Amazon Aurora
Overview
This service contains code to deploy an Amazon Relational Database Service (RDS) cluster that can run Amazon Aurora, Amazon’s cloud-native relational database. The cluster is managed by AWS and automatically handles standby failover, read replicas, backups, patching, and encryption.
RDS architecture
Features
- Deploy a fully-managed, cloud-native relational database
- MySQL and PostgreSQL compatibility
- Automatic failover to a standby in another availability zone
- Read replicas
- Automatic nightly snapshots
- Automatic cross account snapshots
- Automatic scaling of storage
- Scale to 0 with Aurora Serverless
- Integrate with Kubernetes Service Discovery
- Support Aurora Serverless v2
Learn
This repo is a part of the Gruntwork Service Catalog, a collection of reusable, battle-tested, production ready infrastructure code. If you’ve never used the Service Catalog before, make sure to read How to use the Gruntwork Service Catalog!
- What is Amazon RDS?
- Common gotchas with RDS
- Aurora Serverless documentation: Amazon’s docs for Aurora Serverless, including its advantages, limitations, architecture, and scaling configurations.
- RDS documentation: Amazon’s docs for RDS that cover core concepts such a the types of databases supported, security, backup & restore, and monitoring.
- Designing Data Intensive Applications: the best book we’ve found for understanding data systems, including relational databases, NoSQL, replication, sharding, consistency, and so on.
Deploy
Non-production deployment (quick start for learning)
If you just want to try this repo out for experimenting and learning, check out the following resources:
- examples/for-learning-and-testing folder: The
examples/for-learning-and-testing
folder contains standalone sample code optimized for learning, experimenting, and testing (but not direct production usage).
Production deployment
If you want to deploy this repo in production, check out the following resources:
- examples/for-production folder: The
examples/for-production
folder contains sample code optimized for direct usage in production. This is code from the Gruntwork Reference Architecture, and it shows you how we build an end-to-end, integrated tech stack on top of the Gruntwork Service Catalog.
Sample Usage
- Terraform
- Terragrunt
# ------------------------------------------------------------------------------------------------------
# DEPLOY GRUNTWORK'S AURORA MODULE
#
# NOTE: This module uses some sensitive variables marked inline with "# SENSITIVE".
# When using values other than defaults for these variables, set them through environment variables or
# another secure method.
#
# ------------------------------------------------------------------------------------------------------
module "aurora" {
source = "git::git@github.com:gruntwork-io/terraform-aws-service-catalog.git//modules/data-stores/aurora?ref=v0.115.4"
# ----------------------------------------------------------------------------------------------------
# REQUIRED VARIABLES
# ----------------------------------------------------------------------------------------------------
# The list of IDs of the subnets in which to deploy Aurora. The list must only
# contain subnets in var.vpc_id.
aurora_subnet_ids = <list(string)>
# The name used to namespace all the Aurora resources created by these
# templates, including the cluster and cluster instances (e.g. drupaldb). Must
# be unique in this region. Must be a lowercase string.
name = <string>
# The ID of the VPC in which to deploy Aurora.
vpc_id = <string>
# ----------------------------------------------------------------------------------------------------
# OPTIONAL VARIABLES
# ----------------------------------------------------------------------------------------------------
# The ARNs of SNS topics where CloudWatch alarms (e.g., for CPU, memory, and
# disk space usage) should send notifications. Also used for the alarms if the
# share snapshot backup job fails.
alarms_sns_topic_arns = []
# The list of network CIDR blocks to allow network access to Aurora from. One
# of var.allow_connections_from_cidr_blocks or
# var.allow_connections_from_security_groups must be specified for the
# database to be reachable.
allow_connections_from_cidr_blocks = []
# The list of IDs or Security Groups to allow network access to Aurora from.
# All security groups must either be in the VPC specified by var.vpc_id, or a
# peered VPC with the VPC specified by var.vpc_id. One of
# var.allow_connections_from_cidr_blocks or
# var.allow_connections_from_security_groups must be specified for the
# database to be reachable.
allow_connections_from_security_groups = []
# Enable to allow major engine version upgrades when changing engine versions.
allow_major_version_upgrade = false
# Specifies whether any cluster modifications are applied immediately, or
# during the next maintenance window. Note that cluster modifications may
# cause degraded performance or downtime.
apply_immediately = false
# Configure the auto minor version upgrade behavior. This is applied to the
# cluster instances and indicates if the automatic minor version upgrade of
# the engine is allowed. Default value is true.
auto_minor_version_upgrade = true
# How often, in seconds, the backup job is expected to run. This is the same
# as var.schedule_expression, but unfortunately, Terraform offers no way to
# convert rate expressions to seconds. We add a CloudWatch alarm that triggers
# if the metric in var.create_snapshot_cloudwatch_metric_namespace isn't
# updated within this time period, as that indicates the backup failed to run.
backup_job_alarm_period = 3600
# Sets how the backup job alarm should handle entering the INSUFFICIENT_DATA
# state. Based on
# https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data.
# Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'.
backup_job_alarm_treat_missing_data = "missing"
