RDS Database - Ravion Docs

Type: rvn-rds · Latest version: 1.2.0

Dependencies and consumers

Every dependency input can be specified manually to reference existing external infrastructure rather than a Ravion module.

Readme

Creates and manages an Amazon RDS database. Supports PostgreSQL, MySQL, MariaDB, Oracle, and SQL Server engines.

Overview

Use this module when an application needs a managed relational database in AWS. It provisions an RDS instance with subnet placement, security group access, backups, monitoring, optional read replicas, and CloudWatch alarms. The module supports PostgreSQL, MySQL, MariaDB, Oracle, and SQL Server engines. Aurora uses a different AWS resource model and is not configured by this module.

Use cases

Scenario	Benefit
Application database	Create a private RDS instance attached to an existing Ravion VPC network.
Production database	Enable Multi-AZ, deletion protection, automated backups, performance insights, and CloudWatch alarms.
Read-heavy workload	Add read replicas for supported engines.
Sensitive data	Keep public access disabled, use encryption, manage credentials in Secrets Manager, and restrict ingress.

Networking

Select a VPC network first. Ravion maps the network’s AWS account, region, VPC ID, and private subnet IDs into this module. The database subnet group uses the selected private subnets by default. Public access is disabled by default. Keep it disabled for normal application databases and allow access through security group IDs from application services or controlled CIDR blocks.

Database engine and sizing

Choose the engine, optional engine major version, optional engine minor version, instance class, and allocated storage. If engine major version is blank, AWS selects the latest available version for that engine. Storage type defaults to gp3. Max allocated storage controls RDS storage autoscaling; keep it at 0 to disable autoscaling. AWS supports increasing allocated storage after creation, but not reducing it in place.

Credentials and security

Manage password in Secrets Manager is enabled by default, so AWS creates and stores the master password for the database. Before importing a database whose existing password is managed outside Secrets Manager, disable password management and enable Preserve existing master password. Leaving password management enabled causes AWS to generate a new master password. Preservation verifies that the named database already exists in AWS, preventing a new database from reaching AWS without any source of master credentials. Storage encryption is enabled by default. Provide a storage KMS key ARN when you need a customer-managed key for storage. IAM database authentication is shown only for MySQL and PostgreSQL.

Availability, backups, and maintenance

Multi-AZ creates a standby in another availability zone for failover. The single availability zone field is hidden when Multi-AZ is enabled. Read replicas are shown only for engines that support RDS read replicas and are hidden for SQL Server. Automated backups default to 7 days. You can set the backup window and control final snapshot behavior. Deletion protection is enabled by default. Automatic minor engine version upgrades are configured next to the engine version fields and, when enabled, happen during the configured maintenance window. Major version upgrades and immediate changes are opt-in.

Observability

Performance insights is enabled by default with 7 days of retention. Enhanced monitoring can be enabled by setting a monitoring interval. CloudWatch alarms are optional. When enabled, the module can alarm on CPU utilization, free storage space, and database connections. The free storage alarm threshold is entered in GiB in Ravion and converted to bytes for Terraform. The Ravion UI also shows RDS CloudWatch metrics for CPU, free storage, connections, read IOPS, and write IOPS.

Connection pooling

Enable RDS Proxy to place a managed connection pool in front of the database. The proxy authenticates with the Secrets Manager master user secret by default, requires TLS, and allows the same security group and CIDR sources configured for the database. Pool sizing, idle timeouts, session pinning, IAM authentication, and custom auth secrets are configurable in the Connection pooling section. RDS Proxy is not available for Oracle engines. Creating the proxy does not change how applications reach the database. Update your application connection string to the proxy endpoint output to route traffic through the pool.

