rvn-aurora · Latest version: 0.1.1
Dependencies and consumers
Every dependency input can be specified manually to reference existing external infrastructure rather than a Ravion module.Readme
Creates and manages an Amazon Aurora cluster. Supports Aurora PostgreSQL and Aurora MySQL with provisioned or Serverless v2 capacity.Overview
Use this module when an application needs a managed, highly available relational database cluster in AWS. It provisions an Aurora cluster with writer and reader instances, subnet placement, security group access, backups, monitoring, optional reader autoscaling, and optional advanced Aurora features. Aurora PostgreSQL and Aurora MySQL are supported. Choose the engine major version and, when needed, a minor version for exact engine pinning. Choose provisioned instances for predictable capacity or Serverless v2 when the workload needs capacity that scales in Aurora Capacity Units.Use cases
Networking
Select a VPC network first. Ravion maps the network’s AWS account, region, VPC ID, and private and public subnet IDs into this module. Aurora requires at least two subnets in different Availability Zones, and private subnets are the normal choice for application databases. AWS places cluster instances across the Availability Zones of the selected subnets. Public access is disabled by default, and the DB subnet group uses the private subnet IDs. When Publicly accessible is enabled, the DB subnet group switches to the public subnet IDs because AWS requires public subnets for public database access. Changing this setting after creation replaces the DB subnet group and the cluster. Keep public access disabled for production databases and allow access through security group IDs from application services or controlled CIDR blocks. You can create a module-managed security group or attach an existing one.Capacity modes
Provisioned capacity uses a fixed DB instance class for the writer and, by default, for readers. Serverless v2 uses Aurora Capacity Units; set the minimum and maximum ACUs to control the scaling range. The module usesdb.serverless for cluster instances when Serverless v2 is selected.
Availability and readers
Reader settings live together in the Readers section. Choose the number of reader instances, an optional separate reader instance class, and an optional default failover promotion tier. Readers default to 0; add at least one reader in another Availability Zone for production failover. Reader autoscaling can adjust the number of read replicas based on CPU utilization and, optionally, database connections. Configure min and max reader capacity carefully because autoscaling can increase cost.Credentials and security
Master password management in AWS Secrets Manager is enabled by default, so AWS creates and stores the master password for the cluster. Provide a Secrets Manager KMS key ARN when you need a customer-managed key for that secret. Storage encryption is enabled by the Terraform module. Provide a storage KMS key ARN when you need a customer-managed key for cluster storage. IAM database authentication and the Aurora Data API HTTP endpoint are optional.Availability, backups, and maintenance
Aurora creates a writer instance and the configured number of reader instances. Backup retention defaults to 7 days and must be at least 1 day for Aurora. Final snapshots and deletion protection are enabled by default to reduce accidental data loss. Maintenance windows, automatic minor upgrades, major version upgrades, and immediate apply are configurable. Major version upgrades and immediate changes are opt-in because they can affect database availability. Aurora MySQL exposes backtrack and local write forwarding settings. Aurora PostgreSQL exposes global write forwarding according to this module’s Terraform validation.Observability
Performance Insights is enabled by default with 7 days of retention. Enhanced monitoring can be enabled by setting a monitoring interval. CloudWatch alarms can monitor CPU utilization, freeable memory, and database connections. The freeable memory alarm threshold is entered in MiB in Ravion and converted to bytes for Terraform. CloudWatch log exports offer engine-specific log types: postgresql for Aurora PostgreSQL, or audit, error, general, and slowquery for Aurora MySQL. Each enabled log type is shown on the module Logs tab. The Ravion UI charts Aurora CloudWatch metrics for CPU utilization, freeable memory, database connections, serverless capacity and ACU utilization, storage used, read and write latency, replica lag, buffer cache hit ratio, commit latency, deadlocks, network throughput, and volume IOPS.Configuration
Advanced configuration
Use cluster parameter groups for cluster-level engine settings and DB parameter groups for instance-level engine settings. The Misc section holds less common cluster features: Database Activity Streams, custom endpoints for reader or any-instance routing, and IAM role associations that attach feature-specific IAM roles for capabilities such as S3 import, S3 export, or Lambda invocation. Use advanced Terraform variables for one-off overrides not represented directly in the UI. Values in advanced Terraform variables override generated variables. Terraform settings let you override the OpenTofu version, Terraform execution environment inherited from the VPC network, and Ravion state backend workspace name.Design decisions
Aurora clusters are placed in private subnets by default through the VPC network reference. Secrets Manager password management, encryption at rest, Performance Insights, final snapshots, and deletion protection default on because they are safer defaults for long-lived databases. The module keeps primary database, capacity, networking, backup, and monitoring choices visible while placing engine-specific, autoscaling, parameter group, global database, activity stream, custom endpoint, IAM association, and Terraform settings behind focused advanced controls.Learn more
- Amazon Aurora documentation
- Aurora DB instance classes
- Aurora Serverless v2
- Aurora global databases
- Aurora monitoring
- Terraform source
Inputs reference
All inputs forrvn-aurora version 0.1.1. Use the name shown for each field as the input key in module config.
