Skip to main content
The root module (terraform-aws-modules/rds/aws) accepts the following input variables. Only identifier is required; all other variables have defaults.
​
identifier
string
required
The name of the RDS instance. Used as the base name for all related resources.
​
instance_use_identifier_prefix
bool
Determines whether to use identifier as-is or create a unique identifier beginning with identifier as the specified prefix.Default: false
​
engine
string
The database engine to use (e.g. mysql, postgres, oracle-se2, sqlserver-ex).Default: null
​
engine_version
string
The engine version to use (e.g. 8.0.35, 15.4).Default: null
​
engine_lifecycle_support
string
The life cycle type for this DB instance. Applies only to RDS for MySQL and RDS for PostgreSQL. Valid values: open-source-rds-extended-support, open-source-rds-extended-support-disabled. AWS default is open-source-rds-extended-support.Default: null
​
instance_class
string
The instance type of the RDS instance (e.g. db.t3.micro, db.r6g.large).Default: null
​
allocated_storage
number
The allocated storage in gigabytes.Default: null
​
storage_type
string
One of standard (magnetic), gp2 (general purpose SSD), gp3 (new generation of general purpose SSD), or io1 (provisioned IOPS SSD). The default is io1 if iops is specified, gp2 if not. If you specify io1 or gp3, you must also include a value for the iops parameter.Default: null
​
storage_encrypted
bool
Specifies whether the DB instance is encrypted.Default: true
​
kms_key_id
string
The ARN for the KMS encryption key. If creating an encrypted replica, set this to the destination KMS ARN. If storage_encrypted is set to true and kms_key_id is not specified, the default KMS key created in your account will be used. Use the full ARN, not a key alias.Default: null
​
max_allocated_storage
number
Specifies the value for Storage Autoscaling. Set to a value greater than allocated_storage to enable autoscaling. Set to 0 to disable.Default: 0
​
storage_throughput
number
Storage throughput value for the DB instance. See notes for limitations regarding this variable for gp3.Default: null
​
iops
number
The amount of provisioned IOPS. Setting this implies a storage_type of io1 or gp3. See notes for limitations regarding this variable for gp3.Default: null
​
dedicated_log_volume
bool
Use a dedicated log volume (DLV) for the DB instance. Requires Provisioned IOPS.Default: false
​
db_name
string
The DB name to create. If omitted, no database is created initially.Default: null
​
username
string
Username for the master DB user.Default: null
​
password_wo
string
Write-only password for the master DB user. Required unless manage_master_user_password is set to true, or snapshot_identifier / replicate_source_db is provided. This is a sensitive, ephemeral variable — it will not be stored in Terraform state.Default: null
​
password_wo_version
number
Used together with password_wo to trigger an update. Increment this value when a password change is required.Default: null
​
port
string
The port on which the DB accepts connections. Defaults to the engine default if not specified.Default: null
​
character_set_name
string
The character set name to use for DB encoding in Oracle instances. Cannot be changed after creation. See Oracle Character Sets Supported in Amazon RDS and Collations and Character Sets for Microsoft SQL Server for more information.Default: null
​
nchar_character_set_name
string
The national character set used in the NCHAR, NVARCHAR2, and NCLOB data types for Oracle instances. Cannot be changed after creation.Default: null
​
timezone
string
Time zone of the DB instance. Currently only supported by Microsoft SQL Server. Can only be set on creation.Default: null
​
license_model
string
License model information for this DB instance. Optional, but required for some DB engines (e.g. Oracle SE1). Valid values: license-included, bring-your-own-license, general-public-license.Default: null
​
manage_master_user_password
bool
Set to true to allow RDS to manage the master user password in Secrets Manager. Cannot be set if password_wo is provided.Default: true
​
master_user_secret_kms_key_id
string
The key ARN, key ID, alias ARN, or alias name for the KMS key to encrypt the master user password secret in Secrets Manager. If not specified, the default KMS key for your AWS account is used.Default: null
