RDS Database - Ravion Docs

Type: rvn-rds · Latest version: 0.4.2

Dependencies and consumers

Every dependency input can be specified manually to reference existing external infrastructure rather than a Ravion module.

Readme

Creates and manages an Amazon RDS database. Supports PostgreSQL, MySQL, MariaDB, Oracle, and SQL Server engines.

Overview

Use this module when an application needs a managed relational database in AWS. It provisions an RDS instance with subnet placement, security group access, backups, monitoring, optional read replicas, and CloudWatch alarms. The module supports PostgreSQL, MySQL, MariaDB, Oracle, and SQL Server engines. Aurora uses a different AWS resource model and is not configured by this module.

Use cases

Scenario	Benefit
Application database	Create a private RDS instance attached to an existing Ravion VPC network.
Production database	Enable Multi-AZ, deletion protection, automated backups, performance insights, and CloudWatch alarms.
Read-heavy workload	Add read replicas for supported engines.
Sensitive data	Keep public access disabled, use encryption, manage credentials in Secrets Manager, and restrict ingress.

Networking

Select a VPC network first. Ravion maps the network’s AWS account, region, VPC ID, and private subnet IDs into this module. The database subnet group uses the selected private subnets by default. Public access is disabled by default. Keep it disabled for normal application databases and allow access through security group IDs from application services or controlled CIDR blocks.

Database engine and sizing

Choose the engine, optional engine major version, optional engine minor version, instance class, and allocated storage. If engine major version is blank, AWS selects the latest available version for that engine. Storage type defaults to gp3. Max allocated storage controls RDS storage autoscaling; keep it at 0 to disable autoscaling. AWS supports increasing allocated storage after creation, but not reducing it in place.

Credentials and security

Manage password in Secrets Manager is enabled by default, so AWS creates and stores the master password for the database. Disable it only when you need to provide a master password yourself. Storage encryption is enabled by default. Provide a storage KMS key ARN when you need a customer-managed key for storage. IAM database authentication is shown only for MySQL and PostgreSQL.

Availability, backups, and maintenance

Multi-AZ creates a standby in another availability zone for failover. The single availability zone field is hidden when Multi-AZ is enabled. Read replicas are shown only for engines that support RDS read replicas and are hidden for SQL Server. Automated backups default to 7 days. You can set the backup window and control final snapshot behavior. Deletion protection is enabled by default. Automatic minor engine version upgrades are configured next to the engine version fields and, when enabled, happen during the configured maintenance window. Major version upgrades and immediate changes are opt-in.

Observability

Performance insights is enabled by default with 7 days of retention. Enhanced monitoring can be enabled by setting a monitoring interval. CloudWatch alarms are optional. When enabled, the module can alarm on CPU utilization, free storage space, and database connections. The free storage alarm threshold is entered in GiB in Ravion and converted to bytes for Terraform. The Ravion UI also shows RDS CloudWatch metrics for CPU, free storage, connections, read IOPS, and write IOPS.

Configuration

Field	Required	Default	Notes
VPC network	Yes	None	Supplies AWS account, region, VPC ID, and private subnet IDs.
Name slug	Yes	Project and environment given IDs	Prefix for RDS resources.
Engine	Yes	postgres	PostgreSQL, MySQL, MariaDB, Oracle, and SQL Server variants are supported.
Engine major version	Yes	None	Sets the RDS major engine version, such as 15 for PostgreSQL or 8.0 for MySQL.
Engine minor version	No	Blank	Appended to the major version when an exact version is required.
Auto minor version upgrades	No	true	Applies minor engine upgrades during the configured maintenance window.
Instance class	Yes	None	Use an RDS class such as db.t4g.micro or db.r6g.large.
Allocated storage	Yes	20	Storage in GiB.
Master username	Yes	dbadmin	Master database user. Do not use reserved engine words such as admin.
Storage KMS key ARN	No	Blank	Uses a customer-managed KMS key for storage encryption.
Initial database name	No	Blank	Creates an initial database when supported by the engine. Reserved RDS engine words such as database are blocked.
Publicly accessible	No	false	Leave disabled unless public database access is intentional.
Security group creation	No	true	Creates ingress rules from allowed security groups and CIDRs.
Multi-AZ	No	false	Enables high availability standby.
Read replicas	No	false	Creates read replicas when supported by the engine.
Manage password in Secrets Manager	No	true	Stores generated master credentials in AWS Secrets Manager.
Backup retention days	No	7	Set to 0 to disable automated backups.
Deletion protection	No	true	Helps prevent accidental deletion.
Performance insights	No	true	Enables AWS Performance Insights.
CloudWatch alarms	No	false	Adds CPU, free storage, and connection alarms.
Free storage alarm threshold	No	5 GiB	Converted to bytes before Terraform runs.
Tags	No	Blank	Merged with Ravion standard tags.

