Skip to main content
Type: rvn-rds / Latest version: 1.4.0 See RDS Database module reference for the full module page.
​
$ref:rvn-aws-network
required
VPC network.
  • Immutable after creation
Set network to null. Mapped inputs for network: set these keys alongside network, not inside it, when supplying existing infrastructure instead of a module reference.
​
section
AWS account & region.
​
string
AWS account.
  • Default: << ref.input.aws_account_id >>
  • Immutable after creation
​
string
Region.
  • Default: << ref.input.aws_region >>
  • Immutable after creation
​
string
Terraform execution environment. Override the VPC, subnet, and security group for Pipeline Terraform runners. Must use the same AWS account as selected above.
  • Default: << ref.input.execution_environment_id >>
​
section
VPC.
​
string
required
VPC ID.
  • Default: <<ref.stack.output.vpc_id>>
  • Immutable after creation
​
string_array
required
Private subnet IDs. Subnets for the RDS DB subnet group. Use private subnets for normal database deployments.
  • Default: <<ref.stack.output.private_subnet_ids>>
  • Immutable after creation

​
Database

​
string
required
Name slug. Name prefix for all RDS resources.
  • Default: <<project.given_id>>-<<environment.given_id>>
  • Immutable after creation
  • Pattern: ^[a-z0-9]([a-z0-9-]{0,38}[a-z0-9])?$ — 1-40 lowercase letters, numbers, and hyphens. Start and end with a letter or number.
​
string
required
Create or restore.
  • Default: none
  • Allowed values: none (New empty database), snapshot (Restore from snapshot), point_in_time (Point-in-time restore)
  • Immutable after creation
​
string
required
Database name.
  • Immutable after creation
  • Pattern: ^[a-z][a-z0-9_]{0,63}$ — 1-64 lowercase letters, numbers, and underscores. Start with a letter.
  • Pattern: ^(?:|[^adimnoprst].*|a(?:|[^d].*|d(?:|[^m].*|m(?:|[^i].*|i(?:|[^n].*|n.+))))|d(?:|[^a].*|a(?:|[^t].*|t(?:|[^a].*|a(?:|[^b].*|b(?:|[^a].*|a(?:|[^s].*|s(?:|[^e].*|e(?:[^s].*|s.+))))))))|i(?:|[^n].*|n(?:|[^f].*|f(?:|[^o].*|o(?:|[^r].*|r(?:|[^m].*|m(?:|[^a].*|a(?:|[^t].*|t(?:|[^i].*|i(?:|[^o].*|o(?:|[^n].*|n(?:|[^_].*|_(?:|[^s].*|s(?:|[^c].*|c(?:|[^h].*|h(?:|[^e].*|e(?:|[^m].*|m(?:|[^a].*|a.+)))))))))))))))))|m(?:|[^y].*|y(?:|[^s].*|s(?:|[^q].*|q(?:|[^l].*|l.+))))|n(?:|[^u].*|u(?:|[^l].*|l(?:|[^l].*|l.+)))|o(?:|[^r].*|r(?:|[^a].*|a(?:|[^c].*|c(?:|[^l].*|l(?:|[^e].*|e.+)))))|p(?:|[^eo].*|e(?:|[^r].*|r(?:|[^f].*|f(?:|[^o].*|o(?:|[^r].*|r(?:|[^m].*|m(?:|[^a].*|a(?:|[^n].*|n(?:|[^c].*|c(?:|[^e].*|e(?:|[^_].*|_(?:|[^s].*|s(?:|[^c].*|c(?:|[^h].*|h(?:|[^e].*|e(?:|[^m].*|m(?:|[^a].*|a.+))))))))))))))))|o(?:|[^s].*|s(?:|[^t].*|t(?:|[^g].*|g(?:|[^r].*|r(?:|[^e].*|e(?:|[^s].*|s.+)))))))|r(?:|[^do].*|d(?:|[^s].*|s(?:|[^a].*|a(?:|[^d].*|d(?:|[^m].*|m(?:|[^i].*|i(?:|[^n].*|n.+))))))|o(?:|[^o].*|o(?:|[^t].*|t.+)))|s(?:|[^y].*|y(?:|[^s].*|s.+))|t(?:|[^e].*|e(?:|[^m].*|m(?:|[^p].*|p(?:|[^l].*|l(?:|[^a].*|a(?:|[^t].*|t(?:|[^e].*|e(?:|[^01].*|0.+|1.+)))))))))$ — Pick a different name, this is reserved by AWS.
  • Shown when: {"engine":["mysql","postgres","mariadb","oracle-ee","oracle-se2","oracle-se2-cdb"],"restore_mode":"none"}
​
string
required
Username.
  • Default: dbadmin
  • Immutable after creation
  • Pattern: ^[A-Za-z][A-Za-z0-9_]{0,62}$ — Invalid RDS master username. Start with a letter. Letters, numbers, and underscores only.
  • Shown when: {"restore_mode":"none"}
​
string
Snapshot to restore. Snapshot identifier or ARN to restore into this new database. The snapshot must be compatible with the selected engine and instance settings.
  • Immutable after creation
  • Shown when: {"restore_mode":"snapshot"}
​
boolean
Use latest restorable time. Restore to the latest time AWS can recover from the selected source database backup.
  • Default: true
  • Immutable after creation
  • Shown when: {"restore_mode":"point_in_time"}
​
string
Restore time. Restore to this UTC timestamp instead of the latest restorable time.
  • Immutable after creation
  • Shown when: {"point_in_time_use_latest_restorable_time":false,"restore_mode":"point_in_time"}
​
string
Source DB instance identifier. Source DB instance identifier to restore from.
  • Immutable after creation
  • Shown when: {"restore_mode":"point_in_time"}
​
string
Source automated backups ARN. ARN of the source automated backups to restore from. Use this for cross-region or retained automated backup restores.
  • Immutable after creation
  • Shown when: {"restore_mode":"point_in_time"}
​
string
Source DB resource ID. Source DB resource ID to restore from when using automated backups.
  • Immutable after creation
  • Shown when: {"restore_mode":"point_in_time"}

