AWS RDS Aurora Terraform module

Upstream version 10.4.1

5 controls from NIST SP 800-171 Rev 2 requirements

Terraform Module Source

nist800171.compliance.tf/terraform-aws-modules/rds-aurora/aws

Compliance Inputs Outputs Resources Rules Diff (3)README

114 unique

Name	Type	Default	Description
Enforced · locked by active controls
cloudwatch_log_group_kms_key_idlog_group_encryption_at_rest_enabled	string	null	The ARN of the KMS Key to use when encrypting log data
cloudwatch_log_group_retention_in_dayscloudwatch_log_group_retention_period_365	number	365	The number of days to retain CloudWatch logs for the DB instance
cluster_monitoring_intervalrds_db_instance_and_cluster_enhanced_monitoring_enabled	number	60	Interval, in seconds, between points when Enhanced Monitoring metrics are collected for the DB cluster. To turn off collecting Enhanced Monitoring metrics, specify 0. Valid Values: 0, 1, 5, 10, 15, 30, 60
iam_database_authentication_enabledrds_db_cluster_iam_authentication_enabled	bool	true	Specifies whether or not mappings of AWS Identity and Access Management (IAM) accounts to database accounts is enabled
Optional
allocated_storage	number	null	The amount of storage in gibibytes (GiB) to allocate to each DB instance in the Multi-AZ DB cluster. (This setting is required to create a Multi-AZ DB cluster)
allow_major_version_upgrade	bool	false	Enable to allow major engine version upgrades when changing engine versions. Defaults to `false`
apply_immediately	bool	null	Specifies whether any cluster modifications are applied immediately, or during the next maintenance window. Default is `false`
auto_minor_version_upgrade	bool	null	Whether to apply minor engine upgrades automatically to the DB cluster during the maintenance window. Defaults to `true`
autoscaling_enabled	bool	false	Determines whether autoscaling of the cluster read replicas is enabled
autoscaling_max_capacity	number	2	Maximum number of read replicas permitted when autoscaling is enabled
autoscaling_min_capacity	number	0	Minimum number of read replicas permitted when autoscaling is enabled
autoscaling_policy_name	string	"target-metric"	Autoscaling policy name
autoscaling_scale_in_cooldown	number	300	Cooldown in seconds before allowing further scaling operations after a scale in
autoscaling_scale_out_cooldown	number	300	Cooldown in seconds before allowing further scaling operations after a scale out
autoscaling_target_connections	number	700	Average number of connections threshold which will initiate autoscaling. Default value is 70% of db.r4/r5/r6g.large's default max_connections
autoscaling_target_cpu	number	70	CPU threshold which will initiate autoscaling
availability_zones	list(string)	null	List of EC2 Availability Zones for the DB cluster storage where DB cluster instances can be created. RDS automatically assigns 3 AZs if less than 3 AZs are configured, which will show as a difference requiring resource recreation next Terraform apply
backtrack_window	number	null	The target backtrack window, in seconds. Only available for `aurora` engine currently. To disable backtracking, set this value to 0. Must be between 0 and 259200 (72 hours)
backup_retention_period	number	null	The days to retain backups for
cloudwatch_log_group_class	string	null	Specified the log class of the log group. Possible values are: STANDARD or INFREQUENT_ACCESS
cloudwatch_log_group_skip_destroy	bool	null	Set to true if you do not wish the log group (and any logs it may contain) to be deleted at destroy time, and instead just remove the log group from the Terraform state
cloudwatch_log_group_tags	map(string)	{}	Additional tags for the CloudWatch log group(s)
cluster_activity_stream	object({...})	null	Map of arguments for the created DB cluster activity stream
cluster_ca_cert_identifier	string	null	The CA certificate identifier to use for the DB cluster's server certificate. Currently only supported for multi-az DB clusters
cluster_db_instance_parameter_group_name	string	null	Instance parameter group to associate with all instances of the DB cluster. The `cluster_db_instance_parameter_group_name` is only valid in combination with `allow_major_version_upgrade`
cluster_instance_class	string	null	The compute and memory capacity of each DB instance in the Multi-AZ DB cluster (not all DB instance classes are available in all AWS Regions, or for all database engines)
cluster_members	list(string)	null	List of RDS Instances that are a part of this cluster
cluster_parameter_group	object({...})	null	Map of nested arguments for the created DB cluster parameter group
cluster_parameter_group_name	string	null	The name of an existing DB cluster parameter group. Required when `cluster_parameter_group` is not provided (`null`)
cluster_performance_insights_enabled	bool	null	Enables Performance Insights for the RDS Cluster
cluster_performance_insights_kms_key_id	string	null	Specifies the KMS Key ID to encrypt Performance Insights data. If not specified, the default RDS KMS key will be used (aws/rds)
cluster_performance_insights_retention_period	number	null	Specifies the amount of time to retain performance insights data for. Defaults to 7 days if Performance Insights are enabled. Valid values are 7, month * 31 (where month is a number of months from 1-23), and 731
cluster_scalability_type	string	null	Specifies the scalability mode of the Aurora DB cluster. When set to limitless, the cluster operates as an Aurora Limitless Database. When set to standard (the default), the cluster uses normal DB instance creation. Valid values: limitless, standard
