Set by controls 6

Active controls fix these values.

• cloudwatch_log_group_kms_key_idstring, set to nullThe ARN of the KMS Key to use when encrypting log data
• cloudwatch_log_group_retention_in_daysnumber, set to 365The number of days to retain CloudWatch logs for the DB instance
• enabled_cloudwatch_logs_exportslist(string), set to []Set of log types to export to cloudwatch. If omitted, no logs will be exported. The following log types are supported: audit, error, general, slowquery, postgresql
• iam_database_authentication_enabledbool, set to trueSpecifies whether or not mappings of AWS Identity and Access Management (IAM) accounts to database accounts is enabled
• kms_key_idstring, set to nullThe ARN for the KMS encryption key. When specifying kms_key_id, storage_encrypted needs to be set to true
• storage_encryptedbool, set to trueSpecifies whether the DB cluster is encrypted. The default is true

Optional 108

• allocated_storagenumber, default nullThe amount of storage in gibibytes (GiB) to allocate to each DB instance in the Multi-AZ DB cluster. (This setting is required to create a Multi-AZ DB cluster)
• allow_major_version_upgradebool, default falseEnable to allow major engine version upgrades when changing engine versions. Defaults to false
• apply_immediatelybool, default nullSpecifies whether any cluster modifications are applied immediately, or during the next maintenance window. Default is false
• auto_minor_version_upgradebool, default nullWhether to apply minor engine upgrades automatically to the DB cluster during the maintenance window. Defaults to true
• autoscaling_enabledbool, default falseDetermines whether autoscaling of the cluster read replicas is enabled
• autoscaling_max_capacitynumber, default 2Maximum number of read replicas permitted when autoscaling is enabled
• autoscaling_min_capacitynumber, default 0Minimum number of read replicas permitted when autoscaling is enabled
• autoscaling_policy_namestring, default "target-metric"Autoscaling policy name
• autoscaling_scale_in_cooldownnumber, default 300Cooldown in seconds before allowing further scaling operations after a scale in
• autoscaling_scale_out_cooldownnumber, default 300Cooldown in seconds before allowing further scaling operations after a scale out
• autoscaling_target_connectionsnumber, default 700Average number of connections threshold which will initiate autoscaling. Default value is 70% of db.r4/r5/r6g.large's default max_connections
• autoscaling_target_cpunumber, default 70CPU threshold which will initiate autoscaling
• availability_zoneslist(string), default nullList of EC2 Availability Zones for the DB cluster storage where DB cluster instances can be created. RDS automatically assigns 3 AZs if less than 3 AZs are configured, which will show as a difference requiring resource recreation next Terraform apply
• backtrack_windownumber, default nullThe target backtrack window, in seconds. Only available for aurora engine currently. To disable backtracking, set this value to 0. Must be between 0 and 259200 (72 hours)
• backup_retention_periodnumber, default nullThe days to retain backups for
• cloudwatch_log_group_classstring, default nullSpecified the log class of the log group. Possible values are: STANDARD or INFREQUENT_ACCESS
• cloudwatch_log_group_skip_destroybool, default nullSet to true if you do not wish the log group (and any logs it may contain) to be deleted at destroy time, and instead just remove the log group from the Terraform state
• cloudwatch_log_group_tagsmap(string), default {}Additional tags for the CloudWatch log group(s)
• cluster_activity_streamobject({...}), default nullMap of arguments for the created DB cluster activity stream
• cluster_ca_cert_identifierstring, default nullThe CA certificate identifier to use for the DB cluster's server certificate. Currently only supported for multi-az DB clusters
• cluster_db_instance_parameter_group_namestring, default nullInstance parameter group to associate with all instances of the DB cluster. The cluster_db_instance_parameter_group_name is only valid in combination with allow_major_version_upgrade
• cluster_instance_classstring, default nullThe compute and memory capacity of each DB instance in the Multi-AZ DB cluster (not all DB instance classes are available in all AWS Regions, or for all database engines)
• cluster_memberslist(string), default nullList of RDS Instances that are a part of this cluster
• cluster_monitoring_intervalnumber, default 0Interval, in seconds, between points when Enhanced Monitoring metrics are collected for the DB cluster. To turn off collecting Enhanced Monitoring metrics, specify 0. Valid Values: 0, 1, 5, 10, 15, 30, 60
• cluster_parameter_groupobject({...}), default nullMap of nested arguments for the created DB cluster parameter group
• cluster_parameter_group_namestring, default nullThe name of an existing DB cluster parameter group. Required when cluster_parameter_group is not provided (null)
• cluster_performance_insights_enabledbool, default nullEnables Performance Insights for the RDS Cluster
• cluster_performance_insights_kms_key_idstring, default nullSpecifies the KMS Key ID to encrypt Performance Insights data. If not specified, the default RDS KMS key will be used (aws/rds)
• cluster_performance_insights_retention_periodnumber, default nullSpecifies the amount of time to retain performance insights data for. Defaults to 7 days if Performance Insights are enabled. Valid values are 7, month * 31 (where month is a number of months from 1-23), and 731
• cluster_scalability_typestring, default nullSpecifies the scalability mode of the Aurora DB cluster. When set to limitless, the cluster operates as an Aurora Limitless Database. When set to standard (the default), the cluster uses normal DB instance creation. Valid values: limitless, standard