Configuration

Field	Required	Default	Notes
VPC network	Yes	None	Supplies AWS account, region, VPC ID, and private subnet IDs.
Name slug	Yes	Project and environment given IDs	Prefix for RDS resources.
Engine	Yes	postgres	PostgreSQL, MySQL, MariaDB, Oracle, and SQL Server variants are supported.
Engine major version	Yes	None	Sets the RDS major engine version, such as 15 for PostgreSQL or 8.0 for MySQL.
Engine minor version	No	Blank	Appended to the major version when an exact version is required.
Auto minor version upgrades	No	true	Applies minor engine upgrades during the configured maintenance window.
Instance class	Yes	db.t4g.micro	Use a larger RDS class such as db.r6g.large for production workloads.
Allocated storage	Yes	20	Storage in GiB.
Master username	Yes	dbadmin	Master database user. Do not use reserved engine words such as admin.
Storage KMS key ARN	No	Blank	Uses a customer-managed KMS key for storage encryption.
Initial database name	No	Blank	Creates an initial database when supported by the engine. Reserved RDS engine words such as database are blocked.
Publicly accessible	No	false	Leave disabled unless public database access is intentional.
Security group creation	No	true	Creates ingress rules from allowed security groups and CIDRs.
Multi-AZ	No	false	Enables high availability standby.
Read replicas	No	false	Creates read replicas when supported by the engine.
Manage password in Secrets Manager	No	true	Stores generated master credentials in AWS Secrets Manager. Disable before importing an externally managed password.
Preserve existing master password	No	false	Verifies the database exists in AWS and leaves its externally managed password unchanged.
Backup retention days	No	7	Set to 0 to disable automated backups.
Deletion protection	No	true	Helps prevent accidental deletion.
Performance insights	No	true	Enables AWS Performance Insights.
CloudWatch alarms	No	true	Adds CPU, free storage, and connection alarms.
Free storage alarm threshold	No	5 GiB	Converted to bytes before Terraform runs.
RDS Proxy	No	false	Creates an RDS Proxy connection pool in front of the database. Not available for Oracle engines.
Tags	No	Blank	Merged with Ravion standard tags.

Advanced configuration

Use parameter group settings for engine parameters. Oracle settings and SQL Server settings are shown in separate engine-specific sections. Option group settings are shown only for Oracle and SQL Server engines; blue/green updates are shown only for MySQL and MariaDB. Use advanced Terraform variables for one-off overrides not represented directly in the UI. Values in advanced Terraform variables override generated variables. Terraform settings let you override the OpenTofu version, Terraform execution environment inherited from the VPC network, and Ravion state backend workspace name.

Design decisions

RDS instances are placed in private subnets by default through the VPC network reference. Secrets Manager password management, encryption at rest, performance insights, and deletion protection default on because they are safer defaults for long-lived databases. The module keeps primary database choices visible and tucks optional engine, engine-specific, storage, backup, monitoring, maintenance, parameter group, and option group details behind collapsible controls. Source repository and stack plumbing remain managed by Ravion.

Learn more

Inputs reference

All inputs for rvn-rds version 1.2.0. Use the name shown for each field as the input key in module config.

$ref:rvn-aws-network

required

VPC network.

Immutable after creation

Database

string

required

Name slug. Name prefix for all RDS resources.

Default: <<project.given_id>>-<<environment.given_id>>
Immutable after creation
Pattern: ^[a-z0-9]([a-z0-9-]{0,38}[a-z0-9])?$ — 1-40 lowercase letters, numbers, and hyphens. Start and end with a letter or number.

string

required

Create or restore.

Default: none
Allowed values: none (New empty database), snapshot (Restore from snapshot), point_in_time (Point-in-time restore)
Immutable after creation

string

required

Database name.

