rvn-rds-proxy / Latest version: 0.2.1
Dependencies and consumers
Every dependency input can be specified manually to reference existing external infrastructure rather than a Ravion module. Set the dependency input tonull and set its mapped inputs directly; see Use existing infrastructure instead of a module reference.
Readme
Creates and manages an Amazon RDS Proxy that provides connection pooling in front of an RDS instance or Aurora cluster.Overview
Use this module to place a managed connection pool in front of an existing database. The proxy holds a pool of database connections open and multiplexes application connections onto them, which protects the database from connection storms and makes failovers faster for clients. The RDS and Aurora modules can create a proxy directly with their RDS Proxy toggle. Use this standalone module when the target database is not managed by Ravion, or when you want to manage the proxy lifecycle separately from the database.Target database
Target type selects whether the proxy registers an RDS instance or an Aurora cluster, and shows the matching database module selector. Selecting an RDS or Aurora module fills the database identifier, managed master user secret, and port from that module’s stack outputs. For a database managed outside Ravion, leave the module unselected and enter the identifier, and any auth secret ARNs, directly. When a Ravion module supplies the target, add this proxy’s security group ID to that module’s allowed security groups. The proxy connects to the database through the database security group, and the database module owns those ingress rules. Applications do not use the proxy until you point their connection string at the proxy endpoint output.Use cases
Networking
Select a VPC network first. Ravion maps the network’s AWS account, region, VPC ID, and private subnet IDs into this module. The proxy must be in the same VPC as the target database, and the database’s security group must allow ingress from the proxy security group. Allowed security groups and CIDR blocks control which sources can connect to the proxy.Authentication
The proxy reads database credentials from the Secrets Manager secrets listed in auth secret ARNs. Leave that field blank when a selected database module manages its master password in Secrets Manager; the proxy then uses that module’s master user secret. Add auth secret ARNs explicitly for databases identified by identifier, for databases whose password is managed outside Secrets Manager, or to authenticate as a different database user. The module creates an IAM role that can read only the resolved auth secrets; provide KMS key ARNs when the secrets use customer-managed keys. TLS is required by default, and IAM authentication for clients is optional.Configuration
Advanced configuration
Connection pool settings control borrow timeouts, idle connection limits, session pinning filters, and an initialization query. Debug logging sends detailed connection information to CloudWatch Logs. Use advanced Terraform variables for one-off overrides not represented directly in the UI. Terraform settings let you override the OpenTofu version, Terraform execution environment inherited from the VPC network, and Ravion state backend workspace name.Design decisions
The proxy is placed in private subnets by default through the VPC network reference. TLS enforcement and Secrets Manager based authentication default on. The created IAM role follows least privilege and can read only the listed auth secrets.Learn more
Inputs reference
All inputs forrvn-rds-proxy version 0.2.1. Use the name shown for each field as the input key in module config.
$ref:rvn-aws-network
required
VPC network.
- Immutable after creation
network to null.
Mapped inputs for network: set these keys alongside network, not inside it, when supplying existing infrastructure instead of a module reference.
section
AWS account & region.
string
AWS account.
- Default:
<< ref.input.aws_account_id >> - Immutable after creation
string
Region.
- Default:
<< ref.input.aws_region >> - Immutable after creation
string
Terraform execution environment. Override the VPC, subnet, and security group for Pipeline Terraform runners. Must use the same AWS account as selected above.
- Default:
<< ref.input.execution_environment_id >>
section
VPC.
string
required
VPC ID.
- Default:
<<ref.stack.output.vpc_id>> - Immutable after creation
string_array
required
Private subnet IDs. Subnets for the RDS Proxy. Use private subnets for normal deployments.
- Default:
<<ref.stack.output.private_subnet_ids>> - Immutable after creation
Proxy
string
required
Name slug. Name prefix for all proxy resources.
- Default:
<<project.given_id>>-<<environment.given_id>>-proxy - Immutable after creation
- Pattern:
^[a-z0-9]([a-z0-9-]{0,38}[a-z0-9])?$— 1-40 lowercase letters, numbers, and hyphens. Start and end with a letter or number.
string
required
Engine family. Must match the engine of the target database.
- Default:
POSTGRESQL - Allowed values:
POSTGRESQL(PostgreSQL),MYSQL(MySQL / MariaDB),SQLSERVER(SQL Server) - Immutable after creation
Target database
string
required
Target type. Register an RDS instance or an Aurora cluster as the proxy target.
- Default:
db_instance - Allowed values:
db_instance(RDS instance),db_cluster(Aurora cluster)
$ref:rvn-rds
RDS database. RDS database module to register as the proxy target. Add this proxy’s security group to that module’s allowed security groups so the database accepts proxy connections.
- Shown when:
{"target_type":"db_instance"}
rds_database to null.