​
manage_master_user_password_rotation
bool
Whether to manage the master user password rotation. By default, rotation is managed by RDS on creation. Setting this value to false after previously having been set to true will disable automatic rotation.Default: false
​
master_user_password_rotate_immediately
bool
Specifies whether to rotate the secret immediately or wait until the next scheduled rotation window.Default: null
​
master_user_password_rotation_automatically_after_days
number
Specifies the number of days between automatic scheduled rotations of the secret. Either automatically_after_days or schedule_expression must be specified.Default: null
​
master_user_password_rotation_duration
string
The length of the rotation window in hours (e.g. 3h for a three-hour window).Default: null
​
master_user_password_rotation_schedule_expression
string
A cron() or rate() expression that defines the schedule for rotating your secret. Either automatically_after_days or schedule_expression must be specified.Default: null
​
iam_database_authentication_enabled
bool
Specifies whether IAM database authentication is enabled, which allows IAM users and roles to authenticate to the DB instance.Default: false
​
vpc_security_group_ids
list(string)
List of VPC security group IDs to associate with the DB instance.Default: []
​
publicly_accessible
bool
Bool to control if instance is publicly accessible. When false, the instance can only be accessed from within the VPC.Default: false
​
multi_az
bool
Specifies if the RDS instance is multi-AZ. Enables high availability with an automatic failover standby in a different Availability Zone.Default: false
​
availability_zone
string
The Availability Zone of the RDS instance. Cannot be set when multi_az is true.Default: null
​
network_type
string
The type of network stack to use. Valid values: IPV4, DUAL.Default: null
​
customer_owned_ip_enabled
bool
Indicates whether to enable a customer-owned IP address (CoIP) for an RDS on Outposts DB instance.Default: null
​
create_db_subnet_group
bool
Whether to create a database subnet group. If false, db_subnet_group_name must reference an existing subnet group.Default: false
​
db_subnet_group_name
string
Name of the DB subnet group. The DB instance will be created in the VPC associated with this group. If unspecified, the instance will be created in the default VPC.Default: null
​
db_subnet_group_use_name_prefix
bool
Determines whether to use db_subnet_group_name as-is or create a unique name beginning with db_subnet_group_name as the prefix.Default: true
​
db_subnet_group_description
string
Description of the DB subnet group to create.Default: null
​
subnet_ids
list(string)
A list of VPC subnet IDs to use when creating the DB subnet group.Default: []
​
create_db_parameter_group
bool
Whether to create a database parameter group.Default: true
​
parameter_group_name
string
Name of the DB parameter group to associate or create.Default: null
​
parameter_group_use_name_prefix
bool
Determines whether to use parameter_group_name as-is or create a unique name beginning with parameter_group_name as the prefix.Default: true
​
parameter_group_description
string
Description of the DB parameter group to create.Default: null
​
family
string
The family of the DB parameter group (e.g. mysql8.0, postgres15).Default: null
​
parameters
list(object)
A list of DB parameters to apply to the parameter group.Default: null
​
parameter_group_skip_destroy
bool
Set to true if you do not wish the parameter group to be deleted at destroy time. The parameter group is instead removed from Terraform state only.Default: null
​
create_db_option_group
bool
Whether to create a database option group.Default: true
​
option_group_name
string
Name of the option group to associate or create.Default: null
​
option_group_use_name_prefix
bool
Determines whether to use option_group_name as-is or create a unique name beginning with option_group_name as the prefix.Default: true
​
option_group_description
string
The description of the option group.Default: null
​
major_engine_version
string
Specifies the major version of the engine that this option group should be associated with (e.g. 8.0, 15).Default: null
​
options
list(object)
A list of options to apply to the option group.Default: null
​
option_group_skip_destroy
bool