Immutable after creation
Pattern: ^[a-z][a-z0-9_]{0,63}$ — 1-64 lowercase letters, numbers, and underscores. Start with a letter.
Pattern: ^(?:|[^adimnoprst].*|a(?:|[^d].*|d(?:|[^m].*|m(?:|[^i].*|i(?:|[^n].*|n.+))))|d(?:|[^a].*|a(?:|[^t].*|t(?:|[^a].*|a(?:|[^b].*|b(?:|[^a].*|a(?:|[^s].*|s(?:|[^e].*|e(?:[^s].*|s.+))))))))|i(?:|[^n].*|n(?:|[^f].*|f(?:|[^o].*|o(?:|[^r].*|r(?:|[^m].*|m(?:|[^a].*|a(?:|[^t].*|t(?:|[^i].*|i(?:|[^o].*|o(?:|[^n].*|n(?:|[^_].*|_(?:|[^s].*|s(?:|[^c].*|c(?:|[^h].*|h(?:|[^e].*|e(?:|[^m].*|m(?:|[^a].*|a.+)))))))))))))))))|m(?:|[^y].*|y(?:|[^s].*|s(?:|[^q].*|q(?:|[^l].*|l.+))))|n(?:|[^u].*|u(?:|[^l].*|l(?:|[^l].*|l.+)))|o(?:|[^r].*|r(?:|[^a].*|a(?:|[^c].*|c(?:|[^l].*|l(?:|[^e].*|e.+)))))|p(?:|[^eo].*|e(?:|[^r].*|r(?:|[^f].*|f(?:|[^o].*|o(?:|[^r].*|r(?:|[^m].*|m(?:|[^a].*|a(?:|[^n].*|n(?:|[^c].*|c(?:|[^e].*|e(?:|[^_].*|_(?:|[^s].*|s(?:|[^c].*|c(?:|[^h].*|h(?:|[^e].*|e(?:|[^m].*|m(?:|[^a].*|a.+))))))))))))))))|o(?:|[^s].*|s(?:|[^t].*|t(?:|[^g].*|g(?:|[^r].*|r(?:|[^e].*|e(?:|[^s].*|s.+)))))))|r(?:|[^do].*|d(?:|[^s].*|s(?:|[^a].*|a(?:|[^d].*|d(?:|[^m].*|m(?:|[^i].*|i(?:|[^n].*|n.+))))))|o(?:|[^o].*|o(?:|[^t].*|t.+)))|s(?:|[^y].*|y(?:|[^s].*|s.+))|t(?:|[^e].*|e(?:|[^m].*|m(?:|[^p].*|p(?:|[^l].*|l(?:|[^a].*|a(?:|[^t].*|t(?:|[^e].*|e(?:|[^01].*|0.+|1.+)))))))))$ — Pick a different name, this is reserved by AWS.
Shown when: {"engine":["mysql","postgres","mariadb","oracle-ee","oracle-se2","oracle-se2-cdb"],"restore_mode":"none"}

string

required

Username.

Default: dbadmin
Immutable after creation
Pattern: ^[A-Za-z][A-Za-z0-9_]{0,62}$ — Invalid RDS master username. Start with a letter. Letters, numbers, and underscores only.
Shown when: {"restore_mode":"none"}

string

Snapshot to restore. Snapshot identifier or ARN to restore into this new database. The snapshot must be compatible with the selected engine and instance settings.

Immutable after creation
Shown when: {"restore_mode":"snapshot"}

boolean

Use latest restorable time. Restore to the latest time AWS can recover from the selected source database backup.

Default: true
Immutable after creation
Shown when: {"restore_mode":"point_in_time"}

string

Restore time. Restore to this UTC timestamp instead of the latest restorable time.

Immutable after creation
Shown when: {"point_in_time_use_latest_restorable_time":false,"restore_mode":"point_in_time"}

string

Source DB instance identifier. Source DB instance identifier to restore from.

Immutable after creation
Shown when: {"restore_mode":"point_in_time"}

string

Source automated backups ARN. ARN of the source automated backups to restore from. Use this for cross-region or retained automated backup restores.

Immutable after creation
Shown when: {"restore_mode":"point_in_time"}

string

Source DB resource ID. Source DB resource ID to restore from when using automated backups.

Immutable after creation
Shown when: {"restore_mode":"point_in_time"}

Version

string

required

Engine.

Default: postgres
Allowed values: postgres (PostgreSQL), mysql (MySQL), mariadb (MariaDB), oracle-ee (Oracle Enterprise Edition), oracle-se2 (Oracle Standard Edition 2), oracle-se2-cdb (Oracle Standard Edition 2 CDB), sqlserver-ee (SQL Server Enterprise), sqlserver-se (SQL Server Standard), sqlserver-ex (SQL Server Express), sqlserver-web (SQL Server Web)
Immutable after creation

string

required

Engine major version. Examples: 15 for PostgreSQL or SQL Server, 8.0 for MySQL, 19 for Oracle.

