terraform-aws-modules/terraform-aws-rds

The aws_db_instance_role_association module is used to associate an IAM Role with an AWS RDS DB instance for specific features (such as S3 integration or Lambda integration).

Requirements

• Terraform: >= 1.11.1
• AWS Provider: >= 6.28

The root module acts as an orchestrator that calls several specialized sub-modules. You can use the root module for a complete setup or call these sub-modules directly to manage independent resources:

• db_instance: Creates the RDS DB instance.
• db_subnet_group: Creates the RDS DB subnet group.
• db_parameter_group: Creates the RDS DB parameter group.
• db_option_group: Creates the RDS DB option group.
• db_instance_role_association: Creates RDS DB instance role association resources.

The single module wrapper pattern is used to manage several copies of a module in environments where native Terraform for_each might not be feasible (such as certain Terragrunt workflows).

Instead of iterating over resources using Terraform's internal logic, this wrapper accepts a map of items. The wrapper then handles the instantiation of each item. This pattern does not add new RDS functionality; it is strictly a structural pattern for managing multiple resource instances through a single configuration block.

To allow RDS to manage the master user password automatically in AWS Secrets Manager, set manage_master_user_password = true.

When this is enabled, you should not provide a password_wo directly. You can also configure rotation settings:

• manage_master_user_password_rotation: Set to true to enable rotation.
• master_user_password_rotation_automatically_after_days: Number of days between rotations.
• master_user_password_rotation_schedule_expression: A cron() or rate() expression for rotation.
• master_user_password_rotation_duration: The length of the rotation window (e.g., 3h).
• master_user_secret_kms_key_id: The KMS key to encrypt the secret.

The wrapper pattern used in this repository is designed to manage multiple instances of a sub-module (in this case, modules/db_option_group) using a single module call.

By using a defaults block and an items block, the wrapper iterates over the items map and applies the configuration. This pattern is particularly useful for Terragrunt users who want to manage a collection of similar resources (like multiple DB Option Groups) without the overhead of managing a separate directory and terragrunt.hcl file for every single resource.

The db_subnet_group wrapper is a pattern used to manage multiple instances of the modules/db_subnet_group module within a single configuration block. This is particularly useful in environments like Terragrunt where native Terraform for_each might not be feasible for managing multiple copies of a module without duplicating configuration files.

This wrapper does not add new functionality; it simply provides a way to pass a map of items and a map of defaults to the underlying module.

You can manage RDS Option Groups in three ways:

1. Create a new group with a specific name: Set create_db_option_group = true and provide option_group_name. Use option_group_use_name_prefix = false to prevent AWS from appending a random suffix.
2. Create a new group with a unique prefix: Set create_db_option_group = true and provide option_group_name. AWS will append a unique suffix.
3. Use an existing group: Set create_db_option_group = false and provide the option_group_name of a group that already exists in your AWS account.

Note for PostgreSQL: Option groups are not supported for PostgreSQL. If using the postgres engine, providing an option_group_name will be ignored and no option group will be created.

You can manage RDS Parameter Groups in three ways:

1. Create a new group with a specific name: Set create_db_parameter_group = true and provide parameter_group_name. Use parameter_group_use_name_prefix = false to prevent AWS from appending a random suffix.
2. Create a new group with a unique prefix: Set create_db_parameter_group = true and provide parameter_group_name. AWS will append a unique suffix.
3. Use an existing group: Set create_db_parameter_group = false and provide the parameter_group_name of a group that already exists in your AWS account.

Note: Setting create_db_parameter_group = false without providing a name will result in using the default AWS parameter group.

Enhanced Monitoring provides detailed metrics for your RDS instance. To use it, you must configure the following:

1. Enable Monitoring: Set monitoring_interval to a non-zero value (e.g., 60 for 60 seconds). Valid values: 0, 1, 5, 10, 15, 30, 60.
2. IAM Role:
   • Automatic: Set create_monitoring_role = true. You can customize the role name using monitoring_role_name and monitoring_role_use_name_prefix.
   • Manual: Provide an existing role ARN via monitoring_role_arn.

If monitoring_interval is non-zero, monitoring_role_arn must be specified if you are not using the automatic creation feature.

The wrapper pattern implemented here is a single-module wrapper. It does not add new functionality; instead, it provides a way to manage several copies of the modules/db_instance_role_association module using a single block of code.

By using the defaults and items pattern, you can centralize common settings (like tags or creation flags) while allowing specific overrides or unique parameters for each individual item in the items map.