Input variables

Complete reference for all input variables accepted by the terraform-aws-rds root module.

The root module (terraform-aws-modules/rds/aws) accepts the following input variables. Only identifier is required; all other variables have defaults.

Instance

identifier · string · required

The name of the RDS instance. Used as the base name for all related resources.

instance_use_identifier_prefix · bool

Determines whether to use identifier as-is or create a unique identifier beginning with identifier as the specified prefix.

Default: false

engine · string

The database engine to use (e.g. mysql, postgres, oracle-se2, sqlserver-ex).

Default: null

engine_version · string

The engine version to use (e.g. 8.0.35, 15.4).

Default: null

engine_lifecycle_support · string

The life cycle type for this DB instance. Applies only to RDS for MySQL and RDS for PostgreSQL. Valid values: open-source-rds-extended-support, open-source-rds-extended-support-disabled. AWS default is open-source-rds-extended-support.

Default: null

instance_class · string

The instance type of the RDS instance (e.g. db.t3.micro, db.r6g.large).

Default: null

allocated_storage · number

The allocated storage in gigabytes.

Default: null

storage_type · string

One of standard (magnetic), gp2 (general purpose SSD), gp3 (new generation of general purpose SSD), or io1 (provisioned IOPS SSD). The default is io1 if iops is specified, gp2 if not. If you specify io1 or gp3, you must also include a value for the iops parameter.

Default: null

storage_encrypted · bool

Specifies whether the DB instance is encrypted.

Default: true

kms_key_id · string

The ARN for the KMS encryption key. If creating an encrypted replica, set this to the destination KMS ARN. If storage_encrypted is set to true and kms_key_id is not specified, the default KMS key created in your account will be used. Use the full ARN, not a key alias.

Default: null

max_allocated_storage · number

Specifies the value for Storage Autoscaling. Set to a value greater than allocated_storage to enable autoscaling. Set to 0 to disable.

Default: 0

storage_throughput · number

Storage throughput value for the DB instance. See notes for limitations regarding this variable for gp3.

Default: null

iops · number

The amount of provisioned IOPS. Setting this implies a storage_type of io1 or gp3. See notes for limitations regarding this variable for gp3.

Default: null

dedicated_log_volume · bool

Use a dedicated log volume (DLV) for the DB instance. Requires Provisioned IOPS.

Default: false

Database

db_name · string

The DB name to create. If omitted, no database is created initially.

Default: null

username · string

Username for the master DB user.

Default: null

password_wo · string

Write-only password for the master DB user. Required unless manage_master_user_password is set to true, or snapshot_identifier / replicate_source_db is provided. This is a sensitive, ephemeral variable — it will not be stored in Terraform state.

Default: null

password_wo_version · number

Used together with password_wo to trigger an update. Increment this value when a password change is required.

Default: null

port · string

The port on which the DB accepts connections. Defaults to the engine default if not specified.

Default: null

character_set_name · string

The character set name to use for DB encoding in Oracle instances. Cannot be changed after creation. See Oracle Character Sets Supported in Amazon RDS and Collations and Character Sets for Microsoft SQL Server for more information.

Default: null

nchar_character_set_name · string

The national character set used in the NCHAR, NVARCHAR2, and NCLOB data types for Oracle instances. Cannot be changed after creation.

Default: null

timezone · string

Time zone of the DB instance. Currently only supported by Microsoft SQL Server. Can only be set on creation.

Default: null

license_model · string

License model information for this DB instance. Optional, but required for some DB engines (e.g. Oracle SE1). Valid values: license-included, bring-your-own-license, general-public-license.

Default: null

Authentication

manage_master_user_password · bool

Set to true to allow RDS to manage the master user password in Secrets Manager. Cannot be set if password_wo is provided.

Default: true

master_user_secret_kms_key_id · string

The key ARN, key ID, alias ARN, or alias name for the KMS key to encrypt the master user password secret in Secrets Manager. If not specified, the default KMS key for your AWS account is used.

Default: null

manage_master_user_password_rotation · bool

Whether to manage the master user password rotation. By default, rotation is managed by RDS on creation. Setting this value to false after previously having been set to true will disable automatic rotation.

Default: false

master_user_password_rotate_immediately · bool

Specifies whether to rotate the secret immediately or wait until the next scheduled rotation window.

Default: null

master_user_password_rotation_automatically_after_days · number

Specifies the number of days between automatic scheduled rotations of the secret. Either automatically_after_days or schedule_expression must be specified.