• cluster_tagsmap(string), default {}A map of tags to add to only the cluster. Used for AWS Instance Scheduler tagging
• cluster_timeoutsobject({...}), default nullCreate, update, and delete timeout configurations for the cluster
• cluster_use_name_prefixbool, default falseWhether to use name as a prefix for the cluster
• copy_tags_to_snapshotbool, default trueCopy all Cluster tags to snapshots
• createbool, default trueWhether cluster should be created (affects nearly all resources)
• create_cloudwatch_log_groupbool, default falseDetermines whether a CloudWatch log group is created for each enabled_cloudwatch_logs_exports
• create_db_subnet_groupbool, default falseDetermines whether to create the database subnet group or use existing
• create_monitoring_rolebool, default trueDetermines whether to create the IAM role for RDS enhanced monitoring
• create_security_groupbool, default trueDetermines whether to create security group for RDS cluster
• database_insights_modestring, default nullThe mode of Database Insights to enable for the DB cluster. Valid values: standard, advanced
• database_namestring, default nullName for an automatically created database on cluster creation
• db_parameter_groupobject({...}), default nullMap of nested arguments for the created DB parameter group
• db_subnet_group_namestring, default ""The name of the subnet group name (existing or created)
• delete_automated_backupsbool, default nullSpecifies whether to remove automated backups immediately after the DB cluster is deleted
• deletion_protectionbool, default nullIf the DB instance should have deletion protection enabled. The database can't be deleted when this value is set to true. The default is false
• domainstring, default nullThe ID of the Directory Service Active Directory domain to create the instance in
• domain_iam_role_namestring, default null(Required if domain is provided) The name of the IAM role to be used when making API calls to the Directory Service
• enable_global_write_forwardingbool, default nullWhether cluster should forward writes to an associated global cluster. Applied to secondary clusters to enable them to forward writes to an aws_rds_global_cluster's primary cluster
• enable_http_endpointbool, default nullEnable HTTP endpoint (data API). Only valid when engine_mode is set to serverless
• enable_local_write_forwardingbool, default nullWhether read replicas can forward write operations to the writer DB instance in the DB cluster. By default, write operations aren't allowed on reader DB instances
• endpointsmap({...}), default {}Map of additional cluster endpoints and their attributes to be created
• enginestring, default nullThe name of the database engine to be used for this DB cluster. Defaults to aurora. Valid Values: aurora, aurora-mysql, aurora-postgresql
• engine_lifecycle_supportstring, default nullThe life cycle type for this DB instance. This setting is valid for cluster types Aurora DB clusters and Multi-AZ DB clusters. Valid values are open-source-rds-extended-support, open-source-rds-extended-support-disabled. Default value is open-source-rds-extended-support
• engine_modestring, default "provisioned"The database engine mode. Valid values: global, multimaster, parallelquery, provisioned, serverless. Defaults to: provisioned
• engine_versionstring, default nullThe database engine version. Updating this argument results in an outage
• final_snapshot_identifierstring, default nullThe name of your final DB snapshot when this DB cluster is deleted. If omitted, no final snapshot will be made
• global_cluster_identifierstring, default nullThe global cluster identifier specified on aws_rds_global_cluster
• iam_role_descriptionstring, default nullDescription of the monitoring role
• iam_role_max_session_durationnumber, default nullMaximum session duration (in seconds) that you want to set for the monitoring role
• iam_role_namestring, default nullFriendly name of the monitoring role
• iam_role_pathstring, default nullPath for the monitoring role
• iam_role_permissions_boundarystring, default nullThe ARN of the policy that is used to set the permissions boundary for the monitoring role
• iam_role_use_name_prefixbool, default falseDetermines whether to use iam_role_name as is or create a unique name beginning with the iam_role_name as the prefix
• instance_timeoutsobject({...}), default nullCreate, update, and delete timeout configurations for the cluster instance(s)
• instancesmap({...}), default {}Map of cluster instances and any specific/overriding attributes to be created
• instances_use_identifier_prefixbool, default falseDetermines whether cluster instance identifiers are used as prefixes
• iopsnumber, default nullThe amount of Provisioned IOPS (input/output operations per second) to be initially allocated for each DB instance in the Multi-AZ DB cluster
• is_primary_clusterbool, default trueDetermines whether cluster is primary cluster with writer instance (set to false for global cluster and replica clusters)
• manage_master_user_passwordbool, default trueSet to true to allow RDS to manage the master user password in Secrets Manager. Cannot be set if master_password_wo is provided
• manage_master_user_password_rotationbool, default falseWhether to manage the master user password rotation. By default, false on creation, rotation is managed by RDS. There is not currently a way to disable this on initial creation even when set to false. Setting this value to false after previously having been set to true will disable automatic rotation
