Module: rds-db-proxy
Terraform module to provision an Amazon RDS Proxy for MySQL or Postgres.
Usage
For a complete example, see examples/complete.
For automated tests of the complete example using bats and Terratest (which tests and deploys the example on AWS), see test.
module "vpc" {
source = "cloudposse/vpc/aws"
# Cloud Posse recommends pinning every module to a specific version
# version = "x.x.x"
cidr_block = "172.16.0.0/16"
context = module.this.context
}
module "subnets" {
source = "cloudposse/dynamic-subnets/aws"
# Cloud Posse recommends pinning every module to a specific version
# version = "x.x.x"
availability_zones = var.availability_zones
vpc_id = module.vpc.vpc_id
igw_id = module.vpc.igw_id
cidr_block = module.vpc.vpc_cidr_block
nat_gateway_enabled = false
nat_instance_enabled = false
context = module.this.context
}
resource "random_password" "admin_password" {
count = var.database_password == "" || var.database_password == null ? 1 : 0
length = 33
special = false
override_special = "!#$%^&*()<>-_"
}
locals {
database_password = var.database_password != "" && var.database_password != null ? var.database_password : join("", random_password.admin_password.*.result)
username_password = {
username = var.database_user
password = local.database_password
}
auth = [
{
auth_scheme = "SECRETS"
description = "Access the database instance using username and password from AWS Secrets Manager"
iam_auth = "DISABLED"
secret_arn = aws_secretsmanager_secret.rds_username_and_password.arn
}
]
}
module "rds_instance" {
source = "cloudposse/rds/aws"
# Cloud Posse recommends pinning every module to a specific version
# version = "x.x.x"
database_name = var.database_name
database_user = var.database_user
database_password = local.database_password
database_port = var.database_port
multi_az = var.multi_az
storage_type = var.storage_type
allocated_storage = var.allocated_storage
storage_encrypted = var.storage_encrypted
engine = var.engine
engine_version = var.engine_version
instance_class = var.instance_class
db_parameter_group = var.db_parameter_group
publicly_accessible = var.publicly_accessible
vpc_id = module.vpc.vpc_id
subnet_ids = module.subnets.private_subnet_ids
security_group_ids = [module.vpc.vpc_default_security_group_id]
apply_immediately = var.apply_immediately
context = module.this.context
}
resource "aws_secretsmanager_secret" "rds_username_and_password" {
name = module.this.id
description = "RDS username and password"
recovery_window_in_days = 0
tags = module.this.tags
}
resource "aws_secretsmanager_secret_version" "rds_username_and_password" {
secret_id = aws_secretsmanager_secret.rds_username_and_password.id
secret_string = jsonencode(local.username_password)
}
module "rds_proxy" {
source = "cloudposse/rds-db-proxy/aws"
# Cloud Posse recommends pinning every module to a specific version
# version = "x.x.x"
db_instance_identifier = module.rds_instance.instance_id
auth = local.auth
vpc_security_group_ids = [module.vpc.vpc_default_security_group_id]
vpc_subnet_ids = module.subnets.public_subnet_ids
debug_logging = var.debug_logging
engine_family = var.engine_family
idle_client_timeout = var.idle_client_timeout
require_tls = var.require_tls
connection_borrow_timeout = var.connection_borrow_timeout
init_query = var.init_query
max_connections_percent = var.max_connections_percent
max_idle_connections_percent = var.max_idle_connections_percent
session_pinning_filters = var.session_pinning_filters
existing_iam_role_arn = var.existing_iam_role_arn
context = module.this.context
}
Examples
Review the complete example to see how to use this module.