Advanced configuration

Use parameter group settings for engine parameters. Oracle settings and SQL Server settings are shown in separate engine-specific sections. Option group settings are shown only for Oracle and SQL Server engines; blue/green updates are shown only for MySQL and MariaDB. Use advanced Terraform variables for one-off overrides not represented directly in the UI. Values in advanced Terraform variables override generated variables. Terraform settings let you override the OpenTofu version, Terraform execution environment inherited from the VPC network, and Ravion state backend workspace name.

Design decisions

RDS instances are placed in private subnets by default through the VPC network reference. Secrets Manager password management, encryption at rest, performance insights, and deletion protection default on because they are safer defaults for long-lived databases. The module keeps primary database choices visible and tucks optional engine, engine-specific, storage, backup, monitoring, maintenance, parameter group, and option group details behind collapsible controls. Source repository and stack plumbing remain managed by Ravion.

Learn more

Inputs reference

All inputs for rvn-rds version 0.4.2. Use the name shown for each field as the input key in module config.

network

$ref:rvn-aws-network

required

VPC network.

Immutable after creation

Database

name

string

required

Name slug. Name prefix for all RDS resources.

Default: <<project.given_id>>-<<environment.given_id>>
Immutable after creation
Pattern: ^[a-z0-9]([a-z0-9-]{0,38}[a-z0-9])?$ — 1-40 lowercase letters, numbers, and hyphens. Start and end with a letter or number.

restore_mode

string

required

Create or restore.

Default: none
Allowed values: none (New empty database), snapshot (Restore from snapshot), point_in_time (Point-in-time restore)
Immutable after creation

db_name

string

required

Database name.

Immutable after creation
Pattern: ^[a-z][a-z0-9_]{0,63}$ — 1-64 lowercase letters, numbers, and underscores. Start with a letter.
Pattern: ^(?:|[^adimnoprst].*|a(?:|[^d].*|d(?:|[^m].*|m(?:|[^i].*|i(?:|[^n].*|n.+))))|d(?:|[^a].*|a(?:|[^t].*|t(?:|[^a].*|a(?:|[^b].*|b(?:|[^a].*|a(?:|[^s].*|s(?:|[^e].*|e(?:[^s].*|s.+))))))))|i(?:|[^n].*|n(?:|[^f].*|f(?:|[^o].*|o(?:|[^r].*|r(?:|[^m].*|m(?:|[^a].*|a(?:|[^t].*|t(?:|[^i].*|i(?:|[^o].*|o(?:|[^n].*|n(?:|[^_].*|_(?:|[^s].*|s(?:|[^c].*|c(?:|[^h].*|h(?:|[^e].*|e(?:|[^m].*|m(?:|[^a].*|a.+)))))))))))))))))|m(?:|[^y].*|y(?:|[^s].*|s(?:|[^q].*|q(?:|[^l].*|l.+))))|n(?:|[^u].*|u(?:|[^l].*|l(?:|[^l].*|l.+)))|o(?:|[^r].*|r(?:|[^a].*|a(?:|[^c].*|c(?:|[^l].*|l(?:|[^e].*|e.+)))))|p(?:|[^eo].*|e(?:|[^r].*|r(?:|[^f].*|f(?:|[^o].*|o(?:|[^r].*|r(?:|[^m].*|m(?:|[^a].*|a(?:|[^n].*|n(?:|[^c].*|c(?:|[^e].*|e(?:|[^_].*|_(?:|[^s].*|s(?:|[^c].*|c(?:|[^h].*|h(?:|[^e].*|e(?:|[^m].*|m(?:|[^a].*|a.+))))))))))))))))|o(?:|[^s].*|s(?:|[^t].*|t(?:|[^g].*|g(?:|[^r].*|r(?:|[^e].*|e(?:|[^s].*|s.+)))))))|r(?:|[^do].*|d(?:|[^s].*|s(?:|[^a].*|a(?:|[^d].*|d(?:|[^m].*|m(?:|[^i].*|i(?:|[^n].*|n.+))))))|o(?:|[^o].*|o(?:|[^t].*|t.+)))|s(?:|[^y].*|y(?:|[^s].*|s.+))|t(?:|[^e].*|e(?:|[^m].*|m(?:|[^p].*|p(?:|[^l].*|l(?:|[^a].*|a(?:|[^t].*|t(?:|[^e].*|e(?:|[^01].*|0.+|1.+)))))))))$ — Pick a different name, this is reserved by AWS.
Shown when: {"engine":["mysql","postgres","mariadb","oracle-ee","oracle-se2","oracle-se2-cdb"],"restore_mode":"none"}

username

string

required

Username.