Default: null

master_user_password_rotation_duration · string

The length of the rotation window in hours (e.g. 3h for a three-hour window).

Default: null

master_user_password_rotation_schedule_expression · string

A cron() or rate() expression that defines the schedule for rotating your secret. Either automatically_after_days or schedule_expression must be specified.

Default: null

iam_database_authentication_enabled · bool

Specifies whether IAM database authentication is enabled, which allows IAM users and roles to authenticate to the DB instance.

Default: false

Network

vpc_security_group_ids · list(string)

List of VPC security group IDs to associate with the DB instance.

Default: []

publicly_accessible · bool

Bool to control if instance is publicly accessible. When false, the instance can only be accessed from within the VPC.

Default: false

multi_az · bool

Specifies if the RDS instance is multi-AZ. Enables high availability with an automatic failover standby in a different Availability Zone.

Default: false

availability_zone · string

The Availability Zone of the RDS instance. Cannot be set when multi_az is true.

Default: null

network_type · string

The type of network stack to use. Valid values: IPV4, DUAL.

Default: null

customer_owned_ip_enabled · bool

Indicates whether to enable a customer-owned IP address (CoIP) for an RDS on Outposts DB instance.

Default: null

Subnet Group

create_db_subnet_group · bool

Whether to create a database subnet group. If false, db_subnet_group_name must reference an existing subnet group.

Default: false

db_subnet_group_name · string

Name of the DB subnet group. The DB instance will be created in the VPC associated with this group. If unspecified, the instance will be created in the default VPC.

Default: null

db_subnet_group_use_name_prefix · bool

Determines whether to use db_subnet_group_name as-is or create a unique name beginning with db_subnet_group_name as the prefix.

Default: true

db_subnet_group_description · string

Description of the DB subnet group to create.

Default: null

subnet_ids · list(string)

A list of VPC subnet IDs to use when creating the DB subnet group.

Default: []

Parameter Group

create_db_parameter_group · bool

Whether to create a database parameter group.

Default: true

parameter_group_name · string

Name of the DB parameter group to associate or create.

Default: null

parameter_group_use_name_prefix · bool

Determines whether to use parameter_group_name as-is or create a unique name beginning with parameter_group_name as the prefix.

Default: true

parameter_group_description · string

Description of the DB parameter group to create.

Default: null

family · string

The family of the DB parameter group (e.g. mysql8.0, postgres15).

Default: null

parameters · list(object)

A list of DB parameters to apply to the parameter group.

Default: null

Show Object schema

name · string · required

The name of the DB parameter.

value · string · required

The value of the DB parameter.

apply_method · string

When to apply the parameter. Valid values: immediate, pending-reboot. Default is immediate.

parameter_group_skip_destroy · bool

Set to true if you do not wish the parameter group to be deleted at destroy time. The parameter group is instead removed from Terraform state only.

Default: null

Option Group

create_db_option_group · bool

Whether to create a database option group.

Default: true

option_group_name · string

Name of the option group to associate or create.

Default: null

option_group_use_name_prefix · bool

Determines whether to use option_group_name as-is or create a unique name beginning with option_group_name as the prefix.

Default: true

option_group_description · string

The description of the option group.

Default: null

major_engine_version · string

Specifies the major version of the engine that this option group should be associated with (e.g. 8.0, 15).

Default: null

options · list(object)

A list of options to apply to the option group.

Default: null

Show Object schema

option_name · string · required

The name of the option (e.g. MARIADB_AUDIT_PLUGIN).

port · number

The port number used by the option.

version · string

The version of the option.

db_security_group_memberships · list(string)

A list of DB security groups to apply the option to.

vpc_security_group_memberships · list(string)

A list of VPC security group IDs to apply the option to.

option_settings · list(object)

A list of key-value option settings.

Show option_settings schema

name · string · required

Setting name.

value · string · required

Setting value.

option_group_skip_destroy · bool

Set to true if you do not wish the option group to be deleted at destroy time. The option group is instead removed from Terraform state only.

Default: null

Backup & Recovery

backup_retention_period · number

The number of days to retain automated backups. Must be between 0 and 35. Set to 0 to disable automated backups.

Default: null

backup_window · string

The daily time range (in UTC) during which automated backups are created if they are enabled. Format: HH:MM-HH:MM (e.g. 09:46-10:16). Must not overlap with maintenance_window.

