora Serverless v2 DB cluster.

min_capacity

number

Minimum capacity for the Aurora Serverless v2 DB cluster.

seconds_until_auto_pause

number

Time, in seconds, before an Aurora Serverless v2 DB cluster is paused.

skip_final_snapshot

bool

default:"false"

Determines whether a final snapshot is created before the cluster is deleted. If true, no snapshot is created.

snapshot_identifier

string

default:"null"

Specifies whether or not to create this cluster from a snapshot. You can use either the name or ARN when specifying a DB cluster snapshot, or the ARN when specifying a DB snapshot.

source_region

string

default:"null"

The source region for an encrypted replica DB cluster.

storage_encrypted

bool

default:"true"

Specifies whether the DB cluster is encrypted.

storage_type

string

default:"null"

Determines the storage type for the DB cluster. Optional for Single-AZ, required for Multi-AZ DB clusters. Valid values for Single-AZ: aurora, "" (Aurora Standard), aurora-iopt1 (Aurora I/O Optimized). Valid values for Multi-AZ: io1.

cluster_tags

map(string)

default:"{}"

A map of tags to add to only the cluster. Used for AWS Instance Scheduler tagging.

cluster_timeouts

object

default:"null"

Create, update, and delete timeout configurations for the cluster.

Show cluster_timeouts attributes

create

string

Timeout for cluster creation, e.g. "120m".

update

string

Timeout for cluster update, e.g. "120m".

delete

string

Timeout for cluster deletion, e.g. "120m".

Cluster Instances

instances

map(object)

default:"{}"

Map of cluster instances and any specific/overriding attributes to be created.

Show instances object attributes

apply_immediately

bool

Specifies whether any instance modifications are applied immediately.

auto_minor_version_upgrade

bool

Indicates that minor engine upgrades will be applied automatically during the maintenance window.

availability_zone

string

EC2 Availability Zone that the DB instance is created in.

ca_cert_identifier

string

Identifier of the CA certificate for the DB instance.

copy_tags_to_snapshot

bool

default:"true"

Copy all instance tags to snapshots.

custom_iam_instance_profile

string

Instance profile associated with the underlying Amazon EC2 instance of an RDS Custom DB instance.

db_parameter_group_name

string

Name of the DB parameter group to associate with this instance.

db_subnet_group_name

string

DB subnet group to associate with this DB instance.

identifier

string

Identifier for the RDS instance.

identifier_prefix

string

Creates a unique identifier beginning with the specified prefix.

instance_class

string

Instance class to use. For details see http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.DBInstanceClass.html.

monitoring_interval

number

Interval, in seconds, between points when Enhanced Monitoring metrics are collected for the DB instance.

monitoring_role_arn

string

ARN for the IAM role that permits RDS to send enhanced monitoring metrics to CloudWatch Logs.

performance_insights_enabled

bool

Specifies whether Performance Insights are enabled for this instance.

performance_insights_kms_key_id

string

ARN for the KMS key to encrypt Performance Insights data.

performance_insights_retention_period

number

Amount of time in days to retain Performance Insights data. Valid values: 7, 731, or month * 31 (1–23 months).

preferred_maintenance_window

string

Window to perform maintenance in (UTC), e.g. Mon:00:00-Mon:03:00.

promotion_tier

number

Failover priority for the instance. 0 is the highest priority.

publicly_accessible

bool

Whether the DB should be publicly accessible.

tags

map(string)

default:"{}"

Instance-level tags.

instances_use_identifier_prefix

bool

default:"false"

Determines whether cluster instance identifiers are used as prefixes.

instance_timeouts

object

default:"null"

Create, update, and delete timeout configurations for the cluster instance(s).

Show instance_timeouts attributes

create

string

Timeout for instance creation, e.g. "90m".

update

string

Timeout for instance update, e.g. "90m".

delete

string

Timeout for instance deletion, e.g. "90m".

Cluster Endpoints

endpoints

map(object)

default:"{}"

Map of additional cluster endpoints and their attributes to be created.

Show endpoints object attributes

identifier

string

required

Identifier for the endpoint.

type

string

required

Type of endpoint. Valid values: READER, ANY.

excluded_members

list(string)

List of DB instance identifiers that are not part of the custom endpoint group.

static_members

list(string)

List of DB instance identifiers that are part of the custom endpoint group.

tags

map(string)

default:"{}"

Tags for this endpoint.

IAM Role Associations

role_associations

map(object)

default:"{}"

Map of IAM roles and supported feature names to associate with the cluster.