Set to true if you do not wish the option group to be deleted at destroy time. The option group is instead removed from Terraform state only.Default: null
​
backup_retention_period
number
The number of days to retain automated backups. Must be between 0 and 35. Set to 0 to disable automated backups.Default: null
​
backup_window
string
The daily time range (in UTC) during which automated backups are created if they are enabled. Format: HH:MM-HH:MM (e.g. 09:46-10:16). Must not overlap with maintenance_window.Default: null
​
copy_tags_to_snapshot
bool
On delete, copy all instance tags to the final snapshot.Default: true
​
skip_final_snapshot
bool
Determines whether a final DB snapshot is created before the DB instance is deleted. If true, no snapshot is created.Default: false
​
final_snapshot_identifier_prefix
string
The prefix for the final snapshot identifier on cluster destroy. The full identifier will be {prefix}-{identifier}-{random_hex}.Default: "final"
​
delete_automated_backups
bool
Specifies whether to remove automated backups immediately after the DB instance is deleted.Default: true
​
snapshot_identifier
string
Specifies whether or not to create this database from a snapshot. This correlates to the snapshot ID shown in the RDS console (e.g. rds:production-2015-06-26-06-05).Default: null
​
restore_to_point_in_time
object
Restore to a point in time. MySQL is not supported.Default: null
​
s3_import
object
Restore from a Percona Xtrabackup stored in S3. Only MySQL is supported.Default: null
​
maintenance_window
string
The window to perform maintenance in. Format: ddd:hh24:mi-ddd:hh24:mi (e.g. Mon:00:00-Mon:03:00).Default: null
​
apply_immediately
bool
Specifies whether any database modifications are applied immediately or during the next maintenance window.Default: false
​
allow_major_version_upgrade
bool
Indicates that major version upgrades are allowed. Changing this parameter does not result in an outage.Default: false
​
auto_minor_version_upgrade
bool
Indicates that minor engine upgrades will be applied automatically during the maintenance window.Default: true
​
blue_green_update
object
Enables low-downtime updates using RDS Blue/Green deployments. When enabled, backup_retention_period must be at least 1.Default: null
​
upgrade_storage_config
bool
Whether to upgrade the storage file system configuration on the read replica. Can only be set with replicate_source_db.Default: null
​
monitoring_interval
number
The interval in seconds between points when Enhanced Monitoring metrics are collected for the DB instance. To disable, specify 0. Valid values: 0, 1, 5, 10, 15, 30, 60.Default: 0
​
monitoring_role_arn
string
The ARN for the IAM role that permits RDS to send enhanced monitoring metrics to CloudWatch Logs. Must be specified if monitoring_interval is non-zero and create_monitoring_role is false.Default: null
​
monitoring_role_name
string
Name of the IAM role which will be created when create_monitoring_role is enabled.Default: "rds-monitoring-role"
​
monitoring_role_use_name_prefix
bool
Determines whether to use monitoring_role_name as-is or create a unique identifier beginning with monitoring_role_name as the prefix.Default: false
​
monitoring_role_description
string
Description of the monitoring IAM role.Default: null
​
create_monitoring_role
bool
Create an IAM role with a defined name that permits RDS to send enhanced monitoring metrics to CloudWatch Logs.Default: false
​
monitoring_role_permissions_boundary
string
ARN of the policy used to set the permissions boundary for the monitoring IAM role.Default: null
​
performance_insights_enabled
bool
Specifies whether Performance Insights are enabled.Default: false
​
performance_insights_retention_period
number
The amount of time in days to retain Performance Insights data. Valid values: 7, 731 (2 years), or a multiple of 31.Default: 7
​
performance_insights_kms_key_id
string
The ARN for the KMS key to encrypt Performance Insights data.Default: null
​
database_insights_mode
string
The mode of Database Insights enabled for the instance. Valid values: standard, advanced.Default: null
​
enabled_cloudwatch_logs_exports
list(string)
List of log types to export to CloudWatch Logs. Valid values depend on the engine: alert, audit, error, general, listener, slowquery, trace, postgresql (PostgreSQL only), upgrade (PostgreSQL only).Default: []
