Skip to main content

Component: rds

This component is responsible for provisioning an RDS instance. It seeds relevant database information (hostnames, username, password, etc.) into AWS SSM Parameter Store.

Security Groups Guidance:

By default this component creates a client security group and adds that security group id to the default attached security group. Ideally other AWS resources that require RDS access can be granted this client security group. Additionally you can grant access via specific CIDR blocks or security group ids.


Stack Level: Regional

Here's an example snippet for how to use this component.

Microsoft SQL

enabled: true
name: mssql
# SQL Server 2017 Enterprise
engine: sqlserver-ee
engine_version: "14.00.3356.20"
db_parameter_group: "sqlserver-ee-14.0"
license_model: license-included
# Required for MSSQL
database_name: null
database_port: 1433
database_user: mssql
instance_class: db.t3.xlarge
# There are issues with enabling this
multi_az: false
allocated_storage: 20
publicly_accessible: false
ssm_enabled: true
# This does not seem to work correctly
deletion_protection: false

Provisioning from a snapshot

The snapshot identifier variable can be added to provision an instance from a snapshot HOWEVER- Keep in mind these instances are provisioned from a unique kms key per rds. For clean terraform runs, you must first provision the key for the destination instance, then copy the snapshot using that kms key.

Example - I want a new instance rds-example-new to be provisioned from a snapshot of rds-example-old:

  1. Use the console to manually make a snapshot of rds instance rds-example-old

  2. provision the kms key for rds-example-new

    atmos terraform plan  rds-example-new -s ue1-staging '-target=module.kms_key_rds.aws_kms_key.default[0]'
    atmos terraform apply rds-example-new -s ue1-staging '-target=module.kms_key_rds.aws_kms_key.default[0]'
  3. Use the console to copy the snapshot to a new name using the above provisioned kms key

  4. Add snapshot_identifier variable to rds-example-new catalog and specify the newly copied snapshot that used the above key

  5. Post provisioning, remove the snapshot_idenfier variable and verify terraform runs clean for the copied instance


terraform>= 1.0.0
aws~> 4.0
random>= 2.3


aws~> 4.0
random>= 2.3




aws_caller_identity.currentdata source
aws_iam_policy_document.kms_key_rdsdata source


additional_tag_mapAdditional key-value pairs to add to each map in tags_as_list_of_maps. Not added to tags or id.
This is for some rare cases where resources want additional configuration of tags
and therefore take a list of maps with tag key, value, and additional configuration.
allocated_storageThe allocated storage in GBsnumbern/ayes
allow_major_version_upgradeAllow major version upgradeboolfalseno
allowed_cidr_blocksThe whitelisted CIDRs which to allow ingress traffic to the DB instancelist(string)[]no
apply_immediatelySpecifies whether any database modifications are applied immediately, or during the next maintenance windowboolfalseno
associate_security_group_idsThe IDs of the existing security groups to associate with the DB instancelist(string)[]no
attributesID element. Additional attributes (e.g. workers or cluster) to add to id,
in the order they appear in the list. New attributes are appended to the
end of the list. The elements of the list are joined by the delimiter
and treated as a single ID element.
auto_minor_version_upgradeAllow automated minor version upgrade (e.g. from Postgres 9.5.3 to Postgres 9.5.4)booltrueno
availability_zoneThe AZ for the RDS instance. Specify one of subnet_ids, db_subnet_group_name or availability_zone. If availability_zone is provided, the instance will be placed into the default VPC or EC2 Classicstringnullno
backup_retention_periodBackup retention period in days. Must be > 0 to enable backupsnumber0no
backup_windowWhen AWS can perform DB snapshots, can't overlap with maintenance windowstring"22:00-03:00"no
ca_cert_identifierThe identifier of the CA certificate for the DB instancestringnullno
charset_nameThe character set name to use for DB encoding. Oracle & Microsoft SQL only. For other engines use db_parameterstringnullno
client_security_group_enabledcreate a client security group and include in attached default security groupbooltrueno
contextSingle object for setting entire context at once.
See description of individual variables for details.
Leave string and numeric variables as null to use default value.
Individual variable settings (non-null) override settings in context object,
except for attributes, tags, and additional_tag_map, which are merged.
"additional_tag_map": {},
"attributes": [],
"delimiter": null,
"descriptor_formats": {},
"enabled": true,
"environment": null,
"id_length_limit": null,
"label_key_case": null,
"label_order": [],
"label_value_case": null,
"labels_as_tags": [
"name": null,
"namespace": null,
"regex_replace_chars": null,
"stage": null,
"tags": {},
"tenant": null
copy_tags_to_snapshotCopy tags from DB to a snapshotbooltrueno
database_nameThe name of the database to create when the DB instance is createdstringn/ayes
database_passwordDatabase password for the admin userstring""no
database_portDatabase port (_e.g._ 3306 for MySQL). Used in the DB Security Group to allow access to the DB instance from the provided security_group_idsnumbern/ayes
database_userDatabase admin user namestring""no
db_optionsA list of DB options to apply with an option group. Depends on DB engine
db_security_group_memberships = list(string)
option_name = string
port = number
version = string
vpc_security_group_memberships = list(string)