Show role_associations object attributes

role_arn

string

required

ARN of the IAM role to associate with the cluster.

feature_name

string

Name of the feature for association. Valid values: s3Export, s3Import, SageMaker, Lambda.

Enhanced Monitoring

create_monitoring_role

bool

default:"true"

Determines whether to create the IAM role for RDS enhanced monitoring.

monitoring_role_arn

string

default:"\"\""

IAM role used by RDS to send enhanced monitoring metrics to CloudWatch. Provide an existing ARN to skip role creation.

iam_role_name

string

default:"null"

Friendly name of the monitoring role.

iam_role_use_name_prefix

bool

default:"false"

Determines whether to use iam_role_name as-is or create a unique name beginning with iam_role_name as the prefix.

iam_role_description

string

default:"null"

Description of the monitoring role.

iam_role_path

string

default:"null"

Path for the monitoring role.

iam_role_permissions_boundary

string

default:"null"

The ARN of the policy used to set the permissions boundary for the monitoring role.

iam_role_max_session_duration

number

default:"null"

Maximum session duration (in seconds) to set for the monitoring role.

Autoscaling

autoscaling_enabled

bool

default:"false"

Determines whether autoscaling of the cluster read replicas is enabled.

autoscaling_max_capacity

number

default:"2"

Maximum number of read replicas permitted when autoscaling is enabled.

autoscaling_min_capacity

number

default:"0"

Minimum number of read replicas permitted when autoscaling is enabled.

autoscaling_policy_name

string

default:"\"target-metric\""

Autoscaling policy name.

predefined_metric_type

string

default:"\"RDSReaderAverageCPUUtilization\""

The metric type to scale on. Valid values: RDSReaderAverageCPUUtilization, RDSReaderAverageDatabaseConnections.

autoscaling_scale_in_cooldown

number

default:"300"

Cooldown in seconds before allowing further scaling operations after a scale in.

autoscaling_scale_out_cooldown

number

default:"300"

Cooldown in seconds before allowing further scaling operations after a scale out.

autoscaling_target_cpu

number

default:"70"

CPU threshold which will initiate autoscaling.

autoscaling_target_connections

number

default:"700"

Average number of connections threshold which will initiate autoscaling. Default value is 70% of db.r4/r5/r6g.large’s default max_connections.

Security Group

create_security_group

bool

default:"true"

Determines whether to create security group for RDS cluster.

security_group_name

string

default:"\"\""

The security group name. Defaults to var.name.

security_group_use_name_prefix

bool

default:"true"

Determines whether the security group name (var.name) is used as a prefix.

security_group_description

string

default:"null"

The description of the security group. If set to an empty string it will contain the cluster name in the description.

vpc_id

string

default:"\"\""

ID of the VPC where the security group will be created.

vpc_security_group_ids

list(string)

default:"[]"

List of VPC security groups to associate to the cluster in addition to the security group created.

security_group_ingress_rules

map(object)

default:"{}"

Map of security group ingress rules to add to the security group created.

Show security_group_ingress_rules object attributes

name

string

Name of the rule.

cidr_ipv4

string

IPv4 CIDR block.

cidr_ipv6

string

IPv6 CIDR block.

description

string

Description of the rule.

from_port

number

Start of port range for the TCP/UDP protocol.

ip_protocol

string

default:"\"tcp\""

IP protocol name or number.

prefix_list_id

string

ID of the prefix list.

referenced_security_group_id

string

ID of the security group to allow traffic from/to.

region

string

Region for the rule.

tags

map(string)

default:"{}"

Tags for this rule.

to_port

number

End of port range for the TCP/UDP protocol.

security_group_egress_rules

map(object)

default:"{}"

Map of security group egress rules to add to the security group created. Uses the same object schema as security_group_ingress_rules.

Show security_group_egress_rules object attributes

name

string

Name of the rule.

cidr_ipv4

string

IPv4 CIDR block.

cidr_ipv6

string

IPv6 CIDR block.

description

string

Description of the rule.

from_port

number

Start of port range for the TCP/UDP protocol.

ip_protocol

string

default:"\"tcp\""

IP protocol name or number.

prefix_list_id

string

ID of the prefix list.

referenced_security_group_id

string

ID of the security group to allow traffic from/to.

region

string

Region for the rule.

tags

map(string)

default:"{}"

Tags for this rule.

to_port

number

End of port range for the TCP/UDP protocol.

security_group_tags

map(string)

default:"{}"

Additional tags for the security group.