cluster_tags	map(string)	{}	A map of tags to add to only the cluster. Used for AWS Instance Scheduler tagging
cluster_timeouts	object({...})	null	Create, update, and delete timeout configurations for the cluster
cluster_use_name_prefix	bool	false	Whether to use `name` as a prefix for the cluster
copy_tags_to_snapshot	bool	true	Copy all Cluster `tags` to snapshots
create	bool	true	Whether cluster should be created (affects nearly all resources)
create_cloudwatch_log_group	bool	false	Determines whether a CloudWatch log group is created for each `enabled_cloudwatch_logs_exports`
create_db_subnet_group	bool	false	Determines whether to create the database subnet group or use existing
create_monitoring_role	bool	true	Determines whether to create the IAM role for RDS enhanced monitoring
create_security_group	bool	true	Determines whether to create security group for RDS cluster
database_insights_mode	string	null	The mode of Database Insights to enable for the DB cluster. Valid values: standard, advanced
database_name	string	null	Name for an automatically created database on cluster creation
db_parameter_group	object({...})	null	Map of nested arguments for the created DB parameter group
db_subnet_group_name	string	""	The name of the subnet group name (existing or created)
delete_automated_backups	bool	null	Specifies whether to remove automated backups immediately after the DB cluster is deleted
deletion_protection	bool	null	If the DB instance should have deletion protection enabled. The database can't be deleted when this value is set to `true`. The default is `false`
domain	string	null	The ID of the Directory Service Active Directory domain to create the instance in
domain_iam_role_name	string	null	(Required if domain is provided) The name of the IAM role to be used when making API calls to the Directory Service
enable_global_write_forwarding	bool	null	Whether cluster should forward writes to an associated global cluster. Applied to secondary clusters to enable them to forward writes to an `aws_rds_global_cluster`'s primary cluster
enable_http_endpoint	bool	null	Enable HTTP endpoint (data API). Only valid when engine_mode is set to `serverless`
enable_local_write_forwarding	bool	null	Whether read replicas can forward write operations to the writer DB instance in the DB cluster. By default, write operations aren't allowed on reader DB instances
enabled_cloudwatch_logs_exports	list(string)	[]	Set of log types to export to cloudwatch. If omitted, no logs will be exported. The following log types are supported: `audit`, `error`, `general`, `slowquery`, `postgresql`
endpoints	map({...})	{}	Map of additional cluster endpoints and their attributes to be created
engine	string	null	The name of the database engine to be used for this DB cluster. Defaults to `aurora`. Valid Values: `aurora`, `aurora-mysql`, `aurora-postgresql`
engine_lifecycle_support	string	null	The life cycle type for this DB instance. This setting is valid for cluster types Aurora DB clusters and Multi-AZ DB clusters. Valid values are `open-source-rds-extended-support`, `open-source-rds-extended-support-disabled`. Default value is `open-source-rds-extended-support`
engine_mode	string	"provisioned"	The database engine mode. Valid values: `global`, `multimaster`, `parallelquery`, `provisioned`, `serverless`. Defaults to: `provisioned`
engine_version	string	null	The database engine version. Updating this argument results in an outage
final_snapshot_identifier	string	null	The name of your final DB snapshot when this DB cluster is deleted. If omitted, no final snapshot will be made
global_cluster_identifier	string	null	The global cluster identifier specified on `aws_rds_global_cluster`
iam_role_description	string	null	Description of the monitoring role
iam_role_max_session_duration	number	null	Maximum session duration (in seconds) that you want to set for the monitoring role
iam_role_name	string	null	Friendly name of the monitoring role
iam_role_path	string	null	Path for the monitoring role
iam_role_permissions_boundary	string	null	The ARN of the policy that is used to set the permissions boundary for the monitoring role
iam_role_use_name_prefix	bool	false	Determines whether to use `iam_role_name` as is or create a unique name beginning with the `iam_role_name` as the prefix
instance_timeouts	object({...})	null	Create, update, and delete timeout configurations for the cluster instance(s)
instances	map({...})	{}	Map of cluster instances and any specific/overriding attributes to be created
instances_use_identifier_prefix	bool	false	Determines whether cluster instance identifiers are used as prefixes
iops	number	null	The amount of Provisioned IOPS (input/output operations per second) to be initially allocated for each DB instance in the Multi-AZ DB cluster
is_primary_cluster	bool	true	Determines whether cluster is primary cluster with writer instance (set to `false` for global cluster and replica clusters)
kms_key_id	string	null	The ARN for the KMS encryption key. When specifying `kms_key_id`, `storage_encrypted` needs to be set to `true`
manage_master_user_password	bool	true	Set to true to allow RDS to manage the master user password in Secrets Manager. Cannot be set if `master_password_wo` is provided
manage_master_user_password_rotation	bool	false	Whether to manage the master user password rotation. By default, false on creation, rotation is managed by RDS. There is not currently a way to disable this on initial creation even when set to false. Setting this value to false after previously having been set to true will disable automatic rotation
