Modernisation Platform Terraform RDS Instance
June 25, 2026 · View on GitHub
Terraform module for provisioning an AWS RDS instance on the Modernisation Platform.
This repository is for Modernisation Platform usage only. If you have a suggestion for a change that would benefit multiple teams, please raise an issue with the team here.
Usage
module "rds" {
source = "github.com/ministryofjustice/modernisation-platform-terraform-rds-instance?ref=2d8e3b21b8f9a0b8acb81597a2d4575068edfede" # v0.6.0
tags = local.tags
application_name = local.application_name
vpc_id = data.aws_vpc.shared.id
subnet_ids = data.aws_subnets.shared_private.ids
allowed_security_groups = [aws_security_group.application.id]
db_engine = "postgres"
db_engine_version = "16"
db_parameter_group_family = "postgres16"
db_name = "app"
db_username = "app_admin"
monitoring_role_arn = aws_iam_role.rds_monitoring.arn
}
Looking for issues?
If you're looking to raise an issue with this module, please create a new issue in the Modernisation Platform repository.
Requirements
| Name | Version |
|---|---|
| terraform | ~> 1.0 |
| aws | ~> 6.0 |
| random | ~> 3.0 |
Providers
| Name | Version |
|---|---|
| aws | ~> 6.0 |
| random | ~> 3.0 |
Modules
No modules.
Resources
| Name | Type |
|---|---|
| aws_cloudwatch_log_group.rds | resource |
| aws_cloudwatch_log_subscription_filter.rds | resource |
| aws_db_instance.rds | resource |
| aws_db_parameter_group.rds | resource |
| aws_db_subnet_group.rds | resource |
| aws_secretsmanager_secret.rds | resource |
| aws_secretsmanager_secret_version.rds | resource |
| aws_security_group.rds | resource |
| aws_vpc_security_group_ingress_rule.allowed_cidrs | resource |
| aws_vpc_security_group_ingress_rule.allowed_sgs | resource |
| random_id.secret_suffix | resource |
| random_password.rds | resource |
| random_string.log_suffix | resource |
| aws_kinesis_firehose_delivery_stream.xsiam | data source |
| aws_subnets.rds | data source |
Inputs
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| allow_major_version_upgrade | Allow major engine version upgrades when changing engine_version | bool | false | no |
| allowed_cidr_blocks | List of CIDR blocks permitted to connect to the RDS instance | list(string) | [] | no |
| allowed_security_groups | List of security group IDs permitted to connect to the RDS instance | list(string) | [] | no |
| application_name | Name of application | string | n/a | yes |
| auto_minor_version_upgrade | Automatically apply minor engine version upgrades during the maintenance window | bool | true | no |
| backup_retention_period | Number of days to retain automated backups. 0 disables automated backups. | number | 7 | no |
| backup_window | Preferred daily time range for automated backups in UTC (e.g. 03:00-06:00) | string | "03:00-06:00" | no |
| ca_cert_identifier | Identifier of the CA certificate for the DB instance. Defaults to rds-ca-rsa4096-g1 (RSA 4096-bit, 100-year validity). Override to rds-ca-ecc384-g1 for ECC or rds-ca-rsa2048-g1 for broader client compatibility. | string | "rds-ca-rsa4096-g1" | no |
| cloudwatch_log_retention_days | Number of days to retain RDS logs in CloudWatch log groups. | number | 30 | no |
| db_allocated_storage | Allocated storage in GiB | number | 20 | no |
| db_engine | Database engine type (e.g. postgres, mysql, mariadb, oracle-se2, sqlserver-se) | string | n/a | yes |
| db_engine_version | Database engine version | string | n/a | yes |
| db_instance_class | RDS instance class | string | "db.t3.medium" | no |
| db_iops | Provisioned IOPS for the storage. Required for io1 and io2 storage types. Minimum 1000. | number | null | no |
| db_max_allocated_storage | Upper limit for storage autoscaling in GiB. Set to 0 to disable autoscaling. | number | 0 | no |
| db_name | Name of the initial database to create. When restoring from a snapshot or creating a replica, this is inherited from the source and can be left null. | string | null | no |
| db_parameter_group_family | Parameter group family used to create the module-managed parameter group with SSL enforcement (e.g. postgres16, mysql8.0, mariadb10.11, sqlserver-se-15.0). Required unless parameter_group_name is set. Not applicable to Oracle - configure SSL via the option group instead. | string | null | no |
| db_port | Port on which the DB accepts connections. Defaults to 5432 (PostgreSQL). | number | 5432 | no |
| db_storage_type | Storage type (gp2, gp3, io1, io2) | string | "gp3" | no |
| db_username | Master username for the database. Required for new instances and snapshot restores. Inherited from the source instance when replicate_source_db is set. | string | null | no |
| deletion_protection | Enables deletion protection on the RDS instance | bool | true | no |
| kms_key_id | ARN of the KMS key used for storage and Secrets Manager encryption. Uses the AWS-managed key if not set. | string | null | no |
| maintenance_window | Preferred weekly time range for maintenance (e.g. Mon:00:00-Mon:03:00) | string | "Mon:00:00-Mon:03:00" | no |
| monitoring_interval | Interval in seconds for Enhanced Monitoring metrics. Must be 1, 5, 10, 15, 30, or 60. Defaults to 60 (enabled). | number | 60 | no |
| monitoring_role_arn | ARN of the IAM role that allows RDS to send Enhanced Monitoring metrics to CloudWatch. Required for monitoring. | string | n/a | yes |
| multi_az | Whether to deploy the RDS instance across multiple Availability Zones | bool | true | no |
| opt_in_xsiam_logging | If true, forwards RDS CloudWatch logs to XSIAM Cortex via Kinesis Firehose. Requires xsiam_firehose_stream_name and xsiam_cloudwatch_role_arn. | bool | false | no |
| option_group_name | Name of the DB option group to associate with the instance (MySQL and Oracle only) | string | null | no |
| parameter_group_name | Name of a pre-existing DB parameter group to associate with the instance. When set, the module-managed parameter group (and its SSL enforcement settings) is not created. | string | null | no |
| performance_insights_enabled | Enable Performance Insights for the RDS instance | bool | true | no |
| performance_insights_retention_period | Retention period for Performance Insights data in days. Must be 7 or 731. | number | 7 | no |
| replicate_source_db | Identifier or ARN of the source RDS instance to create a read replica from. When set, db_username, db_name, and the master password are inherited from the source — Secrets Manager is not provisioned for the replica. | string | null | no |
| skip_final_snapshot | Whether to skip taking a final snapshot before destroying the instance | bool | false | no |
| snapshot_identifier | Snapshot identifier to restore the instance from. When set, the instance is created from this snapshot instead of a blank database. db_username must match the snapshot's master username. | string | null | no |
| subnet_ids | List of explicit subnet IDs for the DB subnet group. When set, overrides subnet discovery via tags. | list(string) | null | no |
| subnet_tags | Subnet tags used to discover existing subnets for the DB subnet group in the target VPC. Ignored if subnet_ids is set. | map(string) | { | no |
| tags | Common tags to be used by all resources | map(string) | n/a | yes |
| vpc_id | VPC ID where the RDS instance will be deployed | string | n/a | yes |
| xsiam_cloudwatch_role_arn | ARN of the IAM role that allows CloudWatch Logs to write to the Firehose stream. Required when opt_in_xsiam_logging = true. | string | null | no |
| xsiam_firehose_stream_name | Name of the Kinesis Firehose delivery stream to send logs to. Required when opt_in_xsiam_logging = true. | string | null | no |
Outputs
No outputs.