Mapped inputs for rds_database: set these keys alongside rds_database, not inside it, when supplying existing infrastructure instead of a module reference.
string
required
DB instance identifier. Instance identifier from the selected RDS module, or the identifier of an existing RDS instance.
- Default:
<<ref.stack.output.db_instance_identifier>>
string
Master user secret ARN. Managed master user secret from the selected RDS module. Blank when that database does not manage its password in Secrets Manager; add auth secret ARNs instead.
- Default:
<<ref.stack.output.master_user_secret_arn>>
number
Database port. Database port from the selected RDS module. Leave blank to use the engine family default port.
- Default:
<<ref.stack.output.port>>
$ref:rvn-aurora
Aurora cluster. Aurora cluster module to register as the proxy target. Add this proxy’s security group to that module’s allowed security groups so the cluster accepts proxy connections.
- Shown when:
{"target_type":"db_cluster"}
aurora_database to null.
Mapped inputs for aurora_database: set these keys alongside aurora_database, not inside it, when supplying existing infrastructure instead of a module reference.
string
required
DB cluster identifier. Cluster identifier from the selected Aurora module, or the identifier of an existing Aurora cluster.
- Default:
<<ref.stack.output.cluster_identifier>>
string
Master user secret ARN. Managed master user secret from the selected Aurora module. Blank when that cluster does not manage its password in Secrets Manager; add auth secret ARNs instead.
- Default:
<<ref.stack.output.cluster_master_user_secret_arn>>
number
Database port. Cluster port from the selected Aurora module. Leave blank to use the engine family default port.
- Default:
<<ref.stack.output.cluster_port>>
Authentication
string_array
Auth secret ARNs. Secrets Manager secrets containing database credentials the proxy uses to connect to the target database. Leave blank to use the managed master user secret of the selected database module.
string_array
Auth secret KMS key ARNs. KMS keys used to encrypt the auth secrets when using customer-managed keys.
boolean
IAM authentication. Require IAM authentication for client connections to the proxy.
- Default:
false
boolean
Require TLS. Require TLS for client connections to the proxy.
- Default:
true
boolean
IAM role creation. Create the IAM role the proxy uses to read credentials from Secrets Manager. Disable this only when you want to provide an existing role.
- Default:
true - Immutable after creation
string
Existing IAM role ARN.
- Shown when:
{"iam_role_creation_enabled":false}
Network access
number
Port. Leave blank to use the port of the selected database module, or the engine family default port: 5432 for PostgreSQL, 3306 for MySQL, or 1433 for SQL Server.
- Min:
1 - Max:
65535
boolean
Security group creation.
- Default:
true - Immutable after creation
string
Existing security group ID.
- Shown when:
{"security_group_creation_enabled":false}
string_array
Allowed security groups.
- Shown when:
{"security_group_creation_enabled":true}
string_array
Allowed CIDR blocks.
- Shown when:
{"security_group_creation_enabled":true}
Connection pool
number
Idle client timeout (seconds).
- Default:
1800 - Min:
1 - Max:
28800
number
Connection borrow timeout (seconds).
- Default:
120 - Min:
0
number
Max connections (%). Maximum size of the connection pool as a percentage of the database max_connections setting.
- Default:
100 - Min:
1 - Max:
100
number
Max idle connections (%). Maximum idle connections kept open, as a percentage of the database max_connections setting.
- Default:
50 - Min:
0 - Max:
100
string_array
Session pinning filters.
- Allowed values:
EXCLUDE_VARIABLE_SETS
string
Initialization query. SQL statements the proxy runs when opening each new database connection.
boolean
Debug logging. Log detailed connection information, including SQL statements, to CloudWatch Logs.
- Default:
false
Misc
keyvalue
Tags. A map of tags to assign to all resources. Default tags are
Owner, ProjectGivenId, EnvironmentGivenId, ModuleGivenId, ModuleIdTerraform settings
string
OpenTofu version override. Override the environment’s default version for this module
string
Ravion Terraform workspace name. Override Terraform state backend workspace name. Defaults to project + environment + module given ids.
- Immutable after creation
boolean
Include default plan policies. Turn off to plan with only the policies below instead of the default read-only policies. Requires at least one policy below.
- Default:
true
string_array
Terraform plan IAM policies. IAM managed policy ARNs for the Terraform plan runner role. Without default policies, allow s3:CreateBucket, s3:PutObject, s3:GetObject, and s3:ListBucket on the ravion-terraform-plans-<AWS account number> bucket in this account.
- Default:
[]
boolean
Include default apply policies. Turn off to apply and destroy with only the policies below instead of AdministratorAccess. Requires at least one policy below.
- Default:
true
string_array
Terraform apply IAM policies. IAM managed policy ARNs for the Terraform apply runner role. Without default policies, allow s3:CreateBucket, s3:PutObject, s3:GetObject, and s3:ListBucket on the ravion-terraform-plans-<AWS account number> bucket in this account.
- Default:
[]
object
Advanced Terraform variables. Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.
- Default:
{}