# How many days to keep backup snapshots around before cleaning them up. Max:
# 35
backup_retention_period = 30
# The Certificate Authority (CA) certificate bundle to use on the Aurora DB
# instances. Possible values: rds-ca-2019 (default if nothing is specified),
# rds-ca-rsa2048-g1, rds-ca-rsa4096-g1, rds-ca-ecc384-g1.
ca_cert_identifier = null
# Copy all the Aurora cluster tags to snapshots. Default is false.
copy_tags_to_snapshot = false
# Set to true if you want a DNS record automatically created and pointed at
# the RDS endpoints.
create_route53_entry = false
# The namespace to use for the CloudWatch metric we report every time a new
# RDS snapshot is created. We add a CloudWatch alarm on this metric to notify
# us if the backup job fails to run for any reason. Defaults to the cluster
# name.
create_snapshot_cloudwatch_metric_namespace = null
# A map of custom tags to apply to the RDS cluster and all associated
# resources created for it. The key is the tag name and the value is the tag
# value.
custom_tags = {}
# Parameters for the cpu usage widget to output for use in a CloudWatch
# dashboard.
dashboard_cpu_usage_widget_parameters = {"height":6,"period":60,"width":8}
# Parameters for the database connections widget to output for use in a
# CloudWatch dashboard.
dashboard_db_connections_widget_parameters = {"height":6,"period":60,"width":8}
# Parameters for the available disk space widget to output for use in a
# CloudWatch dashboard.
dashboard_disk_space_widget_parameters = {"height":6,"period":60,"width":8}
# Parameters for the available memory widget to output for use in a CloudWatch
# dashboard.
dashboard_memory_widget_parameters = {"height":6,"period":60,"width":8}
# Parameters for the read latency widget to output for use in a CloudWatch
# dashboard.
dashboard_read_latency_widget_parameters = {"height":6,"period":60,"width":8}
# Parameters for the read latency widget to output for use in a CloudWatch
# dashboard.
dashboard_write_latency_widget_parameters = {"height":6,"period":60,"width":8}
# Configure a custom parameter group for the RDS DB cluster. This will create
# a new parameter group with the given parameters. When null, the database
# will be launched with the default parameter group.
db_cluster_custom_parameter_group = null
# The friendly name or ARN of an AWS Secrets Manager secret that contains
# database configuration information in the format outlined by this document:
# https://docs.aws.amazon.com/secretsmanager/latest/userguide/best-practices.html.
# The engine, username, password, dbname, and port fields must be included in
# the JSON. Note that even with this precaution, this information will be
# stored in plaintext in the Terraform state file! See the following blog post
# for more details:
# https://blog.gruntwork.io/a-comprehensive-guide-to-managing-secrets-in-your-terraform-code-1d586955ace1.
# If you do not wish to use Secrets Manager, leave this as null, and use the
# master_username, master_password, db_name, engine, and port variables.
db_config_secrets_manager_id = null
# Configure a custom parameter group for the RDS DB Instance. This will create
# a new parameter group with the given parameters. When null, the database
# will be launched with the default parameter group.
db_instance_custom_parameter_group = null
# The name for your database of up to 8 alpha-numeric characters. If you do
# not provide a name, Amazon RDS will not create a database in the DB cluster
# you are creating. This can also be provided via AWS Secrets Manager. See the
# description of db_config_secrets_manager_id. A value here overrides the
# value in db_config_secrets_manager_id.
db_name = null
# Set to true to enable several basic CloudWatch alarms around CPU usage,
# memory usage, and disk space usage. If set to true, make sure to specify SNS
# topics to send notifications to using var.alarms_sns_topic_arn.
enable_cloudwatch_alarms = true
# When true, enable CloudWatch metrics for the manual snapshots created for
# the purpose of sharing with another account.
enable_cloudwatch_metrics = true
# Enable deletion protection on the database instance. If this is enabled, the
# database cannot be deleted.
enable_deletion_protection = false
# Set to true to enable alarms related to performance, such as read and write
# latency alarms. Set to false to disable those alarms if you aren't sure what
# would be reasonable perf numbers for your RDS set up or if those numbers are
# too unpredictable.
enable_perf_alarms = true
# When true, enable CloudWatch alarms for the manual snapshots created for the
# purpose of sharing with another account. Only used if
# var.share_snapshot_with_another_account is true.
enable_share_snapshot_cloudwatch_alarms = true
# If non-empty, the Aurora cluster will export the specified logs to
# Cloudwatch. Must be zero or more of: audit, error, general and slowquery
enabled_cloudwatch_logs_exports = []
# The name of the database engine to be used for this DB cluster. Valid
# Values: aurora (for MySQL 5.6-compatible Aurora), aurora-mysql (for MySQL
# 5.7-compatible Aurora), and aurora-postgresql. This can also be provided via
# AWS Secrets Manager. See the description of db_config_secrets_manager_id. A
# value here overrides the value in db_config_secrets_manager_id.
engine = null
# The version of aurora to run - provisioned or serverless.
engine_mode = "provisioned"
# The Amazon Aurora DB engine version for the selected engine and engine_mode.
# Note: Starting with Aurora MySQL 2.03.2, Aurora engine versions have the
# following syntax <mysql-major-version>.mysql_aurora.<aurora-mysql-version>.
# e.g. 5.7.mysql_aurora.2.08.1.
engine_version = null
# Global cluster identifier when creating the global secondary cluster.
global_cluster_identifier = null
# The period, in seconds, over which to measure the CPU utilization
# percentage.
high_cpu_utilization_period = 60
# Trigger an alarm if the DB instance has a CPU utilization percentage above
# this threshold.
high_cpu_utilization_threshold = 90
# Sets how this alarm should handle entering the INSUFFICIENT_DATA state.
# Based on
# https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data.
# Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'.
high_cpu_utilization_treat_missing_data = "missing"
# The period, in seconds, over which to measure the read latency.
high_read_latency_period = 60
# Trigger an alarm if the DB instance read latency (average amount of time
# taken per disk I/O operation), in seconds, is above this threshold.
high_read_latency_threshold = 5
# Sets how this alarm should handle entering the INSUFFICIENT_DATA state.
# Based on
# https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data.
# Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'.
high_read_latency_treat_missing_data = "missing"
# The period, in seconds, over which to measure the write latency.
high_write_latency_period = 60
# Trigger an alarm if the DB instance write latency (average amount of time
# taken per disk I/O operation), in seconds, is above this threshold.
high_write_latency_threshold = 5
# Sets how this alarm should handle entering the INSUFFICIENT_DATA state.
# Based on
# https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data.
# Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'.
high_write_latency_treat_missing_data = "missing"
# The ID of the hosted zone in which to write DNS records
hosted_zone_id = null
# Specifies whether mappings of AWS Identity and Access Management (IAM)
# accounts to database accounts is enabled. Disabled by default.
iam_database_authentication_enabled = false
# The number of DB instances, including the primary, to run in the RDS
# cluster. Only used when var.engine_mode is set to provisioned.
instance_count = 1
# The instance type to use for the db (e.g. db.r3.large). Only used when
# var.engine_mode is set to provisioned.
instance_type = "db.t3.medium"
# The ARN of a KMS key that should be used to encrypt data on disk. Only used
# if var.storage_encrypted is true. If you leave this null, the default RDS
# KMS key for the account will be used.
kms_key_arn = null
# The period, in seconds, over which to measure the available free disk space.
low_disk_space_available_period = 60
# Trigger an alarm if the amount of disk space, in Bytes, on the DB instance
# drops below this threshold.
low_disk_space_available_threshold = 1000000000
# Sets how this alarm should handle entering the INSUFFICIENT_DATA state.
# Based on
# https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data.
# Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'.
low_disk_space_available_treat_missing_data = "missing"
# The period, in seconds, over which to measure the available free memory.
low_memory_available_period = 60
# Trigger an alarm if the amount of free memory, in Bytes, on the DB instance
# drops below this threshold.
low_memory_available_threshold = 100000000
# Sets how this alarm should handle entering the INSUFFICIENT_DATA state.
# Based on
# https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data.
# Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'.