option_settings = list(object({
name = string
value = string
db_parameterA list of DB parameters to apply. Note that parameters may differ from a DB family to another
apply_method = string
name = string
value = string
db_parameter_groupThe DB parameter group family name. The value depends on DB engine used. See DBParameterGroupFamily for instructions on how to retrieve applicable value.stringn/ayes
db_subnet_group_nameName of DB subnet group. DB instance will be created in the VPC associated with the DB subnet group. Specify one of subnet_ids, db_subnet_group_name or availability_zonestringnullno
deletion_protectionSet to true to enable deletion protection on the RDS instanceboolfalseno
delimiterDelimiter to be used between ID elements.
Defaults to - (hyphen). Set to "" to use no delimiter at all.
descriptor_formatsDescribe additional descriptors to be output in the descriptors output map.
Map of maps. Keys are names of descriptors. Values are maps of the form
{<br/> format = string<br/> labels = list(string)<br/>}
(Type is any so the map values can later be enhanced to provide additional options.)
format is a Terraform format string to be passed to the format() function.
labels is a list of labels, in order, to pass to format() function.
Label values will be normalized before being passed to format() so they will be
identical to how they appear in id.
Default is {} (descriptors output will be empty).
dns_gbl_delegated_environment_nameThe name of the environment where global dns_delegated is provisionedstring"gbl"no
dns_zone_idThe ID of the DNS Zone in Route53 where a new DNS record will be created for the DB host namestring""no
enabledSet to false to prevent the module from creating any resourcesboolnullno
enabled_cloudwatch_logs_exportsList of log types to enable for exporting to CloudWatch logs. If omitted, no logs will be exported. Valid values (depending on engine): alert, audit, error, general, listener, slowquery, trace, postgresql (PostgreSQL), upgrade (PostgreSQL).list(string)[]no
engineDatabase engine typestringn/ayes
engine_versionDatabase engine version, depends on engine typestringn/ayes
environmentID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'stringnullno
final_snapshot_identifierFinal snapshot identifier e.g.: some-db-final-snapshot-2019-06-26-06-05string""no
host_nameThe DB host name created in Route53string"db"no
iam_database_authentication_enabledSpecifies whether or mappings of AWS Identity and Access Management (IAM) accounts to database accounts is enabledboolfalseno
id_length_limitLimit id to this many characters (minimum 6).
Set to 0 for unlimited length.
Set to null for keep the existing setting, which defaults to 0.
Does not affect id_full.
import_profile_nameAWS Profile name to use when importing a resourcestringnullno
import_role_arnIAM Role ARN to use when importing a resourcestringnullno
instance_classClass of RDS instancestringn/ayes
iopsThe amount of provisioned IOPS. Setting this implies a storage_type of 'io1'. Default is 0 if rds storage type is not 'io1'number0no
kms_alias_name_ssmKMS alias name for SSMstring"alias/aws/ssm"no
kms_key_arnThe ARN of the existing KMS key to encrypt storagestring""no
label_key_caseControls the letter case of the tags keys (label names) for tags generated by this module.
Does not affect keys of tags passed in via the tags input.
Possible values: lower, title, upper.
Default value: title.
label_orderThe order in which the labels (ID elements) appear in the id.
Defaults to ["namespace", "environment", "stage", "name", "attributes"].
You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present.
label_value_caseControls the letter case of ID elements (labels) as included in id,
set as tag values, and output by this module individually.
Does not affect values of tags passed in via the tags input.
Possible values: lower, title, upper and none (no transformation).
Set this to title and set delimiter to "" to yield Pascal Case IDs.
Default value: lower.
labels_as_tagsSet of labels (ID elements) to include as tags in the tags output.
Default is to include all labels.
Tags with empty values will not be included in the tags output.
Set to [] to suppress all generated tags.
The value of the name tag, if included, will be the id, not the name.
Unlike other null-label inputs, the initial setting of labels_as_tags cannot be
changed in later chained modules. Attempts to change it will be silently ignored.
