SquareOps Technologies Your DevOps Partner for Accelerating cloud journey.
This Terraform module provides a convenient way to create and manage an Amazon Aurora RDS (Relational Database Service) cluster in AWS. It supports creating both Aurora MySQL and Aurora PostgreSQL clusters. Features
- Creates an Amazon Aurora RDS cluster with customizable configuration.
- Supports both Aurora MySQL and Aurora PostgreSQL engine types.
- Allows for easy management of database instances, replicas, and failover.
- Configurable backup retention periods and preferred backup/maintenance windows.
- Option to enable encryption at rest using AWS Key Management Service (KMS).
- Flexible configuration for database parameter groups and security groups.
- Supports provisioning in existing VPCs and subnets.
- Enables autoscaling for Aurora MySQL read replicas.
- Support for serverless Aurora PostgreSQL and performance insights.
- Replication: Replicate data from another Amazon RDS database by specifying the source database identifier.
- Snapshot Restore: Restore the database from a specified snapshot ID to easily recreate database instances.
module "aurora" {
source = "squareops/rds-aurora/aws"
version = "2.1.1"
role_arn = local.role_arn
external_id = local.external_id
environment = local.environment
port = local.port
vpc_id = module.vpc.vpc_id
family = local.family
subnets = module.vpc.database_subnets
engine = local.engine
engine_version = local.db_engine_version
rds_instance_name = local.name
create_security_group = true
instance_type = local.db_instance_class
storage_encrypted = true
kms_key_arn = module.kms.key_arn
publicly_accessible = false
master_username = "devuser"
database_name = "devdb"
apply_immediately = true
create_random_password = true
skip_final_snapshot = true # Keeping final snapshot results in retention of DB options group and hence creates problems during destroy. So use this option wisely.
snapshot_identifier = null
preferred_backup_window = "03:00-06:00"
preferred_maintenance_window = "Mon:00:00-Mon:03:00"
final_snapshot_identifier_prefix = "prod-snapshot"
backup_retention_period = 7
enable_ssl_connection = false
autoscaling_enabled = true
autoscaling_max = 4
autoscaling_min = 1
long_query_time = 10
deletion_protection = false
predefined_metric_type = "RDSReaderAverageDatabaseConnections"
autoscaling_target_connections = 40
autoscaling_scale_in_cooldown = 60
autoscaling_scale_out_cooldown = 30
allowed_cidr_blocks = local.allowed_cidr_blocks
allowed_security_groups = local.allowed_security_groups
}Security scanning is graciously provided by Prowler. Proowler is the leading fully hosted, cloud-native solution providing continuous cluster security and compliance.
| Benchmark | Description |
|---|---|
| Ensure that encryption is enabled for RDS instances | Enabled for RDS created using this module. |
| Name | Version |
|---|---|
| terraform | >= 1.0 |
| aws | >= 4.30 |
| Name | Version |
|---|---|
| aws | >= 4.30 |
| aws.secondary | >= 4.30 |
| random | n/a |
| Name | Source | Version |
|---|---|---|
| aurora | terraform-aws-modules/rds-aurora/aws | 8.3.0 |
| aurora_secondary | terraform-aws-modules/rds-aurora/aws | 8.3.0 |
| Name | Type |
|---|---|
| aws_db_parameter_group.rds_parameter_group | resource |
| aws_rds_cluster_parameter_group.rds_cluster_parameter_group | resource |
| aws_rds_global_cluster.this | resource |
| aws_secretsmanager_secret.secret_master_db | resource |
| aws_secretsmanager_secret_version.rds_credentials | resource |
| random_password.master | resource |
| aws_availability_zones.primary | data source |
| aws_availability_zones.secondary | data source |
| aws_caller_identity.current | data source |
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| allow_major_version_upgrade | Determines whether major engine upgrades are allowed when changing engine version | bool |
false |
no |
| allowed_cidr_blocks | A list of CIDR blocks which are allowed to access the database | any |
[] |
no |
| allowed_security_groups | A list of Security Group IDs to allow access to the database | any |
[] |
no |
| apply_immediately | Specifies whether any cluster modifications are applied immediately or during the next maintenance window | bool |
false |
no |
| autoscaling_cpu | CPU usage to trigger autoscaling at | number |
70 |
no |
| autoscaling_enabled | Whether to enable autoscaling for RDS Aurora (MySQL) read replicas | bool |
false |
no |
| autoscaling_max | Maximum number of replicas to allow scaling for | number |
3 |
no |
| autoscaling_min | Minimum number of replicas to allow scaling for | number |
1 |
no |
| autoscaling_scale_in_cooldown | Cooldown in seconds before allowing further scaling operations after a scale in | number |
300 |
no |
| autoscaling_scale_out_cooldown | Cooldown in seconds before allowing further scaling operations after a scale out | number |
300 |
no |