Default: null

copy_tags_to_snapshot · bool

On delete, copy all instance tags to the final snapshot.

Default: true

skip_final_snapshot · bool

Determines whether a final DB snapshot is created before the DB instance is deleted. If true, no snapshot is created.

Default: false

final_snapshot_identifier_prefix · string

The prefix for the final snapshot identifier on cluster destroy. The full identifier will be {prefix}-{identifier}-{random_hex}.

Default: "final"

delete_automated_backups · bool

Specifies whether to remove automated backups immediately after the DB instance is deleted.

Default: true

snapshot_identifier · string

Specifies whether or not to create this database from a snapshot. This correlates to the snapshot ID shown in the RDS console (e.g. rds:production-2015-06-26-06-05).

Default: null

restore_to_point_in_time · object

Restore to a point in time. MySQL is not supported.

Default: null

Show Object schema

restore_time · string

The date and time to restore from in UTC format (e.g. 2023-01-01T00:00:00Z).

source_db_instance_automated_backups_arn · string

ARN of the automated backup from which to restore.

source_db_instance_identifier · string

Identifier of the source DB instance from which to restore.

source_dbi_resource_id · string

The resource ID of the source DB instance.

use_latest_restorable_time · bool

Whether to restore to the latest restorable time. Conflicts with restore_time.

s3_import · object

Restore from a Percona Xtrabackup stored in S3. Only MySQL is supported.

Default: null

Show Object schema

source_engine_version · string · required

The version of the MySQL database in the S3 backup.

bucket_name · string · required

The name of the S3 bucket containing the backup.

bucket_prefix · string

The key prefix for the S3 bucket. If not specified, the entire bucket is used.

ingestion_role · string · required

The ARN of the IAM role with access to the S3 bucket.

Maintenance

maintenance_window · string

The window to perform maintenance in. Format: ddd:hh24:mi-ddd:hh24:mi (e.g. Mon:00:00-Mon:03:00).

Default: null

apply_immediately · bool

Specifies whether any database modifications are applied immediately or during the next maintenance window.

Default: false

allow_major_version_upgrade · bool

Indicates that major version upgrades are allowed. Changing this parameter does not result in an outage.

Default: false

auto_minor_version_upgrade · bool

Indicates that minor engine upgrades will be applied automatically during the maintenance window.

Default: true

blue_green_update · object

Enables low-downtime updates using RDS Blue/Green deployments. When enabled, backup_retention_period must be at least 1.

Default: null

Show Object schema

enabled · bool

Whether to enable Blue/Green deployments for updates.

upgrade_storage_config · bool

Whether to upgrade the storage file system configuration on the read replica. Can only be set with replicate_source_db.

Default: null

Monitoring

monitoring_interval · number

The interval in seconds between points when Enhanced Monitoring metrics are collected for the DB instance. To disable, specify 0. Valid values: 0, 1, 5, 10, 15, 30, 60.

Default: 0

monitoring_role_arn · string

The ARN for the IAM role that permits RDS to send enhanced monitoring metrics to CloudWatch Logs. Must be specified if monitoring_interval is non-zero and create_monitoring_role is false.

Default: null

monitoring_role_name · string

Name of the IAM role which will be created when create_monitoring_role is enabled.

Default: "rds-monitoring-role"

monitoring_role_use_name_prefix · bool

Determines whether to use monitoring_role_name as-is or create a unique identifier beginning with monitoring_role_name as the prefix.

Default: false

monitoring_role_description · string

Description of the monitoring IAM role.

Default: null

create_monitoring_role · bool

Create an IAM role with a defined name that permits RDS to send enhanced monitoring metrics to CloudWatch Logs.

Default: false

monitoring_role_permissions_boundary · string

ARN of the policy used to set the permissions boundary for the monitoring IAM role.

Default: null

performance_insights_enabled · bool

Specifies whether Performance Insights are enabled.

Default: false

performance_insights_retention_period · number

The amount of time in days to retain Performance Insights data. Valid values: 7, 731 (2 years), or a multiple of 31.

Default: 7

performance_insights_kms_key_id · string

The ARN for the KMS key to encrypt Performance Insights data.

Default: null

database_insights_mode · string

The mode of Database Insights enabled for the instance. Valid values: standard, advanced.

Default: null

CloudWatch Logs

enabled_cloudwatch_logs_exports · list(string)

List of log types to export to CloudWatch Logs. Valid values depend on the engine: alert, audit, error, general, listener, slowquery, trace, postgresql (PostgreSQL only), upgrade (PostgreSQL only).