Default: dbadmin
Immutable after creation
Pattern: ^[A-Za-z][A-Za-z0-9_]{0,62}$ — Invalid RDS master username. Start with a letter. Letters, numbers, and underscores only.
Shown when: {"restore_mode":"none"}

snapshot_identifier

string

Snapshot to restore. Snapshot identifier or ARN to restore into this new database. The snapshot must be compatible with the selected engine and instance settings.

Immutable after creation
Shown when: {"restore_mode":"snapshot"}

point_in_time_use_latest_restorable_time

boolean

Use latest restorable time. Restore to the latest time AWS can recover from the selected source database backup.

Default: true
Immutable after creation
Shown when: {"restore_mode":"point_in_time"}

point_in_time_restore_time

string

Restore time. Restore to this UTC timestamp instead of the latest restorable time.

Immutable after creation
Shown when: {"point_in_time_use_latest_restorable_time":false,"restore_mode":"point_in_time"}

point_in_time_source_db_instance_identifier

string

Source DB instance identifier. Source DB instance identifier to restore from.

Immutable after creation
Shown when: {"restore_mode":"point_in_time"}

point_in_time_source_db_instance_automated_backups_arn

string

Source automated backups ARN. ARN of the source automated backups to restore from. Use this for cross-region or retained automated backup restores.

Immutable after creation
Shown when: {"restore_mode":"point_in_time"}

point_in_time_source_dbi_resource_id

string

Source DB resource ID. Source DB resource ID to restore from when using automated backups.

Immutable after creation
Shown when: {"restore_mode":"point_in_time"}

Version

engine

string

required

Engine.

Default: postgres
Allowed values: postgres (PostgreSQL), mysql (MySQL), mariadb (MariaDB), oracle-ee (Oracle Enterprise Edition), oracle-se2 (Oracle Standard Edition 2), oracle-se2-cdb (Oracle Standard Edition 2 CDB), sqlserver-ee (SQL Server Enterprise), sqlserver-se (SQL Server Standard), sqlserver-ex (SQL Server Express), sqlserver-web (SQL Server Web)
Immutable after creation

engine_major_version

string

required

Engine major version. Examples: 15 for PostgreSQL or SQL Server, 8.0 for MySQL, 19 for Oracle.

Immutable after creation

engine_minor_version

string

Engine minor version. Optional minor engine version appended to the major version. Example: major 15 and minor 4 becomes 15.4.

minor_version_auto_upgrade_enabled

boolean

Auto minor version upgrades. Enable automatic minor engine version upgrades during the configured maintenance window.

Default: true

Size & Storage

instance_class

string

required

Instance class. RDS instance size, such as db.t4g.micro or db.r6g.large.

Default: db.t4g.micro

allocated_storage

number

required

Allocated storage (GiB). AWS supports increasing allocated storage after creation, but not reducing it in place.

Default: 20
Min: 20
Max: 65536

max_allocated_storage

number

Max allocated storage (GiB). Upper limit for RDS storage autoscaling. Use 0 to disable. AWS can grow storage up to this limit, but storage cannot be reduced in place.

Default: 0
Min: 0
Max: 65536

storage_type

string

Storage type.

Default: gp3
Allowed values: gp3, gp2, io1, io2, standard

iops

number

Provisioned IOPS.

Min: 1000
Max: 256000
Shown when: {"storage_type":["gp3","io1","io2"]}

storage_throughput

number

Storage throughput (MiB/s).

Min: 125
Max: 1000
Shown when: {"storage_type":"gp3"}

kms_key_id

string

Storage KMS key ARN.

Immutable after creation

ca_cert_identifier

string

CA certificate identifier.

Network access

public_access_enabled

boolean

Publicly accessible. Keep disabled for production databases unless public access is intentional.

Default: false

port

number

Port. Leave blank to use the engine default port.

Min: 1
Max: 65535

security_group_creation_enabled

boolean

Security group creation.

Default: true
Immutable after creation

security_group_id

string

Existing security group ID.

Shown when: {"security_group_creation_enabled":false}

allowed_security_group_ids

string_array

Allowed security groups.

Shown when: {"security_group_creation_enabled":true}

allowed_cidr_blocks

string_array

Allowed CIDR blocks.

Shown when: {"security_group_creation_enabled":true}

Availability & replicas

multi_az_enabled

boolean

Multi-AZ.

