AWS RDS Terraform module

Upstream version 7.2.0

10 controls from NIST SP 800-171 Rev 2 requirements

Terraform Module Source

nist800171.compliance.tf/terraform-aws-modules/rds/aws

Compliance Inputs Outputs Resources Diff (0)README

111 unique

Name	Type	Default	Description
Required · needed to use this module
identifier	string	—	The name of the RDS instance
Enforced · locked by active controls
backup_retention_periodrds_db_instance_backup_enabled	number	null	The days to retain backups for
cloudwatch_log_group_kms_key_idlog_group_encryption_at_rest_enabled	string	null	The ARN of the KMS Key to use when encrypting log data
cloudwatch_log_group_retention_in_dayscloudwatch_log_group_retention_period_365	number	7	The number of days to retain CloudWatch logs for the DB instance
deletion_protectionrds_db_instance_deletion_protection_enabled	bool	false	The database can't be deleted when this value is set to true
enabled_cloudwatch_logs_exportsrds_db_instance_logging_enabled	list(string)	[]	List of log types to enable for exporting to CloudWatch logs. If omitted, no logs will be exported. Valid values (depending on engine): alert, audit, error, general, listener, slowquery, trace, postgresql (PostgreSQL), upgrade (PostgreSQL)
iam_database_authentication_enabledrds_db_instance_iam_authentication_enabled	bool	false	Specifies whether or not the mappings of AWS Identity and Access Management (IAM) accounts to database accounts are enabled
monitoring_intervalrds_db_instance_and_cluster_enhanced_monitoring_enabled	number	0	The interval, in seconds, between points when Enhanced Monitoring metrics are collected for the DB instance. To disable collecting Enhanced Monitoring metrics, specify 0. The default is 0. Valid Values: 0, 1, 5, 10, 15, 30, 60
multi_azrds_db_instance_multiple_az_enabled	bool	false	Specifies if the RDS instance is multi-AZ
publicly_accessiblerds_db_instance_prohibit_public_access	bool	false	Bool to control if instance is publicly accessible
storage_encryptedrds_db_instance_encryption_at_rest_enabled	bool	true	Specifies whether the DB instance is encrypted
Optional
allocated_storage	number	null	The allocated storage in gigabytes
allow_major_version_upgrade	bool	false	Indicates that major version upgrades are allowed. Changing this parameter does not result in an outage and the change is asynchronously applied as soon as possible
apply_immediately	bool	false	Specifies whether any database modifications are applied immediately, or during the next maintenance window
auto_minor_version_upgrade	bool	true	Indicates that minor engine upgrades will be applied automatically to the DB instance during the maintenance window
availability_zone	string	null	The Availability Zone of the RDS instance
backup_window	string	null	The daily time range (in UTC) during which automated backups are created if they are enabled. Example: '09:46-10:16'. Must not overlap with maintenance_window
blue_green_update	object({...})	null	Enables low-downtime updates using RDS Blue/Green deployments.
ca_cert_identifier	string	null	Specifies the identifier of the CA certificate for the DB instance
character_set_name	string	null	The character set name to use for DB encoding in Oracle instances. This can't be changed. See Oracle Character Sets Supported in Amazon RDS and Collations and Character Sets for Microsoft SQL Server for more information. This can only be set on creation
cloudwatch_log_group_class	string	null	Specified the log class of the log group. Possible values are: STANDARD or INFREQUENT_ACCESS
cloudwatch_log_group_skip_destroy	bool	null	Set to true if you do not wish the log group (and any logs it may contain) to be deleted at destroy time, and instead just remove the log group from the Terraform state
cloudwatch_log_group_tags	map(string)	{}	Additional tags for the CloudWatch log group(s)
copy_tags_to_snapshot	bool	true	On delete, copy all Instance tags to the final snapshot
create_cloudwatch_log_group	bool	false	Determines whether a CloudWatch log group is created for each `enabled_cloudwatch_logs_exports`
create_db_instance	bool	true	Whether to create a database instance
create_db_option_group	bool	true	Create a database option group
create_db_parameter_group	bool	true	Whether to create a database parameter group
create_db_subnet_group	bool	false	Whether to create a database subnet group
create_monitoring_role	bool	false	Create IAM role with a defined name that permits RDS to send enhanced monitoring metrics to CloudWatch Logs
custom_iam_instance_profile	string	null	RDS custom iam instance profile
customer_owned_ip_enabled	bool	null	Indicates whether to enable a customer-owned IP address (CoIP) for an RDS on Outposts DB instance
database_insights_mode	string	null	The mode of Database Insights that is enabled for the instance. Valid values: standard, advanced
db_instance_role_associations	map(string)	{}	A map of DB instance supported feature name to role association ARNs.
db_instance_tags	map(string)	{}	Additional tags for the DB instance
db_name	string	null	The DB name to create. If omitted, no database is created initially
db_option_group_tags	map(string)	{}	Additional tags for the DB option group
db_parameter_group_tags	map(string)	{}	Additional tags for the DB parameter group
db_subnet_group_description	string	null	Description of the DB subnet group to create
