> ## Documentation Index > Fetch the complete documentation index at: https://mintlify.com/terraform-aws-modules/terraform-aws-rds/llms.txt > Use this file to discover all available pages before exploring further. # db_instance submodule > Reference for the db_instance submodule — the core resource module that provisions the aws_db_instance and supporting resources. The `db_instance` submodule is the core of the terraform-aws-rds module. It provisions the `aws_db_instance` resource along with the Enhanced Monitoring IAM role, CloudWatch log groups, and Secrets Manager password rotation. The root module wraps this submodule and coordinates it with the subnet group, parameter group, and option group submodules. ## Source ``` ./modules/db_instance ``` ## Usage To use this submodule directly: ```hcl theme={null} module "db_instance" { source = "terraform-aws-modules/rds/aws//modules/db_instance" version = "~> 7.0" identifier = "mydb" engine = "postgres" engine_version = "17" instance_class = "db.t4g.large" allocated_storage = 20 db_name = "myapp" username = "dbadmin" password_wo = var.db_password password_wo_version = 1 manage_master_user_password = false db_subnet_group_name = module.db_subnet_group.db_subnet_group_id parameter_group_name = module.db_parameter_group.db_parameter_group_id vpc_security_group_ids = [aws_security_group.rds.id] tags = { Environment = "production" } } ``` In most cases, use the root module (`terraform-aws-modules/rds/aws`) rather than this submodule directly. The root module creates and wires together the subnet group, parameter group, and option group automatically. ## Input variables Whether to create the DB instance and all associated resources. Set to `false` to skip all resource creation. Default: `true` Region where this resource will be managed. Defaults to the region set in the provider configuration. Default: `null` The name of the RDS instance. Determines whether to use `identifier` as-is or create a unique identifier beginning with `identifier` as the specified prefix. Default: `false` The database engine to use. Not required when `replicate_source_db` is set. Default: `null` The engine version to use. Default: `null` The life cycle type for this DB instance. Applies only to RDS for MySQL and RDS for PostgreSQL. Valid values: `open-source-rds-extended-support`, `open-source-rds-extended-support-disabled`. Default: `null` The instance type of the RDS instance (e.g. `db.t3.micro`, `db.r6g.large`). Default: `null` The allocated storage in gigabytes. Default: `null` One of `standard`, `gp2`, `gp3`, or `io1`. Defaults to `io1` if `iops` is specified, `gp2` otherwise. Default: `null` Specifies whether the DB instance is encrypted. Default: `true` The ARN for the KMS encryption key. Default: `null` Enables Storage Autoscaling when set to a value greater than `allocated_storage`. Set to `0` to disable. Default: `0` Storage throughput for `gp3` storage type. Default: `null` The amount of provisioned IOPS. Requires `storage_type` of `io1` or `gp3`. Default: `null` Use a dedicated log volume (DLV) for the DB instance. Requires Provisioned IOPS. Default: `false` RDS custom IAM instance profile name. Default: `null` The DB name to create. If omitted, no database is created initially. Default: `null` Username for the master DB user. Ignored when `replicate_source_db` is set. Default: `null` Write-only, ephemeral password for the master DB user. Not used when `manage_master_user_password` is `true` or `replicate_source_db` is set. Default: `null` Version counter for `password_wo`. Increment to trigger a password update. Default: `null` Set to `true` to let RDS manage the master user password via Secrets Manager. Default: `true` KMS key ARN/ID/alias for encrypting the Secrets Manager secret. Default: `null` The port on which the DB accepts connections. Default: `null` List of VPC security group IDs to associate. Default: `[]` Name of the DB subnet group for the instance. Default: `null` Name of the DB parameter group to associate. Default: `null` Name of the DB option group to associate. Default: `null` Bool to control if instance is publicly accessible. Default: `false` Specifies if the RDS instance is multi-AZ. Default: `false` The Availability Zone of the RDS instance. Default: `null` The type of network stack to use. Valid values: `IPV4`, `DUAL`. Default: `null` Indicates whether to enable a customer-owned IP address (CoIP) for an RDS on Outposts DB instance. Default: `null` The days to retain backups for. Default: `null` The daily time range (UTC) during which automated backups are created. Default: `null` On delete, copy all Instance tags to the final snapshot. Default: `true` If `true`, no final snapshot is created on deletion. Default: `false` Prefix for the final snapshot identifier. Default: `"final"` Specifies whether to remove automated backups immediately after the DB instance is deleted. Default: `true` Snapshot ID from which to create the DB instance. Default: `null` Restore to a point in time. MySQL is not supported. See [inputs