low_memory_available_treat_missing_data = "missing"
# Set to true to allow RDS to manage the master user password in Secrets
# Manager. Cannot be set if password is provided.
manage_master_user_password = null
# The value to use for the master password of the database. This can also be
# provided via AWS Secrets Manager. See the description of
# db_config_secrets_manager_id. A value here overrides the value in
# db_config_secrets_manager_id.
master_password = null # SENSITIVE
# The value to use for the master username of the database. This can also be
# provided via AWS Secrets Manager. See the description of
# db_config_secrets_manager_id. A value here overrides the value in
# db_config_secrets_manager_id.
master_username = null
# Specifies whether Performance Insights is enabled or not. On Aurora MySQL,
# Performance Insights is not supported on db.t2 or db.t3 DB instance classes.
performance_insights_enabled = false
# The ARN for the KMS key to encrypt Performance Insights data.
performance_insights_kms_key_id = null
# The port the DB will listen on (e.g. 3306). This can also be provided via
# AWS Secrets Manager. See the description of db_config_secrets_manager_id. A
# value here overrides the value in db_config_secrets_manager_id.
port = null
# The daily time range during which automated backups are created (e.g.
# 04:00-09:00). Time zone is UTC. Performance may be degraded while a backup
# runs.
preferred_backup_window = "06:00-07:00"
# The weekly day and time range during which cluster maintenance can occur
# (e.g. wed:04:00-wed:04:30). Time zone is UTC. Performance may be degraded or
# there may even be a downtime during maintenance windows.
preferred_maintenance_window = "sun:07:00-sun:08:00"
# The domain name to create a route 53 record for the primary endpoint of the
# RDS database.
primary_domain_name = null
# If you wish to make your database accessible from the public Internet, set
# this flag to true (WARNING: NOT RECOMMENDED FOR REGULAR USAGE!!). The
# default is false, which means the database is only accessible from within
# the VPC, which is much more secure. This flag MUST be false for serverless
# mode.
publicly_accessible = false
# The domain name to create a route 53 record for the reader endpoint of the
# RDS database. Note that Aurora Serverless does not have reader endpoints, so
# this option is ignored when engine_mode is set to serverless.
reader_domain_name = null
# ARN of a source DB cluster or DB instance if this DB cluster is to be
# created as a Read Replica.
replication_source_identifier = null
# If non-empty, the Aurora cluster will be restored from the given source
# cluster using the latest restorable time. Can only be used if
# snapshot_identifier is null. For more information see
# https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_PIT.html
restore_source_cluster_identifier = null
# Only used if 'restore_source_cluster_identifier' is non-empty. Type of
# restore to be performed. Valid options are 'full-copy' and 'copy-on-write'.
# https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Managing.Clone.html
restore_type = null
# Whether to enable automatic pause. A DB cluster can be paused only when it's
# idle (it has no connections). If a DB cluster is paused for more than seven
# days, the DB cluster might be backed up with a snapshot. In this case, the
# DB cluster is restored when there is a request to connect to it. Only used
# when var.engine_mode is set to serverless.
scaling_configuration_auto_pause = true
# The maximum capacity. The maximum capacity must be greater than or equal to
# the minimum capacity. Valid capacity values are 2, 4, 8, 16, 32, 64, 128,
# and 256. Only used when var.engine_mode is set to serverless.
scaling_configuration_max_capacity = 256
scaling_configuration_max_capacity_V2 = null
# The minimum capacity. The minimum capacity must be lesser than or equal to
# the maximum capacity. Valid capacity values are 2, 4, 8, 16, 32, 64, 128,
# and 256. Only used when var.engine_mode is set to serverless.
scaling_configuration_min_capacity = 2
scaling_configuration_min_capacity_V2 = null
# The time, in seconds, before an Aurora DB cluster in serverless mode is
# paused. Valid values are 300 through 86400. Only used when var.engine_mode
# is set to serverless.
scaling_configuration_seconds_until_auto_pause = 300
# The maximum number of snapshots to keep around for the purpose of cross
# account sharing. Once this number is exceeded, a lambda function will delete
# the oldest snapshots. Only used if var.share_snapshot_with_another_account
# is true.
share_snapshot_max_snapshots = 30
# An expression that defines how often to run the lambda function to take
# snapshots for the purpose of cross account sharing. For example, cron(0 20 *
# * ? *) or rate(5 minutes). Required if
# var.share_snapshot_with_another_account is true
share_snapshot_schedule_expression = null
# The ID of the AWS Account that the snapshot should be shared with. Required
# if var.share_snapshot_with_another_account is true.
share_snapshot_with_account_id = null
# If set to true, take periodic snapshots of the Aurora DB that should be
# shared with another account.
share_snapshot_with_another_account = false
# Determines whether a final DB snapshot is created before the DB instance is
# deleted. Be very careful setting this to true; if you do, and you delete
# this DB instance, you will not have any backups of the data! You almost
# never want to set this to true, unless you are doing automated or manual
# testing.
skip_final_snapshot = false
# If non-null, the RDS Instance will be restored from the given Snapshot ID.
# This is the Snapshot ID you'd find in the RDS console, e.g:
# rds:production-2015-06-26-06-05.
snapshot_identifier = null
# Specifies whether the DB cluster uses encryption for data at rest in the
# underlying storage for the DB, its automated backups, Read Replicas, and
# snapshots. Uses the default aws/rds key in KMS.
storage_encrypted = true
# Trigger an alarm if the number of connections to the DB instance goes above
# this threshold.
too_many_db_connections_threshold = null
}
# ------------------------------------------------------------------------------------------------------
# DEPLOY GRUNTWORK'S AURORA MODULE
#
# NOTE: This module uses some sensitive variables marked inline with "# SENSITIVE".
# When using values other than defaults for these variables, set them through environment variables or
# another secure method.
#
# ------------------------------------------------------------------------------------------------------
terraform {
source = "git::git@github.com:gruntwork-io/terraform-aws-service-catalog.git//modules/data-stores/aurora?ref=v0.115.4"
}
inputs = {
# ----------------------------------------------------------------------------------------------------
# REQUIRED VARIABLES
# ----------------------------------------------------------------------------------------------------
# The list of IDs of the subnets in which to deploy Aurora. The list must only
# contain subnets in var.vpc_id.
aurora_subnet_ids = <list(string)>
# The name used to namespace all the Aurora resources created by these
# templates, including the cluster and cluster instances (e.g. drupaldb). Must
# be unique in this region. Must be a lowercase string.
name = <string>
# The ID of the VPC in which to deploy Aurora.
vpc_id = <string>
# ----------------------------------------------------------------------------------------------------
# OPTIONAL VARIABLES
# ----------------------------------------------------------------------------------------------------
# The ARNs of SNS topics where CloudWatch alarms (e.g., for CPU, memory, and
# disk space usage) should send notifications. Also used for the alarms if the
# share snapshot backup job fails.
alarms_sns_topic_arns = []
# The list of network CIDR blocks to allow network access to Aurora from. One
# of var.allow_connections_from_cidr_blocks or
# var.allow_connections_from_security_groups must be specified for the
# database to be reachable.
allow_connections_from_cidr_blocks = []