Default: []

create_cloudwatch_log_group · bool

Determines whether a CloudWatch log group is created for each entry in enabled_cloudwatch_logs_exports. Log groups are not created when using an identifier prefix.

Default: false

cloudwatch_log_group_retention_in_days · number

The number of days to retain CloudWatch logs for the DB instance.

Default: 7

cloudwatch_log_group_kms_key_id · string

The ARN of the KMS key to use when encrypting CloudWatch log data.

Default: null

cloudwatch_log_group_skip_destroy · bool

Set to true if you do not wish the log group (and any logs it may contain) to be deleted at destroy time. The log group is instead removed from Terraform state only.

Default: null

cloudwatch_log_group_class · string

The log class of the log group. Possible values: STANDARD, INFREQUENT_ACCESS.

Default: null

Security

deletion_protection · bool

The database cannot be deleted when this value is set to true. To delete the instance, set this to false and apply before destroying.

Default: false

ca_cert_identifier · string

Specifies the identifier of the CA certificate for the DB instance (e.g. rds-ca-rsa2048-g1).

Default: null

custom_iam_instance_profile · string

RDS custom IAM instance profile name.

Default: null

Active Directory

domain · string

The ID of the Directory Service Active Directory domain to create the instance in (e.g. d-1234567890). Conflicts with domain_fqdn and domain_auth_secret_arn.

Default: null

domain_auth_secret_arn · string

The ARN for the Secrets Manager secret with the self-managed Active Directory credentials for the user joining the domain. Required if domain_fqdn is provided. Conflicts with domain and domain_iam_role_name.

Default: null

domain_dns_ips · list(string)

The IPv4 DNS IP addresses of your primary and secondary self-managed Active Directory domain controllers. Two IP addresses must be provided. Required if domain_fqdn is provided. Conflicts with domain and domain_iam_role_name.

Default: null

domain_fqdn · string

The fully qualified domain name (FQDN) of the self-managed Active Directory domain. Conflicts with domain and domain_iam_role_name.

Default: null

domain_iam_role_name · string

The name of the IAM role to be used when making API calls to the Directory Service. Required if domain is provided.

Default: null

domain_ou · string

The self-managed Active Directory organizational unit for the DB instance to join. Required if domain_fqdn is provided. Conflicts with domain and domain_iam_role_name.

Default: null

Replicas

replicate_source_db · string

Specifies that this resource is a read replica, and designates the source DB instance identifier to replicate from. When set, many configuration values are inherited from the source instance.

Default: null

replica_mode · string

Specifies whether the replica is in mounted or open-read-only mode. Only supported by Oracle instances.

Default: null

Role Association

db_instance_role_associations · map(string)

A map of DB instance supported feature names to IAM role ARNs. The module creates one aws_db_instance_role_association resource for each map entry.

Default: {}

Example:

db_instance_role_associations = {
  s3_integration = "arn:aws:iam::123456789012:role/rds-s3-integration-role"
}

Tags

tags · map(string)

A mapping of tags to assign to all resources created by this module.

Default: {}

db_instance_tags · map(string)

Additional tags for the DB instance only. Merged with tags.

Default: {}

db_subnet_group_tags · map(string)

Additional tags for the DB subnet group only. Merged with tags.

Default: {}

db_parameter_group_tags · map(string)

Additional tags for the DB parameter group only. Merged with tags.

Default: {}

db_option_group_tags · map(string)

Additional tags for the DB option group only. Merged with tags.

Default: {}

cloudwatch_log_group_tags · map(string)

Additional tags for the CloudWatch log group(s) only. Merged with tags.

Default: {}

Timeouts

timeouts · object

Updated Terraform resource management timeouts for aws_db_instance. Use to permit longer resource management times for slow operations.

Default: null

Show Object schema

create · string

Timeout for creating the DB instance (e.g. 40m).

update · string

Timeout for updating the DB instance (e.g. 80m).

delete · string

Timeout for deleting the DB instance (e.g. 60m).

option_group_timeouts · object

Define the maximum timeout for deletion of the aws_db_option_group resource.

Default: null

Show Object schema

delete · string

Timeout for deleting the option group (e.g. 15m).

Region

region · string

Region where this resource will be managed. Defaults to the region set in the provider configuration. Useful for multi-region deployments.

Default: null