Requirements
Name | Version |
---|---|
terraform | >= 0.13.0 |
aws | >= 3.1.15 |
Providers
Name | Version |
---|---|
aws | >= 3.1.15 |
Modules
Name | Source | Version |
---|---|---|
role_label | cloudposse/label/null | 0.25.0 |
this | cloudposse/label/null | 0.25.0 |
Resources
Name | Type |
---|---|
aws_db_proxy.this | resource |
aws_db_proxy_default_target_group.this | resource |
aws_db_proxy_target.this | resource |
aws_iam_policy.this | resource |
aws_iam_role.this | resource |
aws_iam_role_policy_attachment.this | resource |
aws_iam_policy_document.assume_role | data source |
aws_iam_policy_document.this | data source |
aws_kms_key.this | data source |
aws_region.this | data source |
Inputs
Name | Description | Type | Default | Required |
---|---|---|---|---|
additional_tag_map | Additional key-value pairs to add to each map in tags_as_list_of_maps . Not added to tags or id .This is for some rare cases where resources want additional configuration of tags and therefore take a list of maps with tag key, value, and additional configuration. | map(string) | {} | no |
attributes | ID element. Additional attributes (e.g. workers or cluster ) to add to id ,in the order they appear in the list. New attributes are appended to the end of the list. The elements of the list are joined by the delimiter and treated as a single ID element. | list(string) | [] | no |
auth | Configuration blocks with authorization mechanisms to connect to the associated database instances or clusters |
| n/a | yes |
connection_borrow_timeout | The number of seconds for a proxy to wait for a connection to become available in the connection pool. Only applies when the proxy has opened its maximum number of connections and all connections are busy with client sessions | number | 120 | no |
context | Single object for setting entire context at once. See description of individual variables for details. Leave string and numeric variables as null to use default value.Individual variable settings (non-null) override settings in context object, except for attributes, tags, and additional_tag_map, which are merged. | any |
| no |
db_cluster_identifier | DB cluster identifier. Either db_instance_identifier or db_cluster_identifier should be specified and both should not be specified together | string | null | no |
db_instance_identifier | DB instance identifier. Either db_instance_identifier or db_cluster_identifier should be specified and both should not be specified together | string | null | no |
debug_logging | Whether the proxy includes detailed information about SQL statements in its logs | bool | false | no |
delimiter | Delimiter to be used between ID elements. Defaults to - (hyphen). Set to "" to use no delimiter at all. | string | null | no |
descriptor_formats | Describe additional descriptors to be output in the descriptors output map.Map of maps. Keys are names of descriptors. Values are maps of the form {<br/> format = string<br/> labels = list(string)<br/>} (Type is any so the map values can later be enhanced to provide additional options.)format is a Terraform format string to be passed to the format() function.labels is a list of labels, in order, to pass to format() function.Label values will be normalized before being passed to format() so they will beidentical to how they appear in id .Default is {} (descriptors output will be empty). | any | {} | no |
enabled | Set to false to prevent the module from creating any resources | bool | null | no |
engine_family | The kinds of databases that the proxy can connect to. This value determines which database network protocol the proxy recognizes when it interprets network traffic to and from the database. The engine family applies to MySQL and PostgreSQL for both RDS and Aurora. Valid values are MYSQL and POSTGRESQL | string | "MYSQL" | no |
environment | ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT' | string | null | no |
existing_iam_role_arn | The ARN of an existing IAM role that the proxy can use to access secrets in AWS Secrets Manager. If not provided, the module will create a role to access secrets in Secrets Manager | string | null | no |
iam_role_attributes | Additional attributes to add to the ID of the IAM role that the proxy uses to access secrets in AWS Secrets Manager | list(string) | null | no |
id_length_limit | Limit id to this many characters (minimum 6).Set to 0 for unlimited length.Set to null for keep the existing setting, which defaults to 0 .Does not affect id_full . | number | null | no |
idle_client_timeout | The number of seconds that a connection to the proxy can be inactive before the proxy disconnects it | number | 1800 | no |
init_query | One or more SQL statements for the proxy to run when opening each new database connection | string | null | no |
kms_key_id | The ARN or Id of the AWS KMS customer master key (CMK) to encrypt the secret values in the versions stored in secrets. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default CMK (the one named aws/secretsmanager ) | string | null | no |