license_modelLicense model for this DB. Optional, but required for some DB Engines. Valid values: license-included | bring-your-own-license | general-public-licensestring""no
maintenance_windowThe window to perform maintenance in. Syntax: 'ddd:hh24:mi-ddd:hh24:mi' UTCstring"Mon:03:00-Mon:04:00"no
major_engine_versionDatabase MAJOR engine version, depends on engine typestring""no
max_allocated_storageThe upper limit to which RDS can automatically scale the storage in GBsnumber0no
monitoring_intervalThe interval, in seconds, between points when Enhanced Monitoring metrics are collected for the DB instance. To disable collecting Enhanced Monitoring metrics, specify 0. Valid Values are 0, 1, 5, 10, 15, 30, 60.string"0"no
monitoring_role_arnThe ARN for the IAM role that permits RDS to send enhanced monitoring metrics to CloudWatch Logsstringnullno
multi_azSet to true if multi AZ deployment must be supportedboolfalseno
nameID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.
This is the only ID element not also included as a tag.
The "name" tag is set to the full id string. There is no tag with the value of the name input.
namespaceID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally uniquestringnullno
option_group_nameName of the DB option group to associatestring""no
parameter_group_nameName of the DB parameter group to associatestring""no
performance_insights_enabledSpecifies whether Performance Insights are enabled.boolfalseno
performance_insights_kms_key_idThe ARN for the KMS key to encrypt Performance Insights data. Once KMS key is set, it can never be changed.stringnullno
performance_insights_retention_periodThe amount of time in days to retain Performance Insights data. Either 7 (7 days) or 731 (2 years).number7no
publicly_accessibleDetermines if database can be publicly available (NOT recommended)boolfalseno
regex_replace_charsTerraform regular expression (regex) string.
Characters matching the regex will be removed from the ID elements.
If not set, "/[^a-zA-Z0-9-]/" is used to remove all characters other than hyphens, letters and digits.
regionAWS Regionstringn/ayes
replicate_source_dbIf the rds db instance is a replica, supply the source database identifier hereanynullno
security_group_idsThe IDs of the security groups from which to allow ingress traffic to the DB instancelist(string)[]no
skip_final_snapshotIf true (default), no snapshot will be made before deleting DBbooltrueno
snapshot_identifierSnapshot identifier e.g: rds:production-2019-06-26-06-05. If specified, the module create cluster from the snapshotstringnullno
ssm_enabledIf true create SSM keys for the database user and password.boolfalseno
ssm_key_formatSSM path format. The values will will be used in the following order: var.ssm_key_prefix,, var.ssm_key_*string"/%v/%v/%v"no
ssm_key_hostnameThe SSM key to save the hostname. See var.ssm_path_format.string"admin/db_hostname"no
ssm_key_passwordThe SSM key to save the password. See var.ssm_path_format.string"admin/db_password"no
ssm_key_portThe SSM key to save the port. See var.ssm_path_format.string"admin/db_port"no
ssm_key_prefixSSM path prefix. Omit the leading forward slash /.string"rds"no
ssm_key_userThe SSM key to save the user. See var.ssm_path_format.string"admin/db_user"no
stageID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'stringnullno
storage_encrypted(Optional) Specifies whether the DB instance is encrypted. The default is false if not specifiedbooltrueno
storage_typeOne of 'standard' (magnetic), 'gp2' (general purpose SSD), or 'io1' (provisioned IOPS SSD)string"standard"no
tagsAdditional tags (e.g. {'BusinessUnit': 'XYZ'}).
Neither the tag keys nor the tag values will be modified by this module.
tenantID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is forstringnullno
timezoneTime zone of the DB instance. timezone is currently only supported by Microsoft SQL Server. The timezone can only be set on creation. See MSSQL User Guide for more information.stringnullno
use_eks_security_groupUse the eks default security groupboolfalseno


exportsMap of exports for use in deployment configuration templates
rds_addressAddress of the instance
rds_arnARN of the instance
rds_database_ssm_key_prefixSSM prefix
rds_endpointDNS Endpoint of the instance
rds_hostnameDNS host name of the instance
rds_idID of the instance
rds_nameRDS DB name
rds_option_group_idID of the Option Group
rds_parameter_group_idID of the Parameter Group
rds_portRDS DB port
rds_resource_idThe RDS Resource ID of this instance.
rds_security_group_idID of the Security Group
rds_subnet_group_idID of the created Subnet Group