VPC network.
- Immutable after creation
Database
Name slug. Name of the Aurora cluster and prefix for related resources.
- Default:
<<project.given_id>>-<<environment.given_id>> - Immutable after creation
- Pattern:
^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$— 1-63 lowercase letters, numbers, and hyphens. Start with a letter and end with a letter or number.
Create or restore.
- Default:
none - Allowed values:
none(New empty database),snapshot(Restore from snapshot),point_in_time(Point-in-time restore) - Immutable after creation
Database name. Name for an automatically created database on the cluster.
- Immutable after creation
- Pattern:
^[A-Za-z][A-Za-z0-9_]{0,63}$— 1-64 letters, numbers, and underscores. Start with a letter. - Shown when:
{"restore_mode":"none"}
Username.
- Default:
dbadmin - Immutable after creation
- Pattern:
^[A-Za-z][A-Za-z0-9_]{0,62}$— Invalid Aurora master username. Start with a letter. Letters, numbers, and underscores only. - Shown when:
{"restore_mode":"none"}
Snapshot to restore. Snapshot identifier or ARN to restore into this new Aurora cluster.
- Immutable after creation
- Shown when:
{"restore_mode":"snapshot"}
Source cluster identifier. Source Aurora cluster identifier to restore from.
- Immutable after creation
- Shown when:
{"restore_mode":"point_in_time"}
Restore type.
- Default:
full-copy - Allowed values:
full-copy(Full copy),copy-on-write(Copy on write) - Immutable after creation
- Shown when:
{"restore_mode":"point_in_time"}
Use latest restorable time. Restore to the latest time AWS can recover from the selected source cluster backup.
- Default:
true - Immutable after creation
- Shown when:
{"restore_mode":"point_in_time"}
Restore time. Restore to this UTC timestamp instead of the latest restorable time.
- Immutable after creation
- Shown when:
{"point_in_time_use_latest_restorable_time":false,"restore_mode":"point_in_time"}
Version
Engine.
- Default:
aurora-postgresql - Allowed values:
aurora-postgresql(Aurora PostgreSQL),aurora-mysql(Aurora MySQL) - Immutable after creation
Engine major version. Examples: 16 for Aurora PostgreSQL or 8.0 for Aurora MySQL.
Engine minor version. Optional minor engine version appended to the major version. Example: 4 becomes 16.4 for Aurora PostgreSQL; 3.08.0 becomes 8.0.mysql_aurora.3.08.0 for Aurora MySQL.
Auto minor version upgrades. Enable automatic minor engine version upgrades during the configured maintenance window.
- Default:
true
Capacity
Capacity mode. Choose fixed DB instances or Aurora Serverless v2 capacity.
- Default:
provisioned - Allowed values:
provisioned(Provisioned instances),serverless_v2(Serverless v2)
Instance class. Aurora writer instance size, such as db.t4g.medium or db.r6g.large.
- Default:
db.t4g.medium - Shown when:
{"capacity_mode":"provisioned"}
Min capacity (ACUs). Minimum Aurora Serverless v2 capacity units. Must not exceed max capacity.