label_key_case | Controls the letter case of the tags keys (label names) for tags generated by this module.Does not affect keys of tags passed in via the tags input.Possible values: lower , title , upper .Default value: title . | string | null | no |
label_order | The order in which the labels (ID elements) appear in the id .Defaults to ["namespace", "environment", "stage", "name", "attributes"]. You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. | list(string) | null | no |
label_value_case | Controls the letter case of ID elements (labels) as included in id ,set as tag values, and output by this module individually. Does not affect values of tags passed in via the tags input.Possible values: lower , title , upper and none (no transformation).Set this to title and set delimiter to "" to yield Pascal Case IDs.Default value: lower . | string | null | no |
labels_as_tags | Set of labels (ID elements) to include as tags in the tags output.Default is to include all labels. Tags with empty values will not be included in the tags output.Set to [] to suppress all generated tags.Notes: The value of the name tag, if included, will be the id , not the name .Unlike other null-label inputs, the initial setting of labels_as_tags cannot bechanged in later chained modules. Attempts to change it will be silently ignored. | set(string) |
| no |
max_connections_percent | The maximum size of the connection pool for each target in a target group | number | 100 | no |
max_idle_connections_percent | Controls how actively the proxy closes idle database connections in the connection pool. A high value enables the proxy to leave a high percentage of idle connections open. A low value causes the proxy to close idle client connections and return the underlying database connections to the connection pool | number | 50 | no |
name | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'. This is the only ID element not also included as a tag .The "name" tag is set to the full id string. There is no tag with the value of the name input. | string | null | no |
namespace | ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique | string | null | no |
proxy_create_timeout | Proxy creation timeout | string | "30m" | no |
proxy_delete_timeout | Proxy delete timeout | string | "60m" | no |
proxy_update_timeout | Proxy update timeout | string | "30m" | no |
regex_replace_chars | Terraform regular expression (regex) string. Characters matching the regex will be removed from the ID elements. If not set, "/[^a-zA-Z0-9-]/" is used to remove all characters other than hyphens, letters and digits. | string | null | no |
require_tls | A Boolean parameter that specifies whether Transport Layer Security (TLS) encryption is required for connections to the proxy. By enabling this setting, you can enforce encrypted TLS connections to the proxy | bool | false | no |
session_pinning_filters | Each item in the list represents a class of SQL operations that normally cause all later statements in a session using a proxy to be pinned to the same underlying database connection | list(string) | null | no |
stage | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | string | null | no |
tags | Additional tags (e.g. {'BusinessUnit': 'XYZ'} ).Neither the tag keys nor the tag values will be modified by this module. | map(string) | {} | no |
tenant | ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for | string | null | no |
vpc_security_group_ids | One or more VPC security group IDs to associate with the proxy | set(string) | n/a | yes |
vpc_subnet_ids | One or more VPC subnet IDs to associate with the proxy | set(string) | n/a | yes |
Outputs
Name | Description |
---|---|
proxy_arn | Proxy ARN |
proxy_default_target_group_arn | The Amazon Resource Name (ARN) representing the default target group |
proxy_default_target_group_name | The name of the default target group |
proxy_endpoint | Proxy endpoint |
proxy_iam_role_arn | The ARN of the IAM role that the proxy uses to access secrets in AWS Secrets Manager |
proxy_id | Proxy ID |
proxy_target_endpoint | Hostname for the target RDS DB Instance. Only returned for RDS_INSTANCE type |
proxy_target_id | Identifier of db_proxy_name , target_group_name , target type (e.g. RDS_INSTANCE or TRACKED_CLUSTER ), and resource identifier separated by forward slashes (/ ) |
proxy_target_port | Port for the target RDS DB instance or Aurora DB cluster |
proxy_target_rds_resource_id | Identifier representing the DB instance or DB cluster target |
proxy_target_target_arn | Amazon Resource Name (ARN) for the DB instance or DB cluster |
proxy_target_tracked_cluster_id | DB Cluster identifier for the DB instance target. Not returned unless manually importing an RDS_INSTANCE target that is part of a DB cluster |
proxy_target_type | Type of target. e.g. RDS_INSTANCE or TRACKED_CLUSTER |