Parameter Groups

cluster_parameter_group_name

string

default:"null"

The name of an existing DB cluster parameter group. Required when cluster_parameter_group is not provided.

cluster_parameter_group

object

default:"null"

Map of nested arguments for the created DB cluster parameter group.

Show cluster_parameter_group attributes

family

string

required

The family of the DB cluster parameter group, e.g. aurora-mysql8.0.

name

string

Name of the parameter group.

use_name_prefix

bool

default:"true"

Whether to use name as a prefix.

description

string

Description for the parameter group.

parameters

list(object)

List of parameters to apply.

Show parameters list item attributes

name

string

required

Name of the parameter.

value

string

required

Value of the parameter.

apply_method

string

default:"\"immediate\""

Apply method. Valid values: immediate, pending-reboot.

db_parameter_group

object

default:"null"

Map of nested arguments for the created DB parameter group.

Show db_parameter_group attributes

family

string

required

The family of the DB parameter group, e.g. aurora-mysql8.0.

name

string

Name of the parameter group.

use_name_prefix

bool

default:"true"

Whether to use name as a prefix.

description

string

Description for the parameter group.

parameters

list(object)

List of parameters to apply.

Show parameters list item attributes

name

string

required

Name of the parameter.

value

string

required

Value of the parameter.

apply_method

string

default:"\"immediate\""

Apply method. Valid values: immediate, pending-reboot.

CloudWatch Logs

enabled_cloudwatch_logs_exports

list(string)

default:"[]"

Set of log types to export to CloudWatch. The following log types are supported: audit, error, general, slowquery, postgresql.

create_cloudwatch_log_group

bool

default:"false"

Determines whether a CloudWatch log group is created for each enabled_cloudwatch_logs_exports.

cloudwatch_log_group_retention_in_days

number

default:"7"

The number of days to retain CloudWatch logs for the DB instance.

cloudwatch_log_group_kms_key_id

string

default:"null"

The ARN of the KMS Key to use when encrypting log data.

cloudwatch_log_group_skip_destroy

bool

default:"null"

Set to true to remove the log group from Terraform state at destroy time without deleting it from CloudWatch.

cloudwatch_log_group_class

string

default:"null"

Specifies the log class of the log group. Possible values: STANDARD, INFREQUENT_ACCESS.

cloudwatch_log_group_tags

map(string)

default:"{}"

Additional tags for the CloudWatch log group(s).

Activity Stream

cluster_activity_stream

object

default:"null"

Map of arguments for the created DB cluster activity stream.

Show cluster_activity_stream attributes

kms_key_id

string

required

The ARN of the KMS key used to encrypt the activity stream.

mode

string

required

Specifies the mode of the database activity stream. Valid values: async, sync.

include_audit_fields

bool

default:"false"

Whether to include the original unfiltered audit log events when the activity stream is running in synchronous mode.

Secrets Management

manage_master_user_password_rotation

bool

default:"false"

Whether to manage the master user password rotation. Setting this to false after previously being true will disable automatic rotation.

master_user_password_rotate_immediately

bool

default:"null"

Specifies whether to rotate the secret immediately or wait until the next scheduled rotation window.

master_user_password_rotation_automatically_after_days

number

default:"null"

Specifies the number of days between automatic scheduled rotations of the secret. Either this or master_user_password_rotation_schedule_expression must be specified.

master_user_password_rotation_duration

string

default:"null"

The length of the rotation window in hours, e.g. 3h for a three-hour window.

master_user_password_rotation_schedule_expression

string

default:"null"

A cron() or rate() expression that defines the schedule for rotating the secret. Either this or master_user_password_rotation_automatically_after_days must be specified.

Shard Group

shard_group

object

default:"null"

Arguments for the DB shard group to be created.

Show shard_group attributes

identifier

string

required

Identifier for the shard group.

max_acu

number

required

Maximum capacity of the shard group in Aurora Capacity Units (ACUs).

compute_redundancy

number

Compute redundancy setting for the shard group.

min_acu

number

Minimum capacity of the shard group in Aurora Capacity Units (ACUs).

publicly_accessible

bool

Whether the shard group should be publicly accessible.

tags

map(string)

default:"{}"

Tags for the shard group.

timeouts

object

Create, update, and delete timeout configuration for the shard group.

Show timeouts attributes

create

string

Timeout for shard group creation.

update

string

Timeout for shard group update.

delete

string

Timeout for shard group deletion.

Module Reference

Submodules

Build docs developers (and LLMs) love