db_subnet_group_name	string	null	Name of DB subnet group. DB instance will be created in the VPC associated with the DB subnet group. If unspecified, will be created in the default VPC
db_subnet_group_tags	map(string)	{}	Additional tags for the DB subnet group
db_subnet_group_use_name_prefix	bool	true	Determines whether to use `subnet_group_name` as is or create a unique name beginning with the `subnet_group_name` as the prefix
dedicated_log_volume	bool	false	Use a dedicated log volume (DLV) for the DB instance. Requires Provisioned IOPS.
delete_automated_backups	bool	true	Specifies whether to remove automated backups immediately after the DB instance is deleted
domain	string	null	The ID of the Directory Service Active Directory domain to create the instance in
domain_auth_secret_arn	string	null	(Optional, but required if domain_fqdn is provided) The ARN for the Secrets Manager secret with the self managed Active Directory credentials for the user joining the domain. Conflicts with domain and domain_iam_role_name.
domain_dns_ips	list(string)	null	(Optional, but required if domain_fqdn is provided) The IPv4 DNS IP addresses of your primary and secondary self managed Active Directory domain controllers. Two IP addresses must be provided. If there isn't a secondary domain controller, use the IP address of the primary domain controller for both entries in the list. Conflicts with domain and domain_iam_role_name.
domain_fqdn	string	null	The fully qualified domain name (FQDN) of the self managed Active Directory domain. Conflicts with domain and domain_iam_role_name.
domain_iam_role_name	string	null	(Required if domain is provided) The name of the IAM role to be used when making API calls to the Directory Service
domain_ou	string	null	(Optional, but required if domain_fqdn is provided) The self managed Active Directory organizational unit for your DB instance to join. Conflicts with domain and domain_iam_role_name.
engine	string	null	The database engine to use
engine_lifecycle_support	string	null	The life cycle type for this DB instance. This setting applies only to RDS for MySQL and RDS for PostgreSQL. Valid values are `open-source-rds-extended-support`, `open-source-rds-extended-support-disabled`. Default value is `open-source-rds-extended-support`.
engine_version	string	null	The engine version to use
family	string	null	The family of the DB parameter group
final_snapshot_identifier_prefix	string	"final"	The name which is prefixed to the final snapshot on cluster destroy
instance_class	string	null	The instance type of the RDS instance
instance_use_identifier_prefix	bool	false	Determines whether to use `identifier` as is or create a unique identifier beginning with `identifier` as the specified prefix
iops	number	null	The amount of provisioned IOPS. Setting this implies a storage_type of 'io1' or `gp3`. See `notes` for limitations regarding this variable for `gp3`
kms_key_id	string	null	The ARN for the KMS encryption key. If creating an encrypted replica, set this to the destination KMS ARN. If storage_encrypted is set to true and kms_key_id is not specified the default KMS key created in your account will be used. Be sure to use the full ARN, not a key alias.
license_model	string	null	License model information for this DB instance. Optional, but required for some DB engines, i.e. Oracle SE1
maintenance_window	string	null	The window to perform maintenance in. Syntax: 'ddd:hh24:mi-ddd:hh24:mi'. Eg: 'Mon:00:00-Mon:03:00'
major_engine_version	string	null	Specifies the major version of the engine that this option group should be associated with
manage_master_user_password	bool	true	Set to true to allow RDS to manage the master user password in Secrets Manager
manage_master_user_password_rotation	bool	false	Whether to manage the master user password rotation. By default, false on creation, rotation is managed by RDS. There is not currently a way to disable this on initial creation even when set to false. Setting this value to false after previously having been set to true will disable automatic rotation.
master_user_password_rotate_immediately	bool	null	Specifies whether to rotate the secret immediately or wait until the next scheduled rotation window.
master_user_password_rotation_automatically_after_days	number	null	Specifies the number of days between automatic scheduled rotations of the secret. Either automatically_after_days or schedule_expression must be specified.
master_user_password_rotation_duration	string	null	The length of the rotation window in hours. For example, 3h for a three hour window.
master_user_password_rotation_schedule_expression	string	null	A cron() or rate() expression that defines the schedule for rotating your secret. Either automatically_after_days or schedule_expression must be specified.
master_user_secret_kms_key_id	string	null	The key ARN, key ID, alias ARN or alias name for the KMS key to encrypt the master user password secret in Secrets Manager. If not specified, the default KMS key for your Amazon Web Services account is used.
max_allocated_storage	number	0	Specifies the value for Storage Autoscaling
monitoring_role_arn	string	null	The ARN for the IAM role that permits RDS to send enhanced monitoring metrics to CloudWatch Logs. Must be specified if monitoring_interval is non-zero
