Yandex Cloud Terraform Provider

The yandex_mdb_postgresql_cluster resource allows you to manage PostgreSQL clusters within Yandex Cloud.

Important Connectivity Note

To connect to the database, use port 6432. This port number is not configurable.

Best Practices for Users and Databases

Historically, user and database blocks were used within this resource. This is now deprecated and not recommended. Using these blocks can lead to incorrect Terraform plans when adding or removing resources.

Instead, use the following dedicated resources for managing cluster contents:

• yandex_mdb_postgresql_user
• yandex_mdb_postgresql_database

resource "yandex_mdb_postgresql_cluster" "my_cluster" {
  name        = "test"
  environment = "PRESTABLE"
  network_id  = yandex_vpc_network.foo.id

  config {
    version = 15
    resources {
      resource_preset_id = "s2.micro"
      disk_type_id       = "network-ssd"
      disk_size          = 16
    }
    postgresql_config = {
      max_connections                = 395
      enable_parallel_hash           = true
      autovacuum_vacuum_scale_factor = 0.34
      default_transaction_isolation  = "TRANSACTION_ISOLATION_READ_COMMITTED"
      shared_preload_libraries       = "SHARED_PRELOAD_LIBRARIES_AUTO_EXPLAIN,SHARED_PRELOAD_LIBRARIES_PG_HINT_PLAN"
    }
  }

  maintenance_window {
    type = "WEEKLY"
    day  = "SAT"
    hour = 12
  }

  host {
    zone      = "ru-central1-d"
    subnet_id = yandex_vpc_subnet.foo.id
  }
}

The yandex_vpc_security_group_rule resource allows you to manage individual security group rules within Yandex Cloud.

Important Constraints

• Conflict Warning: Do not use yandex_vpc_security_group_rule at the same time as the ingress and egress arguments within the yandex_vpc_security_group resource. Doing so causes configuration conflicts and is not recommended.
• Port Specification: You can specify a single port using port, or a range using from_port and to_port. If no port is specified or if it is set to -1, all ports are allowed.
• Protocol Restrictions: You cannot specify a port if the protocol is set to ICMP or IPV6_ICMP.
• Targeting Requirements: You must specify exactly one of the following to define the rule's target:
  • v4_cidr_blocks or v6_cidr_blocks
  • predefined_target
  • security_group_id

resource "yandex_vpc_security_group_rule" "rule1" {
  security_group_binding = yandex_vpc_security_group.group1.id
  direction              = "ingress"
  description            = "rule1 description"
  v4_cidr_blocks         = ["10.0.1.0/24", "10.0.2.0/24"]
  port                   = 8080
  protocol               = "TCP"
}

resource "yandex_vpc_security_group_rule" "rule2" {
  security_group_binding = yandex_vpc_security_group.group1.id
  direction              = "egress"
  description            = "rule2 description"
  v4_cidr_blocks         = ["10.0.1.0/24"]
  from_port              = 8090
  to_port                = 8099
  protocol               = "UDP"
}

Advanced Rate Limiter profiles support complex matching logic across several dimensions. When configuring these via Terraform, note the following semantic behaviors:

Source IP Matching

Use the source_ip block to match requests based on:

• IP Lists/Ranges: ip_lists_match/ip_lists_not_match (using list_ids) or ip_ranges_match/ip_ranges_not_match (using ip_ranges).
• ASN: asn_lists_match/asn_lists_not_match or asn_ranges_match/asn_ranges_not_match (using asn_ranges as a list of numbers).
• Geo-IP: geo_ip_match/geo_ip_not_match using ISO 3166-1 alpha 2 country codes.

Request URI Matching

Use the request_uri block to match based on the URI path and query parameters:

• Path: Match using exact_match, exact_not_match, prefix_match, prefix_not_match, or pire_regex_match.
• Queries: Use the queries block to match specific query parameters. Multiple queries blocks within a request_uri use AND semantics. Each query can define a key and a value block containing various matching types (exact, prefix, regex, or list-based).

Bot Detection

Use the verified_bot block with a verified sub-block to match whether a request comes from a verified bot (match = true or match = false).

When configuring a backend within an Application Load Balancer (ALB) Backend Group, you must specify exactly one type of health check. Supported types are stream_healthcheck, http_healthcheck, or grpc_healthcheck.

Health Check Types

• http_healthcheck: Used for HTTP backends. Requires a path. You can also specify expected_statuses, host (for the Host header), and http2 support.
• grpc_healthcheck: Used for gRPC backends. Requires a service_name for the grpc.health.v1.HealthCheckRequest message.
• stream_healthcheck: Used for stream/TCP backends. Supports send (data sent to targets) and receive (data expected from targets).

Common Health Check Parameters

• interval (Required): The time between checks.
• timeout (Required): Time to wait for a response.
• healthy_threshold: Number of consecutive successes to mark a host healthy (0 defaults to 1).
• unhealthy_threshold: Number of consecutive failures to mark a host unhealthy (0 defaults to 1). Note: for HTTP, a single 503 immediately marks the endpoint unhealthy.

The yandex_cm_certificate_iam_binding resource allows you to create and manage a single IAM policy binding for an existing Certificate Manager certificate.

⚠️ Critical Warning: Authoritative Behavior

This resource is authoritative for the specified role on the target certificate. It manages the complete set of members for that role.

If you add or remove members via this resource, it will overwrite any existing members for that specific role that were granted through other means (such as the Yandex Cloud Console, CLI, API, or *_iam_member resources). Because these external subjects are not tracked in the Terraform state, a terraform plan will not show them, but they will be removed when you apply changes to this resource.

Best Practice: Use only one yandex_cm_certificate_iam_binding per role to avoid conflicting management of the same role's membership.

resource "yandex_cm_certificate_iam_binding" "viewer_binding" {
  certificate_id = yandex_cm_certificate.your-certificate.id
  role           = "viewer"

  members = [
    "userAccount:foo_user_id",
  ]
}