Immutable after creation

string

Engine minor version. Optional minor engine version appended to the major version. Example: major 15 and minor 4 becomes 15.4.

boolean

Auto minor version upgrades. Enable automatic minor engine version upgrades during the configured maintenance window.

Default: true

Size & Storage

string

required

Instance class. RDS instance size, such as db.t4g.micro or db.r6g.large.

Default: db.t4g.micro

number

required

Allocated storage (GiB). AWS supports increasing allocated storage after creation, but not reducing it in place.

Default: 20
Min: 20
Max: 65536

number

Max allocated storage (GiB). Upper limit for RDS storage autoscaling. Use 0 to disable. AWS can grow storage up to this limit, but storage cannot be reduced in place.

Default: 0
Min: 0
Max: 65536

string

Storage type.

Default: gp3
Allowed values: gp3, gp2, io1, io2, standard

number

Provisioned IOPS.

Min: 1000
Max: 256000
Shown when: {"storage_type":["gp3","io1","io2"]}

number

Storage throughput (MiB/s).

Min: 125
Max: 1000
Shown when: {"storage_type":"gp3"}

string

Storage KMS key ARN.

Immutable after creation

string

CA certificate identifier.

Network access

boolean

Publicly accessible. Keep disabled for production databases unless public access is intentional.

Default: false

number

Port. Leave blank to use the engine default port.

Min: 1
Max: 65535

boolean

Security group creation.

Default: true
Immutable after creation

string

Existing security group ID.

Shown when: {"security_group_creation_enabled":false}

string_array

Allowed security groups.

Shown when: {"security_group_creation_enabled":true}

string_array

Allowed CIDR blocks.

Shown when: {"security_group_creation_enabled":true}

Connection pooling

boolean

RDS Proxy. Create an RDS Proxy in front of the database for connection pooling and improved failover handling. Applications keep connecting to the database endpoint until you update their connection string to the proxy endpoint output.

Default: false
Shown when: {"engine":["mysql","postgres","mariadb","sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"]}

string_array

Auth secret ARNs. Secrets Manager secrets containing database credentials for the proxy. Leave blank to use the managed master user secret.

Shown when: {"proxy_creation_enabled":true}

string_array

Auth secret KMS key ARNs. KMS keys used to encrypt the auth secrets when using customer-managed keys. The master user secret KMS key is included automatically.

Shown when: {"proxy_creation_enabled":true}

boolean

IAM authentication. Require IAM authentication for client connections to the proxy.

Default: false
Shown when: {"proxy_creation_enabled":true}

boolean

Require TLS. Require TLS for client connections to the proxy.

Default: true
Shown when: {"proxy_creation_enabled":true}

boolean

Debug logging. Log detailed connection information, including SQL statements, to CloudWatch Logs.

Default: false
Shown when: {"proxy_creation_enabled":true}

number

Idle client timeout (seconds).

Default: 1800
Min: 1
Max: 28800
Shown when: {"proxy_creation_enabled":true}

number

Connection borrow timeout (seconds).

Default: 120
Min: 0
Shown when: {"proxy_creation_enabled":true}

number

Max connections (%). Maximum size of the connection pool as a percentage of the database max_connections setting.

Default: 100
Min: 1
Max: 100
Shown when: {"proxy_creation_enabled":true}

number

Max idle connections (%). Maximum idle connections kept open, as a percentage of the database max_connections setting.

Default: 50
Min: 0
Max: 100
Shown when: {"proxy_creation_enabled":true}

string_array

Session pinning filters.

Allowed values: EXCLUDE_VARIABLE_SETS
Shown when: {"proxy_creation_enabled":true}

string

Initialization query. SQL statements the proxy runs when opening each new database connection.

Shown when: {"proxy_creation_enabled":true}

Availability & replicas

boolean

Multi-AZ.

Default: false

string

Availability zone. Single-AZ placement. Hidden when Multi-AZ is enabled because AWS chooses standby placement.

Shown when: {"multi_az_enabled":false}

boolean

Read replicas.