master_password_wo	string	null	Write-Only required unless `manage_master_user_password` is set to `true`, a `snapshot_identifier`, `replication_source_identifier`, or unless a `global_cluster_identifier` is provided when the cluster is the "secondary" cluster of a global database) Password for the master DB user
master_password_wo_version	number	null	Used together with `master_password_wo` to trigger an update. Increment this value when an update to the `master_password_wo` is required
master_user_password_rotate_immediately	bool	null	Specifies whether to rotate the secret immediately or wait until the next scheduled rotation window
master_user_password_rotation_automatically_after_days	number	null	Specifies the number of days between automatic scheduled rotations of the secret. Either `master_user_password_rotation_automatically_after_days` or `master_user_password_rotation_schedule_expression` must be specified
master_user_password_rotation_duration	string	null	The length of the rotation window in hours. For example, 3h for a three hour window
master_user_password_rotation_schedule_expression	string	null	A cron() or rate() expression that defines the schedule for rotating your secret. Either `master_user_password_rotation_automatically_after_days` or `master_user_password_rotation_schedule_expression` must be specified
master_user_secret_kms_key_id	string	null	The Amazon Web Services KMS key identifier is the key ARN, key ID, alias ARN, or alias name for the KMS key
master_username	string	null	Username for the master DB user. Required unless `snapshot_identifier` or `replication_source_identifier` is provided or unless a `global_cluster_identifier` is provided when the cluster is the secondary cluster of a global database
monitoring_role_arn	string	""	IAM role used by RDS to send enhanced monitoring metrics to CloudWatch
name	string	""	Name used across resources created
network_type	string	null	The type of network stack to use (IPV4 or DUAL)
port	string	null	The port on which the DB accepts connections
predefined_metric_type	string	"RDSReaderAverageCPUUtilization"	The metric type to scale on. Valid values are `RDSReaderAverageCPUUtilization` and `RDSReaderAverageDatabaseConnections`
preferred_backup_window	string	null	Daily time range during which automated backups are created if automated backups are enabled using the BackupRetentionPeriod parameter.Time in UTC. Default: A 30-minute window selected at random from an 8-hour block of time per region, e.g. `04:00-09:00`
preferred_maintenance_window	string	null	Weekly time range during which system maintenance can occur, in (UTC) e.g., `wed:04:00-wed:04:30`
putin_khuylo	bool	true	Do you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo!
region	string	null	Region where the resource(s) will be managed. Defaults to the Region set in the provider configuration
replication_source_identifier	string	null	ARN of a source DB cluster or DB instance if this DB cluster is to be created as a Read Replica
restore_to_point_in_time	object({...})	null	Map of nested attributes for cloning Aurora cluster
role_associations	map({...})	{}	Map of IAM roles and supported feature names to associate with the cluster
s3_import	object({...})	null	Configuration map used to restore from a Percona Xtrabackup in S3 (only MySQL is supported)
scaling_configuration	object({...})	null	Map of nested attributes with scaling properties. Only valid when `engine_mode` is set to `serverless`
security_group_description	string	null	The description of the security group. If value is set to empty string it will contain cluster name in the description
security_group_egress_rules	map({...})	{}	Map of security group egress rules to add to the security group created
security_group_ingress_rules	map({...})	{}	Map of security group ingress rules to add to the security group created
security_group_name	string	""	The security group name. Default value is (`var.name`)
security_group_tags	map(string)	{}	Additional tags for the security group
security_group_use_name_prefix	bool	true	Determines whether the security group name (`var.name`) is used as a prefix
serverlessv2_scaling_configuration	object({...})	null	Map of nested attributes with serverless v2 scaling properties. Only valid when `engine_mode` is set to `provisioned`
shard_group	object({...})	null	Arguments for the DB shard group to be created
skip_final_snapshot	bool	false	Determines whether a final snapshot is created before the cluster is deleted. If true is specified, no snapshot is created
snapshot_identifier	string	null	Specifies whether or not to create this cluster from a snapshot. You can use either the name or ARN when specifying a DB cluster snapshot, or the ARN when specifying a DB snapshot
source_region	string	null	The source region for an encrypted replica DB cluster
storage_encrypted	bool	true	Specifies whether the DB cluster is encrypted. The default is `true`
storage_type	string	null	Determines the storage type for the DB cluster. Optional for Single-AZ, required for Multi-AZ DB clusters. Valid values for Single-AZ: `aurora`, `""` (default, both refer to Aurora Standard), `aurora-iopt1` (Aurora I/O Optimized). Valid values for Multi-AZ: `io1` (default)
subnets	list(string)	[]	List of subnet IDs used by database subnet group created
tags	map(string)	{}	A map of tags to add to all resources
vpc_id	string	""	ID of the VPC where to create security group
vpc_security_group_ids	list(string)	[]	List of VPC security groups to associate to the cluster in addition to the security group created