​
Version

​
string
required
Engine.
  • Default: postgres
  • Allowed values: postgres (PostgreSQL), mysql (MySQL), mariadb (MariaDB), oracle-ee (Oracle Enterprise Edition), oracle-se2 (Oracle Standard Edition 2), oracle-se2-cdb (Oracle Standard Edition 2 CDB), sqlserver-ee (SQL Server Enterprise), sqlserver-se (SQL Server Standard), sqlserver-ex (SQL Server Express), sqlserver-web (SQL Server Web)
  • Immutable after creation
​
string
required
Engine major version. Examples: 15 for PostgreSQL or SQL Server, 8.0 for MySQL, 19 for Oracle.
​
string
Engine minor version. Optional minor engine version appended to the major version. Example: major 15 and minor 4 becomes 15.4.
​
boolean
Auto minor version upgrades. Enable automatic minor engine version upgrades during the configured maintenance window.
  • Default: true

​
Size & Storage

​
string
required
Instance class. RDS instance size, such as db.t4g.micro or db.r6g.large.
  • Default: db.t4g.micro
​
number
required
Allocated storage (GiB). AWS supports increasing allocated storage after creation, but not reducing it in place.
  • Default: 20
  • Min: 20
  • Max: 65536
​
number
Max allocated storage (GiB). Upper limit for RDS storage autoscaling. Use 0 to disable. AWS can grow storage up to this limit, but storage cannot be reduced in place.
  • Default: 0
  • Min: 0
  • Max: 65536
​
string
Storage type.
  • Default: gp3
  • Allowed values: gp3, gp2, io1, io2, standard
​
number
Provisioned IOPS.
  • Min: 1000
  • Max: 256000
  • Shown when: {"storage_type":["gp3","io1","io2"]}
​
number
Storage throughput (MiB/s).
  • Min: 125
  • Max: 1000
  • Shown when: {"storage_type":"gp3"}
​
string
Storage KMS key ARN.
  • Immutable after creation
​
string
CA certificate identifier.