| autoscaling_target_connections | No of connections on which aurora has to scale if predefined_metric_type is RDSReaderAverageDatabaseConnections | number |
50 |
no |
| backup_retention_period | The number of days to retain backups for | number |
null |
no |
| create_monitoring_role | Set it to true to create IAM role for Enhanced monitoring. | bool |
false |
no |
| create_random_password | Whether to create a random password for the primary database cluster | bool |
true |
no |
| create_security_group | Whether to create a security group or not | bool |
true |
no |
| database_name | The name for an automatically created database on cluster creation | string |
"" |
no |
| deletion_protection | Whether accidental deletion protection is enabled | bool |
true |
no |
| enable_egress | Set it true if allow outbound traffic in rds security group | bool |
true |
no |
| enable_http_endpoint | Whether or not to enable the Data API for a serverless Aurora database engine | bool |
false |
no |
| enable_ssl_connection | Whether or not to enable the ssl connection | bool |
false |
no |
| engine | The name of the database engine to be used for this DB cluster | string |
"aurora" |
no |
| engine_mode | The database engine mode. Valid values: global, parallelquery, provisioned, serverless, multimaster | string |
"provisioned" |
no |
| engine_version | The database engine version. Updating this argument results in an outage. | string |
"" |
no |
| environment | Select enviroment type: dev, demo, prod | string |
"demo" |
no |
| external_id | External ID for assuming role. | string |
"" |
no |
| family | Version of aurora DB family being created | string |
"aurora-mysql5.7" |
no |
| final_snapshot_identifier_prefix | The prefix name to use when creating a final snapshot on cluster destroy, appends a random 8 digits to name to ensure it's unique too. | string |
"final" |
no |
| global_cluster_enable | Whether enable global cluster then set it to true | bool |
false |
no |
| global_cluster_identifier | Global RDS Cluster Identifier name | string |
null |
no |
| iam_database_authentication_enabled | Specifies whether or mappings of AWS Identity and Access Management (IAM) accounts to database accounts is enabled | bool |
null |
no |
| instance_type | Instance type | string |
"db.m5.large" |
no |
| instances_config | Map of cluster instances and any specific/overriding attributes to be created | map(any) |
{ |
no |
| kms_key_arn | The ARN for the KMS encryption key. If creating an encrypted replica, set this to the destination KMS ARN. If storage_encrypted is set to true and kms_key_id is not specified the default KMS key created in your account will be used | string |
null |
no |
| long_query_time | To prevent fast-running queries from being logged in the slow query log, specify a value for the shortest query runtime to be logged, in seconds | number |
10 |
no |
| manage_master_user_password | Set to true to allow RDS to manage the master user password in Secrets Manager. Cannot be set if master_password is provided |
bool |
false |
no |
| master_username | The username for the primary cluster | string |
"root" |
no |
| monitoring_interval | The interval, in seconds, between points when Enhanced Monitoring metrics are collected for instances. Set to 0 to disble. Default is 0 | number |
0 |
no |
| performance_insights_enabled | Specifies whether Performance Insights is enabled or not | bool |
null |
no |
| performance_insights_kms_key_id | ARN of KMS key to encrypt performance insights data. | string |
null |
no |
| performance_insights_retention_period | Retention period for performance insights data, Either 7 (7 days) or 731 (2 years). | number |
null |
no |
| port | The port for the database | number |
3306 |
no |
| predefined_metric_type | The metric type to scale on. Valid values are RDSReaderAverageCPUUtilization and RDSReaderAverageDatabaseConnections | string |
"RDSReaderAverageDatabaseConnections" |
no |
| preferred_backup_window | The maintenance window for performing database backup | string |
"" |
no |
| preferred_maintenance_window | The maintenance window for performing database maintenance | string |
"" |
no |
| publicly_accessible | Specifies whether the database is publicly accessible over the internet | bool |
false |
no |
| random_password_length | The length of the randomly generated password. (default: 10) | number |
16 |
no |
| rds_instance_name | The name of the RDS instance | string |
"" |
no |
| region | AWS region name where the primary RDS resources will be deployed | string |
null |
no |
| role_arn | The ARN of the role to assume. Leave empty if not using assume role. | string |
"" |
no |
| scaling_configuration | Map of nested attributes with scaling properties. Only valid when engine_mode is set to serverless |
map(string) |
{} |
no |
| secondary_kms_key_arn | The ARN for the secondary region KMS encryption key. If creating an encrypted replica, set this to the destination KMS ARN. If storage_encrypted is set to true and kms_key_id is not specified the default KMS key created in your account will be used | string |