# The list of IDs or Security Groups to allow network access to Aurora from.
# All security groups must either be in the VPC specified by var.vpc_id, or a
# peered VPC with the VPC specified by var.vpc_id. One of
# var.allow_connections_from_cidr_blocks or
# var.allow_connections_from_security_groups must be specified for the
# database to be reachable.
allow_connections_from_security_groups = []
# Enable to allow major engine version upgrades when changing engine versions.
allow_major_version_upgrade = false
# Specifies whether any cluster modifications are applied immediately, or
# during the next maintenance window. Note that cluster modifications may
# cause degraded performance or downtime.
apply_immediately = false
# Configure the auto minor version upgrade behavior. This is applied to the
# cluster instances and indicates if the automatic minor version upgrade of
# the engine is allowed. Default value is true.
auto_minor_version_upgrade = true
# How often, in seconds, the backup job is expected to run. This is the same
# as var.schedule_expression, but unfortunately, Terraform offers no way to
# convert rate expressions to seconds. We add a CloudWatch alarm that triggers
# if the metric in var.create_snapshot_cloudwatch_metric_namespace isn't
# updated within this time period, as that indicates the backup failed to run.
backup_job_alarm_period = 3600
# Sets how the backup job alarm should handle entering the INSUFFICIENT_DATA
# state. Based on
# https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data.
# Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'.
backup_job_alarm_treat_missing_data = "missing"
# How many days to keep backup snapshots around before cleaning them up. Max:
# 35
backup_retention_period = 30
# The Certificate Authority (CA) certificate bundle to use on the Aurora DB
# instances. Possible values: rds-ca-2019 (default if nothing is specified),
# rds-ca-rsa2048-g1, rds-ca-rsa4096-g1, rds-ca-ecc384-g1.
ca_cert_identifier = null
# Copy all the Aurora cluster tags to snapshots. Default is false.
copy_tags_to_snapshot = false
# Set to true if you want a DNS record automatically created and pointed at
# the RDS endpoints.
create_route53_entry = false
# The namespace to use for the CloudWatch metric we report every time a new
# RDS snapshot is created. We add a CloudWatch alarm on this metric to notify
# us if the backup job fails to run for any reason. Defaults to the cluster
# name.
create_snapshot_cloudwatch_metric_namespace = null
# A map of custom tags to apply to the RDS cluster and all associated
# resources created for it. The key is the tag name and the value is the tag
# value.
custom_tags = {}
# Parameters for the cpu usage widget to output for use in a CloudWatch
# dashboard.
dashboard_cpu_usage_widget_parameters = {"height":6,"period":60,"width":8}
# Parameters for the database connections widget to output for use in a
# CloudWatch dashboard.
dashboard_db_connections_widget_parameters = {"height":6,"period":60,"width":8}
# Parameters for the available disk space widget to output for use in a
# CloudWatch dashboard.
dashboard_disk_space_widget_parameters = {"height":6,"period":60,"width":8}
# Parameters for the available memory widget to output for use in a CloudWatch
# dashboard.
dashboard_memory_widget_parameters = {"height":6,"period":60,"width":8}
# Parameters for the read latency widget to output for use in a CloudWatch
# dashboard.
dashboard_read_latency_widget_parameters = {"height":6,"period":60,"width":8}
# Parameters for the read latency widget to output for use in a CloudWatch
# dashboard.
dashboard_write_latency_widget_parameters = {"height":6,"period":60,"width":8}
# Configure a custom parameter group for the RDS DB cluster. This will create
# a new parameter group with the given parameters. When null, the database
# will be launched with the default parameter group.
db_cluster_custom_parameter_group = null
# The friendly name or ARN of an AWS Secrets Manager secret that contains
# database configuration information in the format outlined by this document:
# https://docs.aws.amazon.com/secretsmanager/latest/userguide/best-practices.html.
# The engine, username, password, dbname, and port fields must be included in
# the JSON. Note that even with this precaution, this information will be
# stored in plaintext in the Terraform state file! See the following blog post
# for more details:
# https://blog.gruntwork.io/a-comprehensive-guide-to-managing-secrets-in-your-terraform-code-1d586955ace1.
# If you do not wish to use Secrets Manager, leave this as null, and use the
# master_username, master_password, db_name, engine, and port variables.
db_config_secrets_manager_id = null
# Configure a custom parameter group for the RDS DB Instance. This will create
# a new parameter group with the given parameters. When null, the database
# will be launched with the default parameter group.
db_instance_custom_parameter_group = null
# The name for your database of up to 8 alpha-numeric characters. If you do
# not provide a name, Amazon RDS will not create a database in the DB cluster
# you are creating. This can also be provided via AWS Secrets Manager. See the
# description of db_config_secrets_manager_id. A value here overrides the
# value in db_config_secrets_manager_id.
db_name = null
# Set to true to enable several basic CloudWatch alarms around CPU usage,
# memory usage, and disk space usage. If set to true, make sure to specify SNS
# topics to send notifications to using var.alarms_sns_topic_arn.
enable_cloudwatch_alarms = true
# When true, enable CloudWatch metrics for the manual snapshots created for
# the purpose of sharing with another account.
enable_cloudwatch_metrics = true
# Enable deletion protection on the database instance. If this is enabled, the
# database cannot be deleted.
enable_deletion_protection = false
# Set to true to enable alarms related to performance, such as read and write
# latency alarms. Set to false to disable those alarms if you aren't sure what
# would be reasonable perf numbers for your RDS set up or if those numbers are
# too unpredictable.
enable_perf_alarms = true
# When true, enable CloudWatch alarms for the manual snapshots created for the
# purpose of sharing with another account. Only used if
# var.share_snapshot_with_another_account is true.
enable_share_snapshot_cloudwatch_alarms = true
# If non-empty, the Aurora cluster will export the specified logs to
# Cloudwatch. Must be zero or more of: audit, error, general and slowquery
enabled_cloudwatch_logs_exports = []
# The name of the database engine to be used for this DB cluster. Valid
# Values: aurora (for MySQL 5.6-compatible Aurora), aurora-mysql (for MySQL
# 5.7-compatible Aurora), and aurora-postgresql. This can also be provided via
# AWS Secrets Manager. See the description of db_config_secrets_manager_id. A
# value here overrides the value in db_config_secrets_manager_id.
engine = null
# The version of aurora to run - provisioned or serverless.
engine_mode = "provisioned"
# The Amazon Aurora DB engine version for the selected engine and engine_mode.
# Note: Starting with Aurora MySQL 2.03.2, Aurora engine versions have the
# following syntax <mysql-major-version>.mysql_aurora.<aurora-mysql-version>.
# e.g. 5.7.mysql_aurora.2.08.1.
engine_version = null
# Global cluster identifier when creating the global secondary cluster.
global_cluster_identifier = null
# The period, in seconds, over which to measure the CPU utilization
# percentage.
high_cpu_utilization_period = 60
# Trigger an alarm if the DB instance has a CPU utilization percentage above
# this threshold.
high_cpu_utilization_threshold = 90
# Sets how this alarm should handle entering the INSUFFICIENT_DATA state.
# Based on
# https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data.
# Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'.