​
Network access

​
boolean
Publicly accessible. Keep disabled for production databases unless public access is intentional.
  • Default: false
​
number
Port. Leave blank to use the engine default port.
  • Min: 1
  • Max: 65535
​
boolean
Security group creation.
  • Default: true
  • Immutable after creation
​
string
Existing security group ID.
  • Shown when: {"security_group_creation_enabled":false}
​
string_array
Allowed security groups.
  • Shown when: {"security_group_creation_enabled":true}
​
string_array
Allowed CIDR blocks.
  • Shown when: {"security_group_creation_enabled":true}

​
Connection pooling

​
boolean
RDS Proxy. Create an RDS Proxy in front of the database for connection pooling and improved failover handling. Applications keep connecting to the database endpoint until you update their connection string to the proxy endpoint output.
  • Default: false
  • Shown when: {"engine":["mysql","postgres","mariadb","sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"]}
​
string_array
Auth secret ARNs. Secrets Manager secrets containing database credentials for the proxy. Leave blank to use the managed master user secret.
  • Shown when: {"proxy_creation_enabled":true}
​
string_array
Auth secret KMS key ARNs. KMS keys used to encrypt the auth secrets when using customer-managed keys. The master user secret KMS key is included automatically.
  • Shown when: {"proxy_creation_enabled":true}
​
boolean
IAM authentication. Require IAM authentication for client connections to the proxy.
  • Default: false
  • Shown when: {"proxy_creation_enabled":true}
​
boolean
Require TLS. Require TLS for client connections to the proxy.
  • Default: true
  • Shown when: {"proxy_creation_enabled":true}
​
boolean
Debug logging. Log detailed connection information, including SQL statements, to CloudWatch Logs.
  • Default: false
  • Shown when: {"proxy_creation_enabled":true}
​
number
Idle client timeout (seconds).
  • Default: 1800
  • Min: 1
  • Max: 28800
  • Shown when: {"proxy_creation_enabled":true}
​
number
Connection borrow timeout (seconds).
  • Default: 120
  • Min: 0
  • Shown when: {"proxy_creation_enabled":true}
​
number
Max connections (%). Maximum size of the connection pool as a percentage of the database max_connections setting.
  • Default: 100
  • Min: 1
  • Max: 100
  • Shown when: {"proxy_creation_enabled":true}
​
number
Max idle connections (%). Maximum idle connections kept open, as a percentage of the database max_connections setting.
  • Default: 50
  • Min: 0
  • Max: 100
  • Shown when: {"proxy_creation_enabled":true}
​
string_array
Session pinning filters.
  • Allowed values: EXCLUDE_VARIABLE_SETS
  • Shown when: {"proxy_creation_enabled":true}
​
string
Initialization query. SQL statements the proxy runs when opening each new database connection.
  • Shown when: {"proxy_creation_enabled":true}

​
Availability & replicas

​
boolean
Multi-AZ.
  • Default: false
​
string
Availability zone. Single-AZ placement. Hidden when Multi-AZ is enabled because AWS chooses standby placement.
  • Shown when: {"multi_az_enabled":false}
​
boolean
Read replicas.
  • Default: false
  • Shown when: {"engine":["mysql","postgres","mariadb","oracle-ee","oracle-se2","oracle-se2-cdb"]}
​
number
Read replica count.
  • Default: 1
  • Min: 0
  • Max: 15
  • Shown when: {"engine":["mysql","postgres","mariadb","oracle-ee","oracle-se2","oracle-se2-cdb"],"read_replica_creation_enabled":true}
​
string
Read replica instance class.
  • Shown when: {"engine":["mysql","postgres","mariadb","oracle-ee","oracle-se2","oracle-se2-cdb"],"read_replica_creation_enabled":true}
​
string_array
Read replica AZs.
  • Shown when: {"engine":["mysql","postgres","mariadb","oracle-ee","oracle-se2","oracle-se2-cdb"],"read_replica_creation_enabled":true}