Default: false
Shown when: {"engine":["mysql","postgres","mariadb","oracle-ee","oracle-se2","oracle-se2-cdb"]}

number

Read replica count.

Default: 1
Min: 0
Max: 15
Shown when: {"engine":["mysql","postgres","mariadb","oracle-ee","oracle-se2","oracle-se2-cdb"],"read_replica_creation_enabled":true}

string

Read replica instance class.

Shown when: {"engine":["mysql","postgres","mariadb","oracle-ee","oracle-se2","oracle-se2-cdb"],"read_replica_creation_enabled":true}

string_array

Read replica AZs.

Shown when: {"engine":["mysql","postgres","mariadb","oracle-ee","oracle-se2","oracle-se2-cdb"],"read_replica_creation_enabled":true}

Credentials & authentication

boolean

Manage password in Secrets Manager. Let AWS generate and manage the master password in Secrets Manager. Disable before importing a database whose existing password is managed externally.

Default: true

boolean

Preserve existing master password. Preserve the externally managed password of an imported database. Ravion verifies that the named database already exists in AWS.

Default: false
Shown when: {"master_user_password_management_enabled":false}

string

Secrets Manager KMS key ARN.

Shown when: {"master_user_password_management_enabled":true,"restore_mode":"none"}

boolean

IAM database authentication.

Default: false
Shown when: {"engine":["mysql","postgres"]}

SQL Server settings

string

License model.

Allowed values: license-included, bring-your-own-license
Immutable after creation
Shown when: {"engine":["sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"]}

string

Character set.

Immutable after creation
Shown when: {"engine":["sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"]}

string

SQL Server time zone.

Immutable after creation
Shown when: {"engine":["sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"]}

string

Active Directory directory ID.

Immutable after creation
Shown when: {"engine":["sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"]}

string

Active Directory IAM role name.

Immutable after creation
Shown when: {"domain":{"not":""},"engine":["sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"]}

Oracle settings

string

License model.

Allowed values: license-included, bring-your-own-license
Immutable after creation
Shown when: {"engine":["oracle-ee","oracle-se2","oracle-se2-cdb"]}

string

Character set.

Immutable after creation
Shown when: {"engine":["oracle-ee","oracle-se2","oracle-se2-cdb"]}

Backups

number

Backup retention days.

Default: 7
Min: 0
Max: 35

string

Backup window.

Shown when: {"backup_retention_period":{"not":0}}

boolean

Copy tags to snapshots.

Default: true

boolean

Delete automated backups. Delete retained automated backups when the database is deleted. Disable this to preserve automated backups after deletion.

Default: true
Shown when: {"backup_retention_period":{"not":0}}

boolean

Create final snapshot.

Default: true

string

Final snapshot identifier.

Shown when: {"final_snapshot_creation_enabled":true}

boolean

Deletion protection.

Default: true

Maintenance

string

Maintenance window.

boolean

Allow major version upgrades.

Default: false

boolean

Apply changes immediately.

Default: false

Monitoring

string_array

CloudWatch log exports.

number

Enhanced monitoring interval.

Default: 0
Allowed values: 0 (0), 1 (1), 5 (5), 10 (10), 15 (15), 30 (30), 60 (60)

boolean

Monitoring IAM role creation.

Default: true
Immutable after creation
Shown when: {"monitoring_interval":{"not":0}}

string

Monitoring IAM role ARN.

Shown when: {"monitoring_interval":{"not":0},"monitoring_role_creation_enabled":false}

boolean

Performance insights.

Default: true

number

Performance insights retention days.

Default: 7
Shown when: {"performance_insights_enabled":true}

string

Performance insights KMS key ARN.

Shown when: {"performance_insights_enabled":true}

CloudWatch alarms

boolean

Create CloudWatch alarms.

Default: true

number

CPU alarm threshold (%).

Default: 80
Min: 0
Max: 100
Shown when: {"cloudwatch_alarms_creation_enabled":true}

number

Free storage alarm threshold (GiB). Displayed in GiB. Ravion converts this to bytes for Terraform.

Default: 5
Min: 0
Shown when: {"cloudwatch_alarms_creation_enabled":true}

number

Connections alarm threshold.