high_cpu_utilization_treat_missing_data = "missing"
# The period, in seconds, over which to measure the read latency.
high_read_latency_period = 60
# Trigger an alarm if the DB instance read latency (average amount of time
# taken per disk I/O operation), in seconds, is above this threshold.
high_read_latency_threshold = 5
# Sets how this alarm should handle entering the INSUFFICIENT_DATA state.
# Based on
# https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data.
# Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'.
high_read_latency_treat_missing_data = "missing"
# The period, in seconds, over which to measure the write latency.
high_write_latency_period = 60
# Trigger an alarm if the DB instance write latency (average amount of time
# taken per disk I/O operation), in seconds, is above this threshold.
high_write_latency_threshold = 5
# Sets how this alarm should handle entering the INSUFFICIENT_DATA state.
# Based on
# https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data.
# Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'.
high_write_latency_treat_missing_data = "missing"
# The ID of the hosted zone in which to write DNS records
hosted_zone_id = null
# Specifies whether mappings of AWS Identity and Access Management (IAM)
# accounts to database accounts is enabled. Disabled by default.
iam_database_authentication_enabled = false
# The number of DB instances, including the primary, to run in the RDS
# cluster. Only used when var.engine_mode is set to provisioned.
instance_count = 1
# The instance type to use for the db (e.g. db.r3.large). Only used when
# var.engine_mode is set to provisioned.
instance_type = "db.t3.medium"
# The ARN of a KMS key that should be used to encrypt data on disk. Only used
# if var.storage_encrypted is true. If you leave this null, the default RDS
# KMS key for the account will be used.
kms_key_arn = null
# The period, in seconds, over which to measure the available free disk space.
low_disk_space_available_period = 60
# Trigger an alarm if the amount of disk space, in Bytes, on the DB instance
# drops below this threshold.
low_disk_space_available_threshold = 1000000000
# Sets how this alarm should handle entering the INSUFFICIENT_DATA state.
# Based on
# https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data.
# Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'.
low_disk_space_available_treat_missing_data = "missing"
# The period, in seconds, over which to measure the available free memory.
low_memory_available_period = 60
# Trigger an alarm if the amount of free memory, in Bytes, on the DB instance
# drops below this threshold.
low_memory_available_threshold = 100000000
# Sets how this alarm should handle entering the INSUFFICIENT_DATA state.
# Based on
# https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data.
# Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'.
low_memory_available_treat_missing_data = "missing"
# Set to true to allow RDS to manage the master user password in Secrets
# Manager. Cannot be set if password is provided.
manage_master_user_password = null
# The value to use for the master password of the database. This can also be
# provided via AWS Secrets Manager. See the description of
# db_config_secrets_manager_id. A value here overrides the value in
# db_config_secrets_manager_id.
master_password = null # SENSITIVE
# The value to use for the master username of the database. This can also be
# provided via AWS Secrets Manager. See the description of
# db_config_secrets_manager_id. A value here overrides the value in
# db_config_secrets_manager_id.
master_username = null
# Specifies whether Performance Insights is enabled or not. On Aurora MySQL,
# Performance Insights is not supported on db.t2 or db.t3 DB instance classes.
performance_insights_enabled = false
# The ARN for the KMS key to encrypt Performance Insights data.
performance_insights_kms_key_id = null
# The port the DB will listen on (e.g. 3306). This can also be provided via
# AWS Secrets Manager. See the description of db_config_secrets_manager_id. A
# value here overrides the value in db_config_secrets_manager_id.
port = null
# The daily time range during which automated backups are created (e.g.
# 04:00-09:00). Time zone is UTC. Performance may be degraded while a backup
# runs.
preferred_backup_window = "06:00-07:00"
# The weekly day and time range during which cluster maintenance can occur
# (e.g. wed:04:00-wed:04:30). Time zone is UTC. Performance may be degraded or
# there may even be a downtime during maintenance windows.
preferred_maintenance_window = "sun:07:00-sun:08:00"