reference](/reference/inputs) for the full object schema. Default: `null` Restore from a Percona Xtrabackup in S3. Only MySQL is supported. See [inputs reference](/reference/inputs) for the full object schema. Default: `null` The window to perform maintenance in. Default: `null` Apply database modifications immediately rather than during the next maintenance window. Default: `false` Allow major engine version upgrades. Default: `false` Automatically apply minor engine upgrades during the maintenance window. Default: `true` Enable low-downtime updates using RDS Blue/Green deployments. Default: `null` Upgrade the storage file system configuration on the read replica. Default: `null` Enhanced Monitoring collection interval in seconds. Valid values: `0`, `1`, `5`, `10`, `15`, `30`, `60`. Use `0` to disable. Default: `0` ARN of the IAM role for Enhanced Monitoring. Required when `monitoring_interval > 0` and `create_monitoring_role = false`. Default: `null` Name of the IAM role to create for Enhanced Monitoring. Default: `"rds-monitoring-role"` Use `monitoring_role_name` as a prefix instead of an exact name. Default: `false` Description of the monitoring IAM role. Default: `null` Create an IAM role for Enhanced Monitoring. Default: `false` ARN of the permissions boundary policy for the monitoring IAM role. Default: `null` Enable Performance Insights. Default: `false` Days to retain Performance Insights data. Valid values: `7`, `731`, or a multiple of `31`. Default: `7` KMS key ARN for encrypting Performance Insights data. Default: `null` Database Insights mode. Valid values: `standard`, `advanced`. Default: `null` Log types to export to CloudWatch Logs. Default: `[]` Create CloudWatch log groups for each export type. Not created when `use_identifier_prefix` is `true`. Default: `false` Days to retain CloudWatch logs. Default: `7` KMS key ARN for encrypting CloudWatch log data. Default: `null` Preserve log groups on destroy. Default: `null` Log group class. Valid values: `STANDARD`, `INFREQUENT_ACCESS`. Default: `null` Additional tags for the CloudWatch log group(s). Default: `{}` Manage master user password rotation via Secrets Manager. Requires `manage_master_user_password = true`. Default: `false` Rotate the secret immediately on next apply. Default: `null` Days between automatic rotations. Default: `null` Length of the rotation window in hours (e.g. `3h`). Default: `null` `cron()` or `rate()` expression for the rotation schedule. Default: `null` ID of the Directory Service Active Directory domain. Default: `null` ARN of the Secrets Manager secret with Active Directory credentials. Default: `null` IPv4 DNS IPs of Active Directory domain controllers. Default: `null` FQDN of the self-managed Active Directory domain. Default: `null` Name of the IAM role for Directory Service API calls. Default: `null` Active Directory organizational unit for the DB instance. Default: `null` Identifier of the source DB instance to replicate. Default: `null` Oracle replica mode. Valid values: `mounted`, `open-read-only`. Default: `null` Character set name for Oracle instances. Cannot be changed after creation. Default: `null` National character set for Oracle NCHAR/NVARCHAR2/NCLOB columns. Cannot be changed after creation. Default: `null` DB instance timezone. Only supported by Microsoft SQL Server. Default: `null` License model for the DB instance. Required for some engines. Default: `null` Enable IAM database authentication. Default: `false` Prevent the instance from being deleted. Default: `false` Identifier of the CA certificate for the DB instance. Default: `null` Tags to assign to all resources. Default: `{}` Additional tags for the DB instance only. Default: `{}` Terraform resource management timeouts for `aws_db_instance`. Supports `create`, `update`, and `delete` keys with duration strings (e.g. `40m`). Default: `null` ## Outputs The hostname of the RDS instance. The ARN of the RDS instance. The Availability Zone of the RDS instance. The connection endpoint in `address:port` format. The listener connection endpoint for SQL Server Always On. The database engine. The running version of the database engine. The canonical hosted zone ID of the DB instance. The RDS instance identifier. The RDS Resource ID of this instance. The RDS instance status. The database name. The master username for the database. Sensitive. The database port. The CA certificate identifier. The ID of the Active Directory domain the instance is joined to. The ARN of the Active Directory credentials secret. The DNS IP addresses of the Active Directory domain controllers. The FQDN of the Active Directory domain. The IAM role name used for Directory Service API calls. The Active Directory organizational unit the instance joined. The ARN of the Secrets Manager secret for the master user password. The upgrade rollout order for the instance. Map of CloudWatch log groups created for the DB instance. Whether automatic Secrets Manager rotation is enabled. The name of the Enhanced Monitoring IAM role. The ARN of the Enhanced Monitoring IAM role.