​
create_cloudwatch_log_group
bool
Determines whether a CloudWatch log group is created for each entry in enabled_cloudwatch_logs_exports. Log groups are not created when using an identifier prefix.Default: false
​
cloudwatch_log_group_retention_in_days
number
The number of days to retain CloudWatch logs for the DB instance.Default: 7
​
cloudwatch_log_group_kms_key_id
string
The ARN of the KMS key to use when encrypting CloudWatch log data.Default: null
​
cloudwatch_log_group_skip_destroy
bool
Set to true if you do not wish the log group (and any logs it may contain) to be deleted at destroy time. The log group is instead removed from Terraform state only.Default: null
​
cloudwatch_log_group_class
string
The log class of the log group. Possible values: STANDARD, INFREQUENT_ACCESS.Default: null
​
deletion_protection
bool
The database cannot be deleted when this value is set to true. To delete the instance, set this to false and apply before destroying.Default: false
​
ca_cert_identifier
string
Specifies the identifier of the CA certificate for the DB instance (e.g. rds-ca-rsa2048-g1).Default: null
​
custom_iam_instance_profile
string
RDS custom IAM instance profile name.Default: null
​
domain
string
The ID of the Directory Service Active Directory domain to create the instance in (e.g. d-1234567890). Conflicts with domain_fqdn and domain_auth_secret_arn.Default: null
​
domain_auth_secret_arn
string
The ARN for the Secrets Manager secret with the self-managed Active Directory credentials for the user joining the domain. Required if domain_fqdn is provided. Conflicts with domain and domain_iam_role_name.Default: null
​
domain_dns_ips
list(string)
The IPv4 DNS IP addresses of your primary and secondary self-managed Active Directory domain controllers. Two IP addresses must be provided. Required if domain_fqdn is provided. Conflicts with domain and domain_iam_role_name.Default: null
​
domain_fqdn
string
The fully qualified domain name (FQDN) of the self-managed Active Directory domain. Conflicts with domain and domain_iam_role_name.Default: null
​
domain_iam_role_name
string
The name of the IAM role to be used when making API calls to the Directory Service. Required if domain is provided.Default: null
​
domain_ou
string
The self-managed Active Directory organizational unit for the DB instance to join. Required if domain_fqdn is provided. Conflicts with domain and domain_iam_role_name.Default: null
​
replicate_source_db
string
Specifies that this resource is a read replica, and designates the source DB instance identifier to replicate from. When set, many configuration values are inherited from the source instance.Default: null
​
replica_mode
string
Specifies whether the replica is in mounted or open-read-only mode. Only supported by Oracle instances.Default: null
​
db_instance_role_associations
map(string)
A map of DB instance supported feature names to IAM role ARNs. The module creates one aws_db_instance_role_association resource for each map entry.Default: {}Example:
db_instance_role_associations = {
  s3_integration = "arn:aws:iam::123456789012:role/rds-s3-integration-role"
}
​
tags
map(string)
A mapping of tags to assign to all resources created by this module.Default: {}
​
db_instance_tags
map(string)
Additional tags for the DB instance only. Merged with tags.Default: {}
​
db_subnet_group_tags
map(string)
Additional tags for the DB subnet group only. Merged with tags.Default: {}
​
db_parameter_group_tags
map(string)
Additional tags for the DB parameter group only. Merged with tags.Default: {}
​
db_option_group_tags
map(string)
Additional tags for the DB option group only. Merged with tags.Default: {}
​
cloudwatch_log_group_tags
map(string)
Additional tags for the CloudWatch log group(s) only. Merged with tags.Default: {}
​
timeouts
object
Updated Terraform resource management timeouts for aws_db_instance. Use to permit longer resource management times for slow operations.Default: null
​
option_group_timeouts
object
Define the maximum timeout for deletion of the aws_db_option_group resource.Default: null
​
region
string
Region where this resource will be managed. Defaults to the region set in the provider configuration. Useful for multi-region deployments.Default: null

Build docs developers (and LLMs) love

Get started for freeTalk to us