AWS RDS Proxy Terraform module

Version4.4.1

Upstream version 4.4.1

2 controls from NIST SP 800-171 Rev 2 requirements

Terraform Module Source

nist800171.compliance.tf/terraform-aws-modules/rds-proxy/aws

Compliance Inputs Outputs Resources Rules Diff (1)README

44 unique

Name	Type	Default	Description
Enforced · locked by active controls
log_group_kms_key_idlog_group_encryption_at_rest_enabled	string	null	The ARN of the KMS Key to use when encrypting log data
log_group_retention_in_dayscloudwatch_log_group_retention_period_365	number	365	Specifies the number of days you want to retain log events in the log group
Optional
auth	map({...})	{...}	Configuration block(s) with authorization mechanisms to connect to the associated instances or clusters
connection_borrow_timeout	number	null	The number of seconds for a proxy to wait for a connection to become available in the connection pool
create	bool	true	Whether cluster should be created (affects nearly all resources)
create_iam_policy	bool	true	Determines whether an IAM policy is created
create_iam_role	bool	true	Determines whether an IAM role is created
db_cluster_identifier	string	""	DB cluster identifier
db_instance_identifier	string	""	DB instance identifier
debug_logging	bool	false	Whether the proxy includes detailed information about SQL statements in its logs
default_auth_scheme	string	null	Default authentication scheme that the proxy uses for client connections to the proxy and connections from the proxy to the underlying database. Valid values are NONE and IAM_AUTH. Defaults to NONE
endpoint_network_type	string	null	Network type of the DB proxy endpoint. Valid values are IPV4, IPV6 and DUAL. Defaults to IPV4. If IPV6 is specified, the subnets associated with the proxy must be IPv6-only, and target_connection_network_type must be IPV6
endpoints	map({...})	{}	Map of DB proxy endpoints to create and their attributes
engine_family	string	""	The kind of database engine that the proxy will connect to. Valid values are `MYSQL` or `POSTGRESQL`
iam_policy_name	string	""	The name of the role policy. If omitted, Terraform will assign a random, unique name
iam_role_description	string	""	The description of the role
iam_role_force_detach_policies	bool	true	Specifies to force detaching any policies the role has before destroying it
iam_role_max_session_duration	number	43200	The maximum session duration (in seconds) that you want to set for the specified role
iam_role_name	string	""	The name of the role. If omitted, Terraform will assign a random, unique name
iam_role_path	string	null	The path to the role
iam_role_permissions_boundary	string	null	The ARN of the policy that is used to set the permissions boundary for the role
iam_role_tags	map(string)	{}	A map of tags to apply to the IAM role
idle_client_timeout	number	1800	The number of seconds that a connection to the proxy can be inactive before the proxy disconnects it
init_query	string	""	One or more SQL statements for the proxy to run when opening each new database connection
kms_key_arns	list(string)	[]	List of KMS Key ARNs to allow access to decrypt SecretsManager secrets
log_group_class	string	null	Specified the log class of the log group. Possible values are: `STANDARD` or `INFREQUENT_ACCESS`
log_group_tags	map(string)	{}	A map of tags to apply to the CloudWatch log group
manage_log_group	bool	true	Determines whether Terraform will create/manage the CloudWatch log group or not. Note - this will fail if set to true after the log group has been created as the resource will already exist
max_connections_percent	number	90	The maximum size of the connection pool for each target in a target group
max_idle_connections_percent	number	50	Controls how actively the proxy closes idle database connections in the connection pool
name	string	""	The identifier for the proxy. This name must be unique for all proxies owned by your AWS account in the specified AWS Region. An identifier must begin with a letter and must contain only ASCII letters, digits, and hyphens; it can't end with a hyphen or contain two consecutive hyphens
proxy_tags	map(string)	{}	A map of tags to apply to the RDS Proxy
region	string	null	Region where the resource(s) will be managed. Defaults to the Region set in the provider configuration
require_tls	bool	true	A Boolean parameter that specifies whether Transport Layer Security (TLS) encryption is required for connections to the proxy
role_arn	string	""	The Amazon Resource Name (ARN) of the IAM role that the proxy uses to access secrets in AWS Secrets Manager
session_pinning_filters	list(string)	[]	Each item in the list represents a class of SQL operations that normally cause all later statements in a session using a proxy to be pinned to the same underlying database connection
tags	map(string)	{}	A map of tags to add to all resources
target_connection_network_type	string	null	Network type that the proxy uses to connect to the target database. Valid values are IPV4 and IPV6. Defaults to IPV4
target_db_cluster	bool	false	Determines whether DB cluster is targeted by proxy
target_db_instance	bool	false	Determines whether DB instance is targeted by proxy
use_policy_name_prefix	bool	false	Whether to use unique name beginning with the specified `iam_policy_name`
use_role_name_prefix	bool	false	Whether to use unique name beginning with the specified `iam_role_name`
vpc_security_group_ids	list(string)	[]	One or more VPC security group IDs to associate with the new proxy
vpc_subnet_ids	list(string)	[]	One or more VPC subnet IDs to associate with the new proxy