Default: 100
Min: 1
Shown when: {"cloudwatch_alarms_creation_enabled":true}

number

Alarm evaluation periods.

Default: 2
Min: 1
Shown when: {"cloudwatch_alarms_creation_enabled":true}

number

Alarm period seconds.

Default: 300
Allowed values: 10 (10), 30 (30), 60 (60), 300 (300), 900 (900), 3600 (3600)
Shown when: {"cloudwatch_alarms_creation_enabled":true}

string_array

Alarm action ARNs.

Shown when: {"cloudwatch_alarms_creation_enabled":true}

string_array

OK action ARNs.

Shown when: {"cloudwatch_alarms_creation_enabled":true}

Parameter group

boolean

Parameter group creation. Create a parameter group for this database. Disable this only when you want to attach an existing parameter group.

Default: true
Immutable after creation

string

Existing parameter group name. Name of an existing parameter group to attach when this module is not creating one.

Immutable after creation
Shown when: {"parameter_group_creation_enabled":false}

string

Parameter group family. Parameter group family, such as postgres15 or mysql8.0. Leave blank to derive it from the selected engine and major version.

Immutable after creation
Shown when: {"parameter_group_creation_enabled":true}

object_array

Parameters. Custom database engine parameters to apply to the created parameter group. Many changes require a database reboot depending on the parameter.

Default: []
Shown when: {"parameter_group_creation_enabled":true}

Show item fields

string

required

Name. Engine parameter name, such as log_statement or max_connections.

string

required

Value. Parameter value to set.

string

Apply method. Apply immediately when supported, or wait until the next database reboot.

Default: immediate
Allowed values: immediate, pending-reboot

Option group

boolean

Option group creation.

Default: false
Immutable after creation
Shown when: {"engine":["oracle-ee","oracle-se2","oracle-se2-cdb","sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"]}

string

Existing option group name.

Immutable after creation
Shown when: {"engine":["oracle-ee","oracle-se2","oracle-se2-cdb","sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"],"option_group_creation_enabled":false}

string

Option group engine version.

Immutable after creation
Shown when: {"engine":["oracle-ee","oracle-se2","oracle-se2-cdb","sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"],"option_group_creation_enabled":true}

array

Options.

Default: []
Shown when: {"engine":["oracle-ee","oracle-se2","oracle-se2-cdb","sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"],"option_group_creation_enabled":true}

Blue/green deployments

boolean

Blue/green updates.

Default: false
Shown when: {"engine":["mysql","mariadb"]}

Misc

keyvalue

Tags. A map of tags to assign to all resources. Default tags are Owner, ProjectGivenId, EnvironmentGivenId, ModuleGivenId, ModuleId

Terraform settings

string

OpenTofu version override. Override the environment’s default version for this module

string

Ravion Terraform workspace name. Override Terraform state backend workspace name. Defaults to project + environment + module given ids.

Immutable after creation

object

Advanced Terraform variables. Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.

Default: {}

​Dependencies and consumers

​Readme

​Overview

​Use cases

​Networking

​Database engine and sizing

​Credentials and security

​Availability, backups, and maintenance

​Observability

​Connection pooling

​Configuration

​Advanced configuration

​Design decisions

​Learn more

​Inputs reference

​Database

​Version

​Size & Storage

​Network access

​Connection pooling

​Availability & replicas

​Credentials & authentication

​SQL Server settings

​Oracle settings

​Backups

​Maintenance

​Monitoring

​CloudWatch alarms

​Parameter group

​Option group

​Blue/green deployments

​Misc

​Terraform settings

Dependencies and consumers

Readme

Overview

Use cases

Networking

Database engine and sizing

Credentials and security

Availability, backups, and maintenance

Observability

Connection pooling

Configuration

Advanced configuration

Design decisions

Learn more

Inputs reference

Database

Version

Size & Storage

Network access

Connection pooling

Availability & replicas

Credentials & authentication

SQL Server settings

Oracle settings

Backups

Maintenance

Monitoring

CloudWatch alarms

Parameter group

Option group

Blue/green deployments

Misc

Terraform settings