• master_password_wostring, default nullWrite-Only required unless manage_master_user_password is set to true, a snapshot_identifier, replication_source_identifier, or unless a global_cluster_identifier is provided when the cluster is the "secondary" cluster of a global database) Password for the master DB user
• master_password_wo_versionnumber, default nullUsed together with master_password_wo to trigger an update. Increment this value when an update to the master_password_wo is required
• master_user_password_rotate_immediatelybool, default nullSpecifies whether to rotate the secret immediately or wait until the next scheduled rotation window
• master_user_password_rotation_automatically_after_daysnumber, default nullSpecifies the number of days between automatic scheduled rotations of the secret. Either master_user_password_rotation_automatically_after_days or master_user_password_rotation_schedule_expression must be specified
• master_user_password_rotation_durationstring, default nullThe length of the rotation window in hours. For example, 3h for a three hour window
• master_user_password_rotation_schedule_expressionstring, default nullA cron() or rate() expression that defines the schedule for rotating your secret. Either master_user_password_rotation_automatically_after_days or master_user_password_rotation_schedule_expression must be specified
• master_user_secret_kms_key_idstring, default nullThe Amazon Web Services KMS key identifier is the key ARN, key ID, alias ARN, or alias name for the KMS key
• master_usernamestring, default nullUsername for the master DB user. Required unless snapshot_identifier or replication_source_identifier is provided or unless a global_cluster_identifier is provided when the cluster is the secondary cluster of a global database
• monitoring_role_arnstring, default ""IAM role used by RDS to send enhanced monitoring metrics to CloudWatch
• namestring, default ""Name used across resources created
• network_typestring, default nullThe type of network stack to use (IPV4 or DUAL)
• portstring, default nullThe port on which the DB accepts connections
• predefined_metric_typestring, default "RDSReaderAverageCPUUtilization"The metric type to scale on. Valid values are RDSReaderAverageCPUUtilization and RDSReaderAverageDatabaseConnections
• preferred_backup_windowstring, default nullDaily time range during which automated backups are created if automated backups are enabled using the BackupRetentionPeriod parameter.Time in UTC. Default: A 30-minute window selected at random from an 8-hour block of time per region, e.g. 04:00-09:00
• preferred_maintenance_windowstring, default nullWeekly time range during which system maintenance can occur, in (UTC) e.g., wed:04:00-wed:04:30
• putin_khuylobool, default trueDo you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo!
• regionstring, default nullRegion where the resource(s) will be managed. Defaults to the Region set in the provider configuration
• replication_source_identifierstring, default nullARN of a source DB cluster or DB instance if this DB cluster is to be created as a Read Replica
• restore_to_point_in_timeobject({...}), default nullMap of nested attributes for cloning Aurora cluster
• role_associationsmap({...}), default {}Map of IAM roles and supported feature names to associate with the cluster
• s3_importobject({...}), default nullConfiguration map used to restore from a Percona Xtrabackup in S3 (only MySQL is supported)
• scaling_configurationobject({...}), default nullMap of nested attributes with scaling properties. Only valid when engine_mode is set to serverless
• security_group_descriptionstring, default nullThe description of the security group. If value is set to empty string it will contain cluster name in the description
• security_group_egress_rulesmap({...}), default {}Map of security group egress rules to add to the security group created
• security_group_ingress_rulesmap({...}), default {}Map of security group ingress rules to add to the security group created
• security_group_namestring, default ""The security group name. Default value is (var.name)
• security_group_tagsmap(string), default {}Additional tags for the security group
• security_group_use_name_prefixbool, default trueDetermines whether the security group name (var.name) is used as a prefix
• serverlessv2_scaling_configurationobject({...}), default nullMap of nested attributes with serverless v2 scaling properties. Only valid when engine_mode is set to provisioned
• shard_groupobject({...}), default nullArguments for the DB shard group to be created
• skip_final_snapshotbool, default falseDetermines whether a final snapshot is created before the cluster is deleted. If true is specified, no snapshot is created
• snapshot_identifierstring, default nullSpecifies whether or not to create this cluster from a snapshot. You can use either the name or ARN when specifying a DB cluster snapshot, or the ARN when specifying a DB snapshot
• source_regionstring, default nullThe source region for an encrypted replica DB cluster
• storage_typestring, default nullDetermines the storage type for the DB cluster. Optional for Single-AZ, required for Multi-AZ DB clusters. Valid values for Single-AZ: aurora, "" (default, both refer to Aurora Standard), aurora-iopt1 (Aurora I/O Optimized). Valid values for Multi-AZ: io1 (default)
• subnetslist(string), default []List of subnet IDs used by database subnet group created
• tagsmap(string), default {}A map of tags to add to all resources
• vpc_idstring, default ""ID of the VPC where to create security group
• vpc_security_group_idslist(string), default []List of VPC security groups to associate to the cluster in addition to the security group created