​
Credentials & authentication

​
boolean
Manage password in Secrets Manager. Let AWS generate and manage the master password in Secrets Manager. Disable before importing a database whose existing password is managed externally.
  • Default: true
​
boolean
Preserve existing master password. Preserve the externally managed password of an imported database. Ravion verifies that the named database already exists in AWS.
  • Default: false
  • Shown when: {"master_user_password_management_enabled":false}
​
string
Secrets Manager KMS key ARN.
  • Shown when: {"master_user_password_management_enabled":true,"restore_mode":"none"}
​
boolean
IAM database authentication.
  • Default: false
  • Shown when: {"engine":["mysql","postgres"]}

​
SQL Server settings

​
string
License model.
  • Allowed values: license-included, bring-your-own-license
  • Immutable after creation
  • Shown when: {"engine":["sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"]}
​
string
Character set.
  • Immutable after creation
  • Shown when: {"engine":["sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"]}
​
string
SQL Server time zone.
  • Immutable after creation
  • Shown when: {"engine":["sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"]}
​
string
Active Directory directory ID.
  • Immutable after creation
  • Shown when: {"engine":["sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"]}
​
string
Active Directory IAM role name.
  • Immutable after creation
  • Shown when: {"domain":{"not":""},"engine":["sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"]}

​
Oracle settings

​
string
License model.
  • Allowed values: license-included, bring-your-own-license
  • Immutable after creation
  • Shown when: {"engine":["oracle-ee","oracle-se2","oracle-se2-cdb"]}
​
string
Character set.
  • Immutable after creation
  • Shown when: {"engine":["oracle-ee","oracle-se2","oracle-se2-cdb"]}

​
Backups

​
number
Backup retention days.
  • Default: 7
  • Min: 0
  • Max: 35
​
string
Backup window.
  • Shown when: {"backup_retention_period":{"not":0}}
​
boolean
Copy tags to snapshots.
  • Default: true
​
boolean
Delete automated backups. Delete retained automated backups when the database is deleted. Disable this to preserve automated backups after deletion.
  • Default: true
  • Shown when: {"backup_retention_period":{"not":0}}
​
boolean
Create final snapshot.
  • Default: true
​
string
Final snapshot identifier.
  • Shown when: {"final_snapshot_creation_enabled":true}
​
boolean
Deletion protection.
  • Default: true

​
Maintenance

​
string
Maintenance window.
​
boolean
Allow major version upgrades.
  • Default: false
​
boolean
Apply changes immediately.
  • Default: false

​
Monitoring

​
string_array
CloudWatch log exports.
​
number
Enhanced monitoring interval.
  • Default: 0
  • Allowed values: 0 (0), 1 (1), 5 (5), 10 (10), 15 (15), 30 (30), 60 (60)
​
boolean
Monitoring IAM role creation.
  • Default: true
  • Immutable after creation
  • Shown when: {"monitoring_interval":{"not":0}}
​
string
Monitoring IAM role ARN.
  • Shown when: {"monitoring_interval":{"not":0},"monitoring_role_creation_enabled":false}
​
boolean
Performance insights.
  • Default: true
​
number
Performance insights retention days.
  • Default: 7
  • Shown when: {"performance_insights_enabled":true}
​
string
Performance insights KMS key ARN.
  • Shown when: {"performance_insights_enabled":true}