- Default:
1 - Min:
1 - Max:
256 - Shown when:
{"capacity_mode":"serverless_v2"}
Max capacity (ACUs). Maximum Aurora Serverless v2 capacity units. Must be at least min capacity.
- Default:
4 - Min:
1 - Max:
256 - Shown when:
{"capacity_mode":"serverless_v2"}
Storage & cluster
Storage type.
- Default:
aurora - Allowed values:
aurora(Aurora Standard),aurora-iopt1(Aurora I/O-Optimized)
Storage KMS key ARN.
- Immutable after creation
CA certificate identifier.
Network type.
- Default:
IPV4 - Allowed values:
IPV4(IPv4),DUAL(Dual-stack)
Network access
Publicly accessible. Keep disabled for production databases unless public access is intentional.
- Default:
false
Port. Leave blank to use the engine default port: 5432 for PostgreSQL or 3306 for MySQL.
- Min:
1 - Max:
65535
Security group creation.
- Default:
true - Immutable after creation
Existing security group ID.
- Shown when:
{"security_group_creation_enabled":false}
Allowed security groups.
- Shown when:
{"security_group_creation_enabled":true}
Allowed CIDR blocks.
- Shown when:
{"security_group_creation_enabled":true}
Readers
Reader count. Number of reader instances to create.
- Default:
0 - Min:
0 - Max:
15
Reader instance class. Reader instance class. Leave blank to use the writer instance class.
- Shown when:
{"capacity_mode":"provisioned"}
Promotion tier. Default failover priority for instances. Lower values have higher priority.
- Min:
0 - Max:
15
Reader autoscaling.
- Default:
false
Min reader capacity. Must not exceed max reader capacity.
- Default:
1 - Min:
0 - Shown when:
{"autoscaling_enabled":true}
Max reader capacity. Must be at least min reader capacity.
- Default:
3 - Min:
1 - Shown when:
{"autoscaling_enabled":true}
Target CPU utilization (%).
- Default:
70 - Min:
1 - Max:
100 - Shown when:
{"autoscaling_enabled":true}
Target connections.
- Min:
1 - Shown when:
{"autoscaling_enabled":true}
Scale-in cooldown seconds.
- Default:
300 - Min:
0 - Shown when:
{"autoscaling_enabled":true}
Scale-out cooldown seconds.
- Default:
300 - Min:
0 - Shown when:
{"autoscaling_enabled":true}
Credentials & authentication
Secrets Manager KMS key ARN.
- Shown when:
{"restore_mode":"none"}
IAM database authentication.
- Default:
false
Data API (HTTP endpoint). Enable the Aurora Data API HTTP endpoint.
- Default:
false
MySQL settings
Backtrack window (seconds). Target backtrack window in seconds. Set 0 to disable.
- Default:
0 - Min:
0 - Max:
259200 - Shown when:
{"engine":"aurora-mysql"}
Local write forwarding.
- Default:
false - Shown when:
{"engine":"aurora-mysql"}
Backups
Backup retention days.
- Default:
7 - Min:
1 - Max:
35
Backup window.
Copy tags to snapshots.
- Default:
true
Create final snapshot.
- Default:
true
Final snapshot identifier.
- Shown when:
{"final_snapshot_creation_enabled":true}
Deletion protection.
- Default:
true
Maintenance
Maintenance window.
Allow major version upgrades.
- Default:
false
Apply changes immediately.
- Default:
false
Parameter groups
Cluster parameter group creation. Create a cluster parameter group for this database. Disable this only when you want to attach an existing parameter group.
- Default:
true - Immutable after creation
Existing cluster parameter group name. Name of an existing cluster parameter group to attach when this module is not creating one.
- Immutable after creation
- Shown when:
{"cluster_parameter_group_creation_enabled":false}
Cluster parameter group family. Cluster parameter group family. Leave blank to derive it from the selected engine version.
- Immutable after creation
- Shown when:
{"cluster_parameter_group_creation_enabled":true}
Cluster parameters. Custom cluster parameters to apply to the created cluster parameter group.
- Default:
[] - Shown when:
{"cluster_parameter_group_creation_enabled":true}
DB parameter group creation. Create a DB parameter group for cluster instances. Disable this only when you want to attach an existing parameter group.