# The domain name to create a route 53 record for the primary endpoint of the
# RDS database.
primary_domain_name = null
# If you wish to make your database accessible from the public Internet, set
# this flag to true (WARNING: NOT RECOMMENDED FOR REGULAR USAGE!!). The
# default is false, which means the database is only accessible from within
# the VPC, which is much more secure. This flag MUST be false for serverless
# mode.
publicly_accessible = false
# The domain name to create a route 53 record for the reader endpoint of the
# RDS database. Note that Aurora Serverless does not have reader endpoints, so
# this option is ignored when engine_mode is set to serverless.
reader_domain_name = null
# ARN of a source DB cluster or DB instance if this DB cluster is to be
# created as a Read Replica.
replication_source_identifier = null
# If non-empty, the Aurora cluster will be restored from the given source
# cluster using the latest restorable time. Can only be used if
# snapshot_identifier is null. For more information see
# https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_PIT.html
restore_source_cluster_identifier = null
# Only used if 'restore_source_cluster_identifier' is non-empty. Type of
# restore to be performed. Valid options are 'full-copy' and 'copy-on-write'.
# https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Managing.Clone.html
restore_type = null
# Whether to enable automatic pause. A DB cluster can be paused only when it's
# idle (it has no connections). If a DB cluster is paused for more than seven
# days, the DB cluster might be backed up with a snapshot. In this case, the
# DB cluster is restored when there is a request to connect to it. Only used
# when var.engine_mode is set to serverless.
scaling_configuration_auto_pause = true
# The maximum capacity. The maximum capacity must be greater than or equal to
# the minimum capacity. Valid capacity values are 2, 4, 8, 16, 32, 64, 128,
# and 256. Only used when var.engine_mode is set to serverless.
scaling_configuration_max_capacity = 256
scaling_configuration_max_capacity_V2 = null
# The minimum capacity. The minimum capacity must be lesser than or equal to
# the maximum capacity. Valid capacity values are 2, 4, 8, 16, 32, 64, 128,
# and 256. Only used when var.engine_mode is set to serverless.
scaling_configuration_min_capacity = 2
scaling_configuration_min_capacity_V2 = null
# The time, in seconds, before an Aurora DB cluster in serverless mode is
# paused. Valid values are 300 through 86400. Only used when var.engine_mode
# is set to serverless.
scaling_configuration_seconds_until_auto_pause = 300
# The maximum number of snapshots to keep around for the purpose of cross
# account sharing. Once this number is exceeded, a lambda function will delete
# the oldest snapshots. Only used if var.share_snapshot_with_another_account
# is true.
share_snapshot_max_snapshots = 30
# An expression that defines how often to run the lambda function to take
# snapshots for the purpose of cross account sharing. For example, cron(0 20 *
# * ? *) or rate(5 minutes). Required if
# var.share_snapshot_with_another_account is true
share_snapshot_schedule_expression = null
# The ID of the AWS Account that the snapshot should be shared with. Required
# if var.share_snapshot_with_another_account is true.
share_snapshot_with_account_id = null
# If set to true, take periodic snapshots of the Aurora DB that should be
# shared with another account.
share_snapshot_with_another_account = false
# Determines whether a final DB snapshot is created before the DB instance is
# deleted. Be very careful setting this to true; if you do, and you delete
# this DB instance, you will not have any backups of the data! You almost
# never want to set this to true, unless you are doing automated or manual
# testing.
skip_final_snapshot = false
# If non-null, the RDS Instance will be restored from the given Snapshot ID.
# This is the Snapshot ID you'd find in the RDS console, e.g:
# rds:production-2015-06-26-06-05.
snapshot_identifier = null
# Specifies whether the DB cluster uses encryption for data at rest in the
# underlying storage for the DB, its automated backups, Read Replicas, and
# snapshots. Uses the default aws/rds key in KMS.
storage_encrypted = true
# Trigger an alarm if the number of connections to the DB instance goes above
# this threshold.
too_many_db_connections_threshold = null
}
Reference
- Inputs
- Outputs
Required
aurora_subnet_ids
list(string)The list of IDs of the subnets in which to deploy Aurora. The list must only contain subnets in vpc_id
.
name
stringThe name used to namespace all the Aurora resources created by these templates, including the cluster and cluster instances (e.g. drupaldb). Must be unique in this region. Must be a lowercase string.
vpc_id
stringThe ID of the VPC in which to deploy Aurora.
Optional
alarms_sns_topic_arns
list(string)The ARNs of SNS topics where CloudWatch alarms (e.g., for CPU, memory, and disk space usage) should send notifications. Also used for the alarms if the share snapshot backup job fails.
[]
allow_connections_from_cidr_blocks
list(string)The list of network CIDR blocks to allow network access to Aurora from. One of allow_connections_from_cidr_blocks
or allow_connections_from_security_groups
must be specified for the database to be reachable.
[]
allow_connections_from_security_groups
list(string)The list of IDs or Security Groups to allow network access to Aurora from. All security groups must either be in the VPC specified by vpc_id
, or a peered VPC with the VPC specified by vpc_id
. One of allow_connections_from_cidr_blocks
or allow_connections_from_security_groups
must be specified for the database to be reachable.
[]
Enable to allow major engine version upgrades when changing engine versions.
false
Specifies whether any cluster modifications are applied immediately, or during the next maintenance window. Note that cluster modifications may cause degraded performance or downtime.
false
Configure the auto minor version upgrade behavior. This is applied to the cluster instances and indicates if the automatic minor version upgrade of the engine is allowed. Default value is true.
true
backup_job_alarm_period
numberHow often, in seconds, the backup job is expected to run. This is the same as schedule_expression
, but unfortunately, Terraform offers no way to convert rate expressions to seconds. We add a CloudWatch alarm that triggers if the metric in create_snapshot_cloudwatch_metric_namespace
isn't updated within this time period, as that indicates the backup failed to run.
3600
Details
Default to hourly
Sets how the backup job alarm should handle entering the INSUFFICIENT_DATA state. Based on https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'.
"missing"
backup_retention_period
numberHow many days to keep backup snapshots around before cleaning them up. Max: 35
30
ca_cert_identifier
stringThe Certificate Authority (CA) certificate bundle to use on the Aurora DB instances. Possible values: rds-ca-2019 (default if nothing is specified), rds-ca-rsa2048-g1, rds-ca-rsa4096-g1, rds-ca-ecc384-g1.
null
Copy all the Aurora cluster tags to snapshots. Default is false.
false
Set to true if you want a DNS record automatically created and pointed at the RDS endpoints.
false
The namespace to use for the CloudWatch metric we report every time a new RDS snapshot is created. We add a CloudWatch alarm on this metric to notify us if the backup job fails to run for any reason. Defaults to the cluster name.
null
custom_tags
map(string)A map of custom tags to apply to the RDS cluster and all associated resources created for it. The key is the tag name and the value is the tag value.
{}
Parameters for the cpu usage widget to output for use in a CloudWatch dashboard.
object({
# The period in seconds for metrics to sample across.
period = number
# The width and height of the widget in grid units in a 24 column grid. E.g., a value of 12 will take up half the
# space.
width = number
height = number
})
{
height = 6,
period = 60,
width = 8
}
Details
The width and height of the widget in grid units in a 24 column grid. E.g., a value of 12 will take up half the
space.
Parameters for the database connections widget to output for use in a CloudWatch dashboard.
object({
# The period in seconds for metrics to sample across.
period = number
# The width and height of the widget in grid units in a 24 column grid. E.g., a value of 12 will take up half the
# space.
width = number
height = number
})
{
height = 6,
period = 60,
width = 8
}
Details
The width and height of the widget in grid units in a 24 column grid. E.g., a value of 12 will take up half the
space.
Parameters for the available disk space widget to output for use in a CloudWatch dashboard.
object({
# The period in seconds for metrics to sample across.
period = number
# The width and height of the widget in grid units in a 24 column grid. E.g., a value of 12 will take up half the
# space.
width = number
height = number
})
{
height = 6,
period = 60,
width = 8
}
Details
The width and height of the widget in grid units in a 24 column grid. E.g., a value of 12 will take up half the
space.
dashboard_memory_widget_parameters
object(…)Parameters for the available memory widget to output for use in a CloudWatch dashboard.
object({
# The period in seconds for metrics to sample across.
period = number
# The width and height of the widget in grid units in a 24 column grid. E.g., a value of 12 will take up half the
# space.
width = number
height = number
})
{
height = 6,
period = 60,
width = 8
}
Details
The width and height of the widget in grid units in a 24 column grid. E.g., a value of 12 will take up half the
space.
Parameters for the read latency widget to output for use in a CloudWatch dashboard.
object({
# The period in seconds for metrics to sample across.
period = number
# The width and height of the widget in grid units in a 24 column grid. E.g., a value of 12 will take up half the
# space.
width = number
height = number
})
{
height = 6,
period = 60,
width = 8
}
Details
The width and height of the widget in grid units in a 24 column grid. E.g., a value of 12 will take up half the
space.