​
CloudWatch alarms

​
boolean
Create CloudWatch alarms.
  • Default: true
​
number
CPU alarm threshold (%).
  • Default: 80
  • Min: 0
  • Max: 100
  • Shown when: {"cloudwatch_alarms_creation_enabled":true}
​
number
Free storage alarm threshold (GiB). Triggers when the primary instance’s period average falls below this value.
  • Default: 5
  • Min: 0
  • Shown when: {"cloudwatch_alarms_creation_enabled":true}
​
number
Read IOPS alarm threshold. Average for the primary instance, in operations per second. Tune to workload capacity.
  • Default: 1000
  • Min: 1
  • Shown when: {"cloudwatch_alarms_creation_enabled":true}
​
number
Write IOPS alarm threshold. Average for the primary instance, in operations per second. Tune to workload capacity.
  • Default: 1000
  • Min: 1
  • Shown when: {"cloudwatch_alarms_creation_enabled":true}
​
number
Connections alarm threshold.
  • Default: 100
  • Min: 1
  • Shown when: {"cloudwatch_alarms_creation_enabled":true}
​
number
Alarm evaluation periods.
  • Default: 2
  • Min: 1
  • Shown when: {"cloudwatch_alarms_creation_enabled":true}
​
number
Alarm period seconds. I/O uses at least one minute; other metrics use this value.
  • Default: 300
  • Allowed values: 10 (10), 30 (30), 60 (60), 300 (300), 900 (900), 3600 (3600)
  • Shown when: {"cloudwatch_alarms_creation_enabled":true}
​
string_array
Alarm action ARNs.
  • Shown when: {"cloudwatch_alarms_creation_enabled":true}
​
string_array
OK action ARNs.
  • Shown when: {"cloudwatch_alarms_creation_enabled":true}

​
Parameter group

​
boolean
Parameter group creation. Create a parameter group for this database. Disable this only when you want to attach an existing parameter group.
  • Default: true
  • Immutable after creation
​
string
Existing parameter group name. Name of an existing parameter group to attach when this module is not creating one.
  • Immutable after creation
  • Shown when: {"parameter_group_creation_enabled":false}
​
string
Parameter group family. Parameter group family, such as postgres15 or mysql8.0. Leave blank to derive it from the selected engine and major version.
  • Immutable after creation
  • Shown when: {"parameter_group_creation_enabled":true}
​
object_array
Parameters. Custom database engine parameters to apply to the created parameter group. Many changes require a database reboot depending on the parameter.
  • Default: []
  • Shown when: {"parameter_group_creation_enabled":true}

​
Option group

​
boolean
Option group creation.
  • Default: false
  • Immutable after creation
  • Shown when: {"engine":["oracle-ee","oracle-se2","oracle-se2-cdb","sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"]}
​
string
Existing option group name.
  • Immutable after creation
  • Shown when: {"engine":["oracle-ee","oracle-se2","oracle-se2-cdb","sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"],"option_group_creation_enabled":false}
​
string
Option group engine version.
  • Immutable after creation
  • Shown when: {"engine":["oracle-ee","oracle-se2","oracle-se2-cdb","sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"],"option_group_creation_enabled":true}
​
array
Options.
  • Default: []
  • Shown when: {"engine":["oracle-ee","oracle-se2","oracle-se2-cdb","sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"],"option_group_creation_enabled":true}

​
Blue/green deployments

​
boolean
Blue/green updates.
  • Default: false
  • Shown when: {"engine":["mysql","mariadb"]}

​
Misc

​
keyvalue
Tags. A map of tags to assign to all resources. Default tags are Owner, ProjectGivenId, EnvironmentGivenId, ModuleGivenId, ModuleId

​
Terraform settings

​
string
OpenTofu version override. Override the environment’s default version for this module
​
string
Ravion Terraform workspace name. Override Terraform state backend workspace name. Defaults to project + environment + module given ids.
  • Immutable after creation
​
boolean
Include default plan policies. Turn off to plan with only the policies below instead of the default read-only policies. Requires at least one policy below.
  • Default: true
​
string_array
Terraform plan IAM policies. IAM managed policy ARNs for the Terraform plan runner role. Without default policies, allow s3:CreateBucket, s3:PutObject, s3:GetObject, and s3:ListBucket on the ravion-terraform-plans-<AWS account number> bucket in this account.
  • Default: []
​
boolean
Include default apply policies. Turn off to apply and destroy with only the policies below instead of AdministratorAccess. Requires at least one policy below.
  • Default: true
​
string_array
Terraform apply IAM policies. IAM managed policy ARNs for the Terraform apply runner role. Without default policies, allow s3:CreateBucket, s3:PutObject, s3:GetObject, and s3:ListBucket on the ravion-terraform-plans-<AWS account number> bucket in this account.
  • Default: []
​
object
Advanced Terraform variables. Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.
  • Default: {}