Default: false

availability_zone

string

Availability zone. Single-AZ placement. Hidden when Multi-AZ is enabled because AWS chooses standby placement.

Shown when: {"multi_az_enabled":false}

read_replica_creation_enabled

boolean

Read replicas.

Default: false
Shown when: {"engine":["mysql","postgres","mariadb","oracle-ee","oracle-se2","oracle-se2-cdb"]}

read_replica_count

number

Read replica count.

Default: 1
Min: 0
Max: 15
Shown when: {"engine":["mysql","postgres","mariadb","oracle-ee","oracle-se2","oracle-se2-cdb"],"read_replica_creation_enabled":true}

read_replica_instance_class

string

Read replica instance class.

Shown when: {"engine":["mysql","postgres","mariadb","oracle-ee","oracle-se2","oracle-se2-cdb"],"read_replica_creation_enabled":true}

read_replica_availability_zones

string_array

Read replica AZs.

Shown when: {"engine":["mysql","postgres","mariadb","oracle-ee","oracle-se2","oracle-se2-cdb"],"read_replica_creation_enabled":true}

Credentials & authentication

master_user_secret_kms_key_id

string

Secrets Manager KMS key ARN.

Shown when: {"restore_mode":"none"}

iam_database_authentication_enabled

boolean

IAM database authentication.

Default: false
Shown when: {"engine":["mysql","postgres"]}

SQL Server settings

license_model_sqlserver

string

License model.

Allowed values: license-included, bring-your-own-license
Immutable after creation
Shown when: {"engine":["sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"]}

character_set_name_sqlserver

string

Character set.

Immutable after creation
Shown when: {"engine":["sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"]}

timezone

string

SQL Server time zone.

Immutable after creation
Shown when: {"engine":["sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"]}

domain

string

Active Directory directory ID.

Immutable after creation
Shown when: {"engine":["sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"]}

domain_iam_role_name

string

Active Directory IAM role name.

Immutable after creation
Shown when: {"domain":{"not":""},"engine":["sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"]}

Oracle settings

license_model_oracle

string

License model.

Allowed values: license-included, bring-your-own-license
Immutable after creation
Shown when: {"engine":["oracle-ee","oracle-se2","oracle-se2-cdb"]}

character_set_name_oracle

string

Character set.

Immutable after creation
Shown when: {"engine":["oracle-ee","oracle-se2","oracle-se2-cdb"]}

Backups

backup_retention_period

number

Backup retention days.

Default: 7
Min: 0
Max: 35

backup_window

string

Backup window.

Shown when: {"backup_retention_period":{"not":0}}

snapshot_tag_copying_enabled

boolean

Copy tags to snapshots.

Default: true

automated_backups_deletion_enabled

boolean

Delete automated backups. Delete retained automated backups when the database is deleted. Disable this to preserve automated backups after deletion.

Default: true
Shown when: {"backup_retention_period":{"not":0}}

final_snapshot_creation_enabled

boolean

Create final snapshot.

Default: true

final_snapshot_identifier

string

Final snapshot identifier.

Shown when: {"final_snapshot_creation_enabled":true}

deletion_protection_enabled

boolean

Deletion protection.

Default: true

Maintenance

maintenance_window

string

Maintenance window.

major_version_upgrade_enabled

boolean

Allow major version upgrades.

Default: false

immediate_apply_enabled

boolean

Apply changes immediately.

Default: false

Monitoring

enabled_cloudwatch_logs_exports

string_array

CloudWatch log exports.

monitoring_interval

number

Enhanced monitoring interval.

Default: 0
Allowed values: 0 (0), 1 (1), 5 (5), 10 (10), 15 (15), 30 (30), 60 (60)

monitoring_role_creation_enabled

boolean

Monitoring IAM role creation.

Default: true
Immutable after creation
Shown when: {"monitoring_interval":{"not":0}}

monitoring_role_arn

string

Monitoring IAM role ARN.

Shown when: {"monitoring_interval":{"not":0},"monitoring_role_creation_enabled":false}

performance_insights_enabled

boolean

Performance insights.

Default: true

performance_insights_retention_period

number

Performance insights retention days.

Default: 7
Shown when: {"performance_insights_enabled":true}

performance_insights_kms_key_id

string

Performance insights KMS key ARN.

Shown when: {"performance_insights_enabled":true}

CloudWatch alarms

cloudwatch_alarms_creation_enabled

boolean

Create CloudWatch alarms.

Default: true

cloudwatch_alarm_cpu_threshold

number

CPU alarm threshold (%).

