Module library

RDS Proxy

Terraform module to create AWS RDS Proxy resources

Inputs

40 / 44
authoptionalmap(object({ auth_scheme = optional(string) client_password_auth_type = optional…

Configuration block(s) with authorization mechanisms to connect to the associated instances or clusters

Default{…}
connection_borrow_timeoutoptionalnumber

The number of seconds for a proxy to wait for a connection to become available in the connection pool

Defaultnull
createoptionalbool

Whether cluster should be created (affects nearly all resources)

Defaulttrue
create_iam_policyoptionalbool

Determines whether an IAM policy is created

Defaulttrue
create_iam_roleoptionalbool

Determines whether an IAM role is created

Defaulttrue
db_cluster_identifieroptionalstring

DB cluster identifier

Default""
db_instance_identifieroptionalstring

DB instance identifier

Default""
debug_loggingoptionalbool

Whether the proxy includes detailed information about SQL statements in its logs

Defaultfalse
default_auth_schemeoptionalstring

Default authentication scheme that the proxy uses for client connections to the proxy and connections from the proxy to the underlying database. Valid values are NONE and IAM_AUTH. Defaults to NONE

Defaultnull
endpoint_network_typeoptionalstring

Network type of the DB proxy endpoint. Valid values are IPV4, IPV6 and DUAL. Defaults to IPV4. If IPV6 is specified, the subnets associated with the proxy must be IPv6-only, and target_connection_network_type must be IPV6

Defaultnull
endpointsoptionalmap(object({ name = optional(string) vpc_subnet_ids = list(string) vpc_security_…

Map of DB proxy endpoints to create and their attributes

Default{}
engine_familyoptionalstring

The kind of database engine that the proxy will connect to. Valid values are `MYSQL` or `POSTGRESQL`

Default""
iam_policy_nameoptionalstring

The name of the role policy. If omitted, Terraform will assign a random, unique name

Default""
iam_role_descriptionoptionalstring

The description of the role

Default""
iam_role_force_detach_policiesoptionalbool

Specifies to force detaching any policies the role has before destroying it

Defaulttrue
iam_role_max_session_durationoptionalnumber

The maximum session duration (in seconds) that you want to set for the specified role

Default43200
iam_role_nameoptionalstring

The name of the role. If omitted, Terraform will assign a random, unique name

Default""
iam_role_pathoptionalstring

The path to the role

Defaultnull
iam_role_permissions_boundaryoptionalstring

The ARN of the policy that is used to set the permissions boundary for the role

Defaultnull
iam_role_tagsoptionalmap(string)

A map of tags to apply to the IAM role

Default{}
idle_client_timeoutoptionalnumber

The number of seconds that a connection to the proxy can be inactive before the proxy disconnects it

Default1800
init_queryoptionalstring

One or more SQL statements for the proxy to run when opening each new database connection

Default""
kms_key_arnsoptionallist(string)

List of KMS Key ARNs to allow access to decrypt SecretsManager secrets

Default[]
log_group_classoptionalstring

Specified the log class of the log group. Possible values are: `STANDARD` or `INFREQUENT_ACCESS`

Defaultnull
log_group_kms_key_idoptionalstring

The ARN of the KMS Key to use when encrypting log data

Defaultnull
log_group_retention_in_daysoptionalnumber

Specifies the number of days you want to retain log events in the log group

Default30
log_group_tagsoptionalmap(string)

A map of tags to apply to the CloudWatch log group

Default{}
manage_log_groupoptionalbool

Determines whether Terraform will create/manage the CloudWatch log group or not. Note - this will fail if set to true after the log group has been created as the resource will already exist

Defaulttrue
max_connections_percentoptionalnumber

The maximum size of the connection pool for each target in a target group

Default90
max_idle_connections_percentoptionalnumber

Controls how actively the proxy closes idle database connections in the connection pool

Default50
nameoptionalstring

The identifier for the proxy. This name must be unique for all proxies owned by your AWS account in the specified AWS Region. An identifier must begin with a letter and must contain only ASCII letters, digits, and hyphens; it can't end with a hyphen or contain two consecutive hyphens

Default""
proxy_tagsoptionalmap(string)

A map of tags to apply to the RDS Proxy

Default{}
regionoptionalstring

Region where the resource(s) will be managed. Defaults to the Region set in the provider configuration

Defaultnull
require_tlsoptionalbool

A Boolean parameter that specifies whether Transport Layer Security (TLS) encryption is required for connections to the proxy

Defaulttrue
role_arnoptionalstring

The Amazon Resource Name (ARN) of the IAM role that the proxy uses to access secrets in AWS Secrets Manager

Default""
session_pinning_filtersoptionallist(string)

Each item in the list represents a class of SQL operations that normally cause all later statements in a session using a proxy to be pinned to the same underlying database connection

Default[]
tagsoptionalmap(string)

A map of tags to add to all resources

Default{}
target_connection_network_typeoptionalstring

Network type that the proxy uses to connect to the target database. Valid values are IPV4 and IPV6. Defaults to IPV4

Defaultnull
target_db_clusteroptionalbool

Determines whether DB cluster is targeted by proxy

Defaultfalse
target_db_instanceoptionalbool

Determines whether DB instance is targeted by proxy

Defaultfalse

All 44 are optional — the module deploys with none of them set. Showing 40, so the site stays a static download — the remaining 4 are in the source.

Outputs

19
db_proxy_endpoints

Array containing the full resource object and attributes for all DB proxy endpoints created

iam_role_arn

The Amazon Resource Name (ARN) of the IAM role that the proxy uses to access secrets in AWS Secrets Manager.

iam_role_name

IAM role name

iam_role_unique_id

Stable and unique string identifying the IAM role

log_group_arn

The Amazon Resource Name (ARN) of the CloudWatch log group

log_group_name

The name of the CloudWatch log group

proxy_arn

The Amazon Resource Name (ARN) for the proxy

proxy_default_target_group_arn

The Amazon Resource Name (ARN) for the default target group

proxy_default_target_group_id

The ID for the default target group

proxy_default_target_group_name

The name of the default target group

proxy_endpoint

The endpoint that you can use to connect to the proxy

proxy_id

The ID for the proxy

proxy_target_endpoint

Hostname for the target RDS DB Instance. Only returned for `RDS_INSTANCE` type

proxy_target_id

Identifier of `db_proxy_name`, `target_group_name`, target type (e.g. `RDS_INSTANCE` or `TRACKED_CLUSTER`), and resource identifier separated by forward slashes (/)

proxy_target_port

Port for the target RDS DB Instance or Aurora DB Cluster

proxy_target_rds_resource_id

Identifier representing the DB Instance or DB Cluster target

proxy_target_target_arn

Amazon Resource Name (ARN) for the DB instance or DB cluster. Currently not returned by the RDS API

proxy_target_tracked_cluster_id

DB Cluster identifier for the DB Instance target. Not returned unless manually importing an RDS_INSTANCE target that is part of a DB Cluster

proxy_target_type

Type of target. e.g. `RDS_INSTANCE` or `TRACKED_CLUSTER`

What the agent wires into the next module. An edge on the architecture diagram is one of these consumed by something else.