null |
no |
| secondary_region | Secondary AWS region name where the Secondary RDS and VPC resources will be deployed | string |
null |
no |
| secondary_subnets | List of subnet IDs used by database subnet group created in secondary region | list(string) |
[] |
no |
| secondary_vpc_allowed_cidr_blocks | A list of CIDR blocks which are allowed to access the database | any |
[] |
no |
| secondary_vpc_allowed_security_groups | A list of Security Group IDs to allow access to the database | any |
[] |
no |
| secondary_vpc_id | The secondary VPC in which secondary RDS will be launched | string |
"" |
no |
| security_group_description | The description of the security group. If value is set to empty string it will contain cluster name in the description | string |
"RDS Aurora SG managed by Terraform" |
no |
| security_group_rules | Map of security group rules to add to the cluster security group created | any |
{} |
no |
| serverlessv2_scaling_configuration | Map of nested attributes with serverless v2 scaling properties. Only valid when engine_mode is set to provisioned | map(string) |
{} |
no |
| skip_final_snapshot | Determines whether a final DB snapshot is created before the DB instance is deleted. If true is specified, no DBSnapshot is created. If false is specified, a DB snapshot is created before the DB instance is deleted, using the value from final_snapshot_identifier | bool |
true |
no |
| snapshot_identifier | DB snapshot to create this database from | string |
"" |
no |
| storage_encrypted | Allow Database encryption or not | bool |
true |
no |
| subnets | List of subnet IDs used by database subnet group created | list(string) |
[] |
no |
| vpc_id | In which VPC do you want to deploy the RDS cluster | string |
"" |
no |
| Name | Description |
|---|---|
| rds_cluster_endpoint | The endpoint URL of the Aurora cluster |
| rds_cluster_master_password | The master password for the Aurora cluster |
| rds_cluster_master_username | The master username for the Aurora cluster |
| rds_cluster_reader_endpoint | The reader endpoint URL of the Aurora cluster |
| secondary_rds_cluster_endpoint | The endpoint URL of the Aurora cluster secondary instance |
| secondary_rds_cluster_reader_endpoint | A read-only endpoint for the cluster, automatically load-balanced across replicas |
| security_group_id | The security group ID associated with the Aurora cluster |
To report an issue with a project:
- Check the repository's issue tracker on GitHub
- Search to check if the issue has already been reported
- If you can't find an answer to your question in the documentation or issue tracker, you can ask a question by creating a new issue. Make sure to provide enough context and details.
Apache License, Version 2.0, January 2004 (https://www.apache.org/licenses/LICENSE-2.0)
To support our GitHub project by liking it, you can follow these steps:
-
Visit the repository: Navigate to the GitHub repository
-
Click the "Star" button: On the repository page, you'll see a "Star" button in the upper right corner. Clicking on it will star the repository, indicating your support for the project.
-
Optionally, you can also leave a comment on the repository or open an issue to give feedback or suggest changes.
Staring a repository on GitHub is a simple way to show your support and appreciation for the project. It also helps to increase the visibility of the project and make it more discoverable to others.
We believe that the key to success in the digital age is the ability to deliver value quickly and reliably. That’s why we offer a comprehensive range of DevOps & Cloud services designed to help your organization optimize its systems & Processes for speed and agility.
- We are an AWS Advanced consulting partner which reflects our deep expertise in AWS Cloud and helping 100+ clients over the last 5 years.
- Expertise in Kubernetes and overall container solution helps companies expedite their journey by 10X.
- Infrastructure Automation is a key component to the success of our Clients and our Expertise helps deliver the same in the shortest time.
- DevSecOps as a service to implement security within the overall DevOps process and helping companies deploy securely and at speed.
- Platform engineering which supports scalable,Cost efficient infrastructure that supports rapid development, testing, and deployment.
- 24*7 SRE service to help you Monitor the state of your infrastructure and eradicate any issue within the SLA.
We provide support on all of our projects, no matter how small or large they may be.
To find more information about our company, visit squareops.com, follow us on Linkedin, or fill out a job application. If you have any questions or would like assistance with your cloud strategy and implementation, please don't hesitate to contact us.