Default: 80
Min: 0
Max: 100
Shown when: {"cloudwatch_alarms_creation_enabled":true}

cloudwatch_alarm_storage_threshold_gib

number

Free storage alarm threshold (GiB). Displayed in GiB. Ravion converts this to bytes for Terraform.

Default: 5
Min: 0
Shown when: {"cloudwatch_alarms_creation_enabled":true}

cloudwatch_alarm_connections_threshold

number

Connections alarm threshold.

Default: 100
Min: 1
Shown when: {"cloudwatch_alarms_creation_enabled":true}

cloudwatch_alarm_evaluation_periods

number

Alarm evaluation periods.

Default: 2
Min: 1
Shown when: {"cloudwatch_alarms_creation_enabled":true}

cloudwatch_alarm_period

number

Alarm period seconds.

Default: 300
Allowed values: 10 (10), 30 (30), 60 (60), 300 (300), 900 (900), 3600 (3600)
Shown when: {"cloudwatch_alarms_creation_enabled":true}

cloudwatch_alarm_actions

string_array

Alarm action ARNs.

Shown when: {"cloudwatch_alarms_creation_enabled":true}

cloudwatch_ok_actions

string_array

OK action ARNs.

Shown when: {"cloudwatch_alarms_creation_enabled":true}

Parameter group

parameter_group_creation_enabled

boolean

Parameter group creation. Create a parameter group for this database. Disable this only when you want to attach an existing parameter group.

Default: true
Immutable after creation

parameter_group_name

string

Existing parameter group name. Name of an existing parameter group to attach when this module is not creating one.

Immutable after creation
Shown when: {"parameter_group_creation_enabled":false}

parameter_group_family

string

Parameter group family. Parameter group family, such as postgres15 or mysql8.0. Leave blank to derive it from the selected engine and major version.

Immutable after creation
Shown when: {"parameter_group_creation_enabled":true}

parameters

object_array

Parameters. Custom database engine parameters to apply to the created parameter group. Many changes require a database reboot depending on the parameter.

Default: []
Shown when: {"parameter_group_creation_enabled":true}

Show item fields

name

string

required

Name. Engine parameter name, such as log_statement or max_connections.

value

string

required

Value. Parameter value to set.

apply_method

string

Apply method. Apply immediately when supported, or wait until the next database reboot.

Default: immediate
Allowed values: immediate, pending-reboot

Option group

option_group_creation_enabled

boolean

Option group creation.

Default: false
Immutable after creation
Shown when: {"engine":["oracle-ee","oracle-se2","oracle-se2-cdb","sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"]}

option_group_name

string

Existing option group name.

Immutable after creation
Shown when: {"engine":["oracle-ee","oracle-se2","oracle-se2-cdb","sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"],"option_group_creation_enabled":false}

option_group_engine_version

string

Option group engine version.

Immutable after creation
Shown when: {"engine":["oracle-ee","oracle-se2","oracle-se2-cdb","sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"],"option_group_creation_enabled":true}

options

array

Options.

Default: []
Shown when: {"engine":["oracle-ee","oracle-se2","oracle-se2-cdb","sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"],"option_group_creation_enabled":true}

Blue/green deployments

blue_green_update_enabled

boolean

Blue/green updates.

Default: false
Shown when: {"engine":["mysql","mariadb"]}

Misc

Terraform settings

opentofu_version

string

OpenTofu version override. Override the environment’s default version for this module

ravion_state_backend_workspace

string

Ravion Terraform workspace name. Override Terraform state backend workspace name. Defaults to project + environment + module given ids.

Immutable after creation

advanced_terraform_variables

object

Advanced Terraform variables. Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.

Default: {}

​Dependencies and consumers

​Readme

​Overview

​Use cases

​Networking

​Database engine and sizing

​Credentials and security

​Availability, backups, and maintenance

​Observability

​Configuration

​Advanced configuration

​Design decisions

​Learn more

​Inputs reference

​Database

​Version

​Size & Storage

​Network access

​Availability & replicas

​Credentials & authentication

​SQL Server settings

​Oracle settings

​Backups

​Maintenance

​Monitoring

​CloudWatch alarms

​Parameter group

​Option group

​Blue/green deployments

​Misc

​Terraform settings

Dependencies and consumers

Readme

Overview

Use cases

Networking

Database engine and sizing

Credentials and security

Availability, backups, and maintenance

Observability

Configuration

Advanced configuration

Design decisions

Learn more

Inputs reference

Database

Version

Size & Storage

Network access

Availability & replicas

Credentials & authentication

SQL Server settings

Oracle settings

Backups

Maintenance

Monitoring

CloudWatch alarms

Parameter group

Option group

Blue/green deployments

Misc

Terraform settings