monitoring_role_description	string	null	Description of the monitoring IAM role
monitoring_role_name	string	"rds-monitoring-role"	Name of the IAM role which will be created when create_monitoring_role is enabled
monitoring_role_permissions_boundary	string	null	ARN of the policy that is used to set the permissions boundary for the monitoring IAM role
monitoring_role_use_name_prefix	bool	false	Determines whether to use `monitoring_role_name` as is or create a unique identifier beginning with `monitoring_role_name` as the specified prefix
nchar_character_set_name	string	null	The national character set is used in the NCHAR, NVARCHAR2, and NCLOB data types for Oracle instances. This can't be changed.
network_type	string	null	The type of network stack to use
option_group_description	string	null	The description of the option group
option_group_name	string	null	Name of the option group
option_group_skip_destroy	bool	null	Set to true if you do not wish the option group to be deleted at destroy time, and instead just remove the option group from the Terraform state
option_group_timeouts	object({...})	null	Define maximum timeout for deletion of `aws_db_option_group` resource
option_group_use_name_prefix	bool	true	Determines whether to use `option_group_name` as is or create a unique name beginning with the `option_group_name` as the prefix
options	list({...})	null	A list of Options to apply
parameter_group_description	string	null	Description of the DB parameter group to create
parameter_group_name	string	null	Name of the DB parameter group to associate or create
parameter_group_skip_destroy	bool	null	Set to true if you do not wish the parameter group to be deleted at destroy time, and instead just remove the parameter group from the Terraform state
parameter_group_use_name_prefix	bool	true	Determines whether to use `parameter_group_name` as is or create a unique name beginning with the `parameter_group_name` as the prefix
parameters	list({...})	null	A list of DB parameters (map) to apply
password_wo	string	null	Write-Only required unless `manage_master_user_password` is set to `true`, `snapshot_identifier`, or `replicate_source_db` is provided). Password for the master DB user. Note that this may show up in logs, and it will be stored in the state file
password_wo_version	number	null	Used together with password_wo to trigger an update. Increment this value when an update to password_wo is required.
performance_insights_enabled	bool	false	Specifies whether Performance Insights are enabled
performance_insights_kms_key_id	string	null	The ARN for the KMS key to encrypt Performance Insights data
performance_insights_retention_period	number	7	The amount of time in days to retain Performance Insights data. Valid values are `7`, `731` (2 years) or a multiple of `31`
port	string	null	The port on which the DB accepts connections
putin_khuylo	bool	true	Do you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo!
region	string	null	Region where this resource will be managed. Defaults to the Region set in the provider configuration
replica_mode	string	null	Specifies whether the replica is in either mounted or open-read-only mode. This attribute is only supported by Oracle instances. Oracle replicas operate in open-read-only mode unless otherwise specified
replicate_source_db	string	null	Specifies that this resource is a Replicate database, and to use this value as the source database. This correlates to the identifier of another Amazon RDS Database to replicate
restore_to_point_in_time	object({...})	null	Restore to a point in time (MySQL is NOT supported)
s3_import	object({...})	null	Restore from a Percona Xtrabackup in S3 (only MySQL is supported)
skip_final_snapshot	bool	false	Determines whether a final DB snapshot is created before the DB instance is deleted. If true is specified, no DBSnapshot is created. If false is specified, a DB snapshot is created before the DB instance is deleted
snapshot_identifier	string	null	Specifies whether or not to create this database from a snapshot. This correlates to the snapshot ID you'd find in the RDS console, e.g: rds:production-2015-06-26-06-05
storage_throughput	number	null	Storage throughput value for the DB instance. See `notes` for limitations regarding this variable for `gp3`
storage_type	string	null	One of 'standard' (magnetic), 'gp2' (general purpose SSD), 'gp3' (new generation of general purpose SSD), or 'io1' (provisioned IOPS SSD). The default is 'io1' if iops is specified, 'gp2' if not. If you specify 'io1' or 'gp3' , you must also include a value for the 'iops' parameter
subnet_ids	list(string)	[]	A list of VPC subnet IDs
tags	map(string)	{}	A mapping of tags to assign to all resources
timeouts	object({...})	null	Updated Terraform resource management timeouts. Applies to `aws_db_instance` in particular to permit resource management times
timezone	string	null	Time zone of the DB instance. timezone is currently only supported by Microsoft SQL Server. The timezone can only be set on creation. See MSSQL User Guide for more information
upgrade_storage_config	bool	null	Whether to upgrade the storage file system configuration on the read replica. Can only be set with replicate_source_db.
username	string	null	Username for the master DB user
vpc_security_group_ids	list(string)	[]	List of VPC security groups to associate