- Default:
true - Immutable after creation
Existing DB parameter group name. Name of an existing DB parameter group to attach when this module is not creating one.
- Immutable after creation
- Shown when:
{"db_parameter_group_creation_enabled":false}
DB parameter group family. DB parameter group family. Leave blank to derive it from the selected engine version.
- Immutable after creation
- Shown when:
{"db_parameter_group_creation_enabled":true}
DB parameters. Custom instance parameters to apply to the created DB parameter group.
- Default:
[] - Shown when:
{"db_parameter_group_creation_enabled":true}
Monitoring
CloudWatch log exports. Engine logs exported to CloudWatch. Each enabled log type is shown on the module Logs tab.
- Allowed values:
postgresql,audit,error,general,slowquery
Enhanced monitoring interval.
- Default:
0 - Allowed values:
0(0),1(1),5(5),10(10),15(15),30(30),60(60)
Monitoring IAM role creation.
- Default:
true - Immutable after creation
- Shown when:
{"monitoring_interval":{"not":0}}
Monitoring IAM role ARN.
- Shown when:
{"monitoring_interval":{"not":0},"monitoring_role_creation_enabled":false}
Performance insights.
- Default:
true
Performance insights retention days. AWS supports 7 days, multiples of 31 days up to 23 months, or 731 days.
- Default:
7 - Allowed values:
7(7 days),31(1 month (31 days)),62(2 months (62 days)),93(3 months (93 days)),186(6 months (186 days)),372(12 months (372 days)),731(24 months (731 days)) - Shown when:
{"performance_insights_enabled":true}
Performance insights KMS key ARN.
- Shown when:
{"performance_insights_enabled":true}
CloudWatch alarms
Create CloudWatch alarms.
- Default:
true
CPU alarm threshold (%).
- Default:
80 - Min:
0 - Max:
100 - Shown when:
{"cloudwatch_alarms_creation_enabled":true}
Freeable memory alarm threshold (MiB). Displayed in MiB. Ravion converts this to bytes for Terraform.
- Default:
256 - Min:
1 - Shown when:
{"cloudwatch_alarms_creation_enabled":true}
Connections alarm threshold.
- Default:
100 - Min:
1 - Shown when:
{"cloudwatch_alarms_creation_enabled":true}
Alarm evaluation periods.
- Default:
2 - Min:
1 - Shown when:
{"cloudwatch_alarms_creation_enabled":true}
Alarm period seconds.
- Default:
300 - Allowed values:
10(10),30(30),60(60),300(300),900(900),3600(3600) - Shown when:
{"cloudwatch_alarms_creation_enabled":true}
Alarm action ARNs.
- Shown when:
{"cloudwatch_alarms_creation_enabled":true}
OK action ARNs.
- Shown when:
{"cloudwatch_alarms_creation_enabled":true}
Global database
Global cluster creation.
- Default:
false - Immutable after creation
Global cluster identifier. Global cluster identifier. Set this to create a new global cluster or join an existing global cluster.
- Immutable after creation
Source region. Source region for cross-region replication in a global database.
- Immutable after creation
Global write forwarding.
- Default:
false - Shown when:
{"engine":"aurora-postgresql"}
Misc
Activity stream. Enable Database Activity Streams for the cluster.
- Default:
false
Activity stream mode.
- Default:
async - Allowed values:
async,sync - Shown when:
{"activity_stream_enabled":true}
Activity stream KMS key ARN.
- Shown when:
{"activity_stream_enabled":true}
Custom endpoints. Custom Aurora cluster endpoints for reader or any-instance routing.
- Default:
{}
IAM role associations. IAM roles associated with the Aurora cluster for features such as S3_IMPORT, S3_EXPORT, or LAMBDA_INVOKE.
- Default:
{}
Tags. A map of tags to assign to all resources. Default tags are
Owner, ProjectGivenId, EnvironmentGivenId, ModuleGivenId, ModuleIdTerraform settings
OpenTofu version override. Override the environment’s default version for this module
Ravion Terraform workspace name. Override Terraform state backend workspace name. Defaults to project + environment + module given ids.
- Immutable after creation
Advanced Terraform variables. Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.
- Default:
{}