RDS Proxy
Terraform module to create AWS RDS Proxy resources
Inputs
40 / 44
authoptionalmap(object({ auth_scheme = optional(string) client_password_auth_type = optional…Configuration block(s) with authorization mechanisms to connect to the associated instances or clusters
{…}connection_borrow_timeoutoptionalnumberThe number of seconds for a proxy to wait for a connection to become available in the connection pool
nullcreateoptionalboolWhether cluster should be created (affects nearly all resources)
truecreate_iam_policyoptionalboolDetermines whether an IAM policy is created
truecreate_iam_roleoptionalboolDetermines whether an IAM role is created
truedb_cluster_identifieroptionalstringDB cluster identifier
""db_instance_identifieroptionalstringDB instance identifier
""debug_loggingoptionalboolWhether the proxy includes detailed information about SQL statements in its logs
falsedefault_auth_schemeoptionalstringDefault authentication scheme that the proxy uses for client connections to the proxy and connections from the proxy to the underlying database. Valid values are NONE and IAM_AUTH. Defaults to NONE
nullendpoint_network_typeoptionalstringNetwork type of the DB proxy endpoint. Valid values are IPV4, IPV6 and DUAL. Defaults to IPV4. If IPV6 is specified, the subnets associated with the proxy must be IPv6-only, and target_connection_network_type must be IPV6
nullendpointsoptionalmap(object({ name = optional(string) vpc_subnet_ids = list(string) vpc_security_…Map of DB proxy endpoints to create and their attributes
{}engine_familyoptionalstringThe kind of database engine that the proxy will connect to. Valid values are `MYSQL` or `POSTGRESQL`
""iam_policy_nameoptionalstringThe name of the role policy. If omitted, Terraform will assign a random, unique name
""iam_role_descriptionoptionalstringThe description of the role
""iam_role_force_detach_policiesoptionalboolSpecifies to force detaching any policies the role has before destroying it
trueiam_role_max_session_durationoptionalnumberThe maximum session duration (in seconds) that you want to set for the specified role
43200iam_role_nameoptionalstringThe name of the role. If omitted, Terraform will assign a random, unique name
""iam_role_pathoptionalstringThe path to the role
nulliam_role_permissions_boundaryoptionalstringThe ARN of the policy that is used to set the permissions boundary for the role
nulliam_role_tagsoptionalmap(string)A map of tags to apply to the IAM role
{}idle_client_timeoutoptionalnumberThe number of seconds that a connection to the proxy can be inactive before the proxy disconnects it
1800init_queryoptionalstringOne or more SQL statements for the proxy to run when opening each new database connection
""kms_key_arnsoptionallist(string)List of KMS Key ARNs to allow access to decrypt SecretsManager secrets
[]log_group_classoptionalstringSpecified the log class of the log group. Possible values are: `STANDARD` or `INFREQUENT_ACCESS`
nulllog_group_kms_key_idoptionalstringThe ARN of the KMS Key to use when encrypting log data
nulllog_group_retention_in_daysoptionalnumberSpecifies the number of days you want to retain log events in the log group
30log_group_tagsoptionalmap(string)A map of tags to apply to the CloudWatch log group
{}manage_log_groupoptionalboolDetermines whether Terraform will create/manage the CloudWatch log group or not. Note - this will fail if set to true after the log group has been created as the resource will already exist
truemax_connections_percentoptionalnumberThe maximum size of the connection pool for each target in a target group
90max_idle_connections_percentoptionalnumberControls how actively the proxy closes idle database connections in the connection pool
50nameoptionalstringThe identifier for the proxy. This name must be unique for all proxies owned by your AWS account in the specified AWS Region. An identifier must begin with a letter and must contain only ASCII letters, digits, and hyphens; it can't end with a hyphen or contain two consecutive hyphens
""proxy_tagsoptionalmap(string)A map of tags to apply to the RDS Proxy
{}regionoptionalstringRegion where the resource(s) will be managed. Defaults to the Region set in the provider configuration
nullrequire_tlsoptionalboolA Boolean parameter that specifies whether Transport Layer Security (TLS) encryption is required for connections to the proxy
truerole_arnoptionalstringThe Amazon Resource Name (ARN) of the IAM role that the proxy uses to access secrets in AWS Secrets Manager
""session_pinning_filtersoptionallist(string)Each item in the list represents a class of SQL operations that normally cause all later statements in a session using a proxy to be pinned to the same underlying database connection
[]tagsoptionalmap(string)A map of tags to add to all resources
{}target_connection_network_typeoptionalstringNetwork type that the proxy uses to connect to the target database. Valid values are IPV4 and IPV6. Defaults to IPV4
nulltarget_db_clusteroptionalboolDetermines whether DB cluster is targeted by proxy
falsetarget_db_instanceoptionalboolDetermines whether DB instance is targeted by proxy
falseAll 44 are optional — the module deploys with none of them set. Showing 40, so the site stays a static download — the remaining 4 are in the source.
Outputs
19
db_proxy_endpointsArray containing the full resource object and attributes for all DB proxy endpoints created
iam_role_arnThe Amazon Resource Name (ARN) of the IAM role that the proxy uses to access secrets in AWS Secrets Manager.
iam_role_nameIAM role name
iam_role_unique_idStable and unique string identifying the IAM role
log_group_arnThe Amazon Resource Name (ARN) of the CloudWatch log group
log_group_nameThe name of the CloudWatch log group
proxy_arnThe Amazon Resource Name (ARN) for the proxy
proxy_default_target_group_arnThe Amazon Resource Name (ARN) for the default target group
proxy_default_target_group_idThe ID for the default target group
proxy_default_target_group_nameThe name of the default target group
proxy_endpointThe endpoint that you can use to connect to the proxy
proxy_idThe ID for the proxy
proxy_target_endpointHostname for the target RDS DB Instance. Only returned for `RDS_INSTANCE` type
proxy_target_idIdentifier of `db_proxy_name`, `target_group_name`, target type (e.g. `RDS_INSTANCE` or `TRACKED_CLUSTER`), and resource identifier separated by forward slashes (/)
proxy_target_portPort for the target RDS DB Instance or Aurora DB Cluster
proxy_target_rds_resource_idIdentifier representing the DB Instance or DB Cluster target
proxy_target_target_arnAmazon Resource Name (ARN) for the DB instance or DB cluster. Currently not returned by the RDS API
proxy_target_tracked_cluster_idDB Cluster identifier for the DB Instance target. Not returned unless manually importing an RDS_INSTANCE target that is part of a DB Cluster
proxy_target_typeType of target. e.g. `RDS_INSTANCE` or `TRACKED_CLUSTER`
What the agent wires into the next module. An edge on the architecture diagram is one of these consumed by something else.