Parameters for the read latency widget to output for use in a CloudWatch dashboard.
object({
# The period in seconds for metrics to sample across.
period = number
# The width and height of the widget in grid units in a 24 column grid. E.g., a value of 12 will take up half the
# space.
width = number
height = number
})
{
height = 6,
period = 60,
width = 8
}
Details
The width and height of the widget in grid units in a 24 column grid. E.g., a value of 12 will take up half the
space.
db_cluster_custom_parameter_group
object(…)Configure a custom parameter group for the RDS DB cluster. This will create a new parameter group with the given parameters. When null, the database will be launched with the default parameter group.
object({
# Name of the parameter group to create
name = string
# The family of the DB cluster parameter group.
family = string
# The parameters to configure on the created parameter group.
parameters = list(object({
# Parameter name to configure.
name = string
# Vaue to set the parameter.
value = string
# When to apply the parameter. "immediate" or "pending-reboot".
apply_method = string
}))
})
null
Details
The family of the DB cluster parameter group.
Details
The parameters to configure on the created parameter group.
Details
Vaue to set the parameter.
Details
When to apply the parameter. "immediate" or "pending-reboot".
The friendly name or ARN of an AWS Secrets Manager secret that contains database configuration information in the format outlined by this document: https://docs.aws.amazon.com/secretsmanager/latest/userguide/best-practices.html. The engine, username, password, dbname, and port fields must be included in the JSON. Note that even with this precaution, this information will be stored in plaintext in the Terraform state file! See the following blog post for more details: https://blog.gruntwork.io/a-comprehensive-guide-to-managing-secrets-in-your-terraform-code-1d586955ace1. If you do not wish to use Secrets Manager, leave this as null, and use the master_username, master_password, db_name, engine, and port variables.
null
db_instance_custom_parameter_group
object(…)Configure a custom parameter group for the RDS DB Instance. This will create a new parameter group with the given parameters. When null, the database will be launched with the default parameter group.
object({
# Name of the parameter group to create
name = string
# The family of the DB cluster parameter group.
family = string
# The parameters to configure on the created parameter group.
parameters = list(object({
# Parameter name to configure.
name = string
# Vaue to set the parameter.
value = string
# When to apply the parameter. "immediate" or "pending-reboot".
apply_method = string
}))
})
null
Details
The family of the DB cluster parameter group.
Details
The parameters to configure on the created parameter group.
Details
Vaue to set the parameter.
Details
When to apply the parameter. "immediate" or "pending-reboot".
db_name
stringThe name for your database of up to 8 alpha-numeric characters. If you do not provide a name, Amazon RDS will not create a database in the DB cluster you are creating. This can also be provided via AWS Secrets Manager. See the description of db_config_secrets_manager_id. A value here overrides the value in db_config_secrets_manager_id.
null
Set to true to enable several basic CloudWatch alarms around CPU usage, memory usage, and disk space usage. If set to true, make sure to specify SNS topics to send notifications to using alarms_sns_topic_arn
.
true
When true, enable CloudWatch metrics for the manual snapshots created for the purpose of sharing with another account.
true
Enable deletion protection on the database instance. If this is enabled, the database cannot be deleted.
false
Set to true to enable alarms related to performance, such as read and write latency alarms. Set to false to disable those alarms if you aren't sure what would be reasonable perf numbers for your RDS set up or if those numbers are too unpredictable.
true
When true, enable CloudWatch alarms for the manual snapshots created for the purpose of sharing with another account. Only used if share_snapshot_with_another_account
is true.
true
enabled_cloudwatch_logs_exports
list(string)If non-empty, the Aurora cluster will export the specified logs to Cloudwatch. Must be zero or more of: audit, error, general and slowquery
[]
engine
stringThe name of the database engine to be used for this DB cluster. Valid Values: aurora (for MySQL 5.6-compatible Aurora), aurora-mysql (for MySQL 5.7-compatible Aurora), and aurora-postgresql. This can also be provided via AWS Secrets Manager. See the description of db_config_secrets_manager_id. A value here overrides the value in db_config_secrets_manager_id.
null
engine_mode
stringThe version of aurora to run - provisioned or serverless.
"provisioned"
engine_version
stringThe Amazon Aurora DB engine version for the selected engine and engine_mode. Note: Starting with Aurora MySQL 2.03.2, Aurora engine versions have the following syntax <mysql-major-version>.mysql_aurora.<aurora-mysql-version>. e.g. 5.7.mysql_aurora.2.08.1.
null
Global cluster identifier when creating the global secondary cluster.
null
The period, in seconds, over which to measure the CPU utilization percentage.
60
Trigger an alarm if the DB instance has a CPU utilization percentage above this threshold.
90
Sets how this alarm should handle entering the INSUFFICIENT_DATA state. Based on https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'.
"missing"
high_read_latency_period
numberThe period, in seconds, over which to measure the read latency.
60
Trigger an alarm if the DB instance read latency (average amount of time taken per disk I/O operation), in seconds, is above this threshold.
5
Sets how this alarm should handle entering the INSUFFICIENT_DATA state. Based on https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'.
"missing"
The period, in seconds, over which to measure the write latency.
60
Trigger an alarm if the DB instance write latency (average amount of time taken per disk I/O operation), in seconds, is above this threshold.
5
Sets how this alarm should handle entering the INSUFFICIENT_DATA state. Based on https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'.
"missing"
hosted_zone_id
stringThe ID of the hosted zone in which to write DNS records
null
Specifies whether mappings of AWS Identity and Access Management (IAM) accounts to database accounts is enabled. Disabled by default.
false
instance_count
numberThe number of DB instances, including the primary, to run in the RDS cluster. Only used when engine_mode
is set to provisioned.
1
instance_type
stringThe instance type to use for the db (e.g. db.r3.large). Only used when engine_mode
is set to provisioned.
"db.t3.medium"
Details
See https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Aurora.Managing.html for the instance types supported by
Aurora
kms_key_arn
stringThe ARN of a KMS key that should be used to encrypt data on disk. Only used if storage_encrypted
is true. If you leave this null, the default RDS KMS key for the account will be used.
null
The period, in seconds, over which to measure the available free disk space.
60
Trigger an alarm if the amount of disk space, in Bytes, on the DB instance drops below this threshold.
1000000000
Details
Default is 1GB (1 billion bytes)
Sets how this alarm should handle entering the INSUFFICIENT_DATA state. Based on https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'.
"missing"
The period, in seconds, over which to measure the available free memory.
60
Trigger an alarm if the amount of free memory, in Bytes, on the DB instance drops below this threshold.
100000000
Details
Default is 100MB (100 million bytes)
Sets how this alarm should handle entering the INSUFFICIENT_DATA state. Based on https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-missing-data. Must be one of: 'missing', 'ignore', 'breaching' or 'notBreaching'.
"missing"
Set to true to allow RDS to manage the master user password in Secrets Manager. Cannot be set if password is provided.
null
master_password
stringThe value to use for the master password of the database. This can also be provided via AWS Secrets Manager. See the description of db_config_secrets_manager_id. A value here overrides the value in db_config_secrets_manager_id.
null
master_username
stringThe value to use for the master username of the database. This can also be provided via AWS Secrets Manager. See the description of db_config_secrets_manager_id. A value here overrides the value in db_config_secrets_manager_id.
null
Specifies whether Performance Insights is enabled or not. On Aurora MySQL, Performance Insights is not supported on db.t2 or db.t3 DB instance classes.
false
The ARN for the KMS key to encrypt Performance Insights data.
null
port
numberThe port the DB will listen on (e.g. 3306). This can also be provided via AWS Secrets Manager. See the description of db_config_secrets_manager_id. A value here overrides the value in db_config_secrets_manager_id.
null
preferred_backup_window
stringThe daily time range during which automated backups are created (e.g. 04:00-09:00). Time zone is UTC. Performance may be degraded while a backup runs.
"06:00-07:00"
The weekly day and time range during which cluster maintenance can occur (e.g. wed:04:00-wed:04:30). Time zone is UTC. Performance may be degraded or there may even be a downtime during maintenance windows.
"sun:07:00-sun:08:00"
primary_domain_name
stringThe domain name to create a route 53 record for the primary endpoint of the RDS database.
null
If you wish to make your database accessible from the public Internet, set this flag to true (WARNING: NOT RECOMMENDED FOR REGULAR USAGE!!). The default is false, which means the database is only accessible from within the VPC, which is much more secure. This flag MUST be false for serverless mode.
false
reader_domain_name
stringThe domain name to create a route 53 record for the reader endpoint of the RDS database. Note that Aurora Serverless does not have reader endpoints, so this option is ignored when engine_mode is set to serverless.
null
ARN of a source DB cluster or DB instance if this DB cluster is to be created as a Read Replica.
null
If non-empty, the Aurora cluster will be restored from the given source cluster using the latest restorable time. Can only be used if snapshot_identifier is null. For more information see https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_PIT.html
null
restore_type
stringOnly used if 'restore_source_cluster_identifier' is non-empty. Type of restore to be performed. Valid options are 'full-copy' and 'copy-on-write'. https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Managing.Clone.html
null
Whether to enable automatic pause. A DB cluster can be paused only when it's idle (it has no connections). If a DB cluster is paused for more than seven days, the DB cluster might be backed up with a snapshot. In this case, the DB cluster is restored when there is a request to connect to it. Only used when engine_mode
is set to serverless.
true
The maximum capacity. The maximum capacity must be greater than or equal to the minimum capacity. Valid capacity values are 2, 4, 8, 16, 32, 64, 128, and 256. Only used when engine_mode
is set to serverless.
256
null
The minimum capacity. The minimum capacity must be lesser than or equal to the maximum capacity. Valid capacity values are 2, 4, 8, 16, 32, 64, 128, and 256. Only used when engine_mode
is set to serverless.
2
null
The time, in seconds, before an Aurora DB cluster in serverless mode is paused. Valid values are 300 through 86400. Only used when engine_mode
is set to serverless.
300
The maximum number of snapshots to keep around for the purpose of cross account sharing. Once this number is exceeded, a lambda function will delete the oldest snapshots. Only used if share_snapshot_with_another_account
is true.
30
An expression that defines how often to run the lambda function to take snapshots for the purpose of cross account sharing. For example, cron(0 20 * * ? *) or rate(5 minutes). Required if share_snapshot_with_another_account
is true
null
The ID of the AWS Account that the snapshot should be shared with. Required if share_snapshot_with_another_account
is true.
null
If set to true, take periodic snapshots of the Aurora DB that should be shared with another account.
false
Determines whether a final DB snapshot is created before the DB instance is deleted. Be very careful setting this to true; if you do, and you delete this DB instance, you will not have any backups of the data! You almost never want to set this to true, unless you are doing automated or manual testing.
false
snapshot_identifier
stringIf non-null, the RDS Instance will be restored from the given Snapshot ID. This is the Snapshot ID you'd find in the RDS console, e.g: rds:production-2015-06-26-06-05.
null
Specifies whether the DB cluster uses encryption for data at rest in the underlying storage for the DB, its automated backups, Read Replicas, and snapshots. Uses the default aws/rds key in KMS.
true
Trigger an alarm if the number of connections to the DB instance goes above this threshold.
null
Details
The max number of connections allowed by RDS depends a) the type of DB, b) the DB instance type, and c) the
use case, and it can vary from ~30 all the way up to 5,000, so we cannot pick a reasonable default here.
A list of all the CloudWatch Dashboard metric widgets available in this module.
The ARN of the AWS Lambda Function used for cleaning up manual snapshots taken for sharing with secondary accounts.
The ARN of the RDS Aurora cluster.
The ID of the RDS Aurora cluster (e.g TODO).
The ARN of master user secret. Only available when manage_master_user_password
is set to true
The unique resource ID assigned to the cluster e.g. cluster-POBCBQUFQC56EBAAWXGFJ77GRU. This is useful for allowing database authentication via IAM.
The ARN of the AWS Lambda Function used for periodically taking snapshots to share with secondary accounts.
A list of endpoints of the RDS instances that you can use to make requests to.
A CloudWatch Dashboard widget that graphs CPU usage (percentage) of the Aurora cluster.
A CloudWatch Dashboard widget that graphs the number of active database connections of the Aurora cluster.
A CloudWatch Dashboard widget that graphs available disk space (in bytes) on the Aurora cluster.
A CloudWatch Dashboard widget that graphs available memory (in bytes) on the Aurora cluster.
A CloudWatch Dashboard widget that graphs the average amount of time taken per disk I/O operation on reads.
A CloudWatch Dashboard widget that graphs the average amount of time taken per disk I/O operation on writes.
The port used by the RDS Aurora cluster for handling database connections.
The primary endpoint of the RDS Aurora cluster that you can use to make requests to.
The host portion of the Aurora endpoint. primary_endpoint is in the form '<host>:<port>', and this output returns just the host part.
A read-only endpoint for the Aurora cluster, automatically load-balanced across replicas.
ID of security group created by aurora module.
The ARN of the AWS Lambda Function used for sharing manual snapshots with secondary accounts.