terraform-aws-modules / terraform-aws-rds-aurora Goto Github PK

Introduced in v2.10.0 by #80

"aws_security_group" "this" is being recreated due to description change.

# module.aurora.aws_security_group.this[0] must be replaced
-/+ resource "aws_security_group" "this" {
      ~ arn                    = "arn:aws:ec2:us-east-1:xxx:security-group/sg-xxx" -> (known after apply)
      ~ description            = "Managed by Terraform" -> "Control traffic to/from RDS Aurora xxx" # forces replacement
      ~ egress                 = [
          - {
              - cidr_blocks      = []
              - description      = ""
              - from_port        = 5432
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"

Error:

module.aurora.aws_security_group.this[0]: Still destroying... [id=sg-xxx, 9m20s elapsed]
module.aurora.aws_security_group.this[0]: Still destroying... [id=sg-xxx, 9m30s elapsed]
module.aurora.aws_security_group.this[0]: Still destroying... [id=sg-xxx, 9m40s elapsed]
module.aurora.aws_security_group.this[0]: Still destroying... [id=sg-xxx, 9m50s elapsed]
module.aurora.aws_security_group.this[0]: Still destroying... [id=sg-xxx, 10m0s elapsed]

Error: Error deleting security group: DependencyViolation: resource sg-xxx has a dependent object
	status code: 400, request id: 2e5e5ee3-0a88-459d-a5d6-177979d94bcd

Currently, the project is returning the resource id, wouldn't it make more sense if it returned the ARN directly? The use case is the same for creating policies but look like returning the ARN is more straight forward.

Terraform version 0.12.24

I am trying to create aurora mysql serverless rds with below configuration, running into error invalid parameter value when I use aurora-mysql. it works fine if i use engine as aurora. plan does not give me any error.

provider "aws" {
region = "us-east-1"
}
resource "aws_rds_cluster" "serverless" {
cluster_identifier = "serverless-dev"
engine = "aurora-mysql"
engine_mode = "serverless"
master_username = "dba_admin"
master_password = "changemepass"
skip_final_snapshot = true
db_subnet_group_name = "serverless-vpc"
}

Error: error creating RDS cluster: InvalidParameterValue: The engine mode serverless you requested is currently unavailable.
status code: 400, request id: 2294c942-fec5-4f45-a9e0-7520e33b73b8

Hi,

I'm not able to use your module in terraform. This is the first time this happens to me with a terraform module.

Here is the result of a terraform get command :

Initializing modules...

module.security_group-db
Found version 2.7.0 of terraform-aws-modules/security-group/aws on registry.terraform.io
Getting source "terraform-aws-modules/security-group/aws"
module.aurora
Found version 0.0.1 of terraform-aws-modules/rds-aurora/aws on registry.terraform.io
Getting source "terraform-aws-modules/rds-aurora/aws"
Error downloading modules: Error loading modules: module aurora: No Terraform configuration files found in directory: .terraform/modules/3a6b6096207200690f118584dd370e00/terraform-aws-modules-terraform-aws-rds-aurora-7db32bb

When I go in the temporary folder, there is only a README file :

# terraform-aws-rds-aurora
Terraform module which creates RDS Aurora resources on AWS

WORK IN PROGRESS

Can you help me ?
Thanks

When setting up a cluster resource like so...

module "database" {
    source = "../modules/terraform-aws-modules/rds-aurora/aws"
    [...]
    allowed_security_groups = ["${module.asg_resources.asg_security_group_id}"]
    [...]
}

I get this well-known terraform error:
* module.database.aws_security_group_rule.default_ingress: aws_security_group_rule.default_ingress: value of 'count' cannot be computed

This is despite the fact that module.asg_resources.asg_security_group_id is a string and not a list.

Hi,
I am creating a aws aurora cluster and adding to it 2 instances. At first terraform apply, i have kept performance insights enabled parameter as false and the cluster is successfully created. After this I am changing the performance insights enabled parameter to true and re applying terraform. At this point, terraform is destroying my instances and recreating them which is not the expected behavior. Can you please help me on this issue, maybe I am missing something.

I want to make RDS Aurora Cluster with 1 read replica,
is it possible to set the replica with different size using this module?

Hi,

Is there a way to enable the Data API for a Aurora Serverless? Enabling it manually is not too much work, but it would be great if it could be done through code.

Thanks!

target_tracking_scaling_policy_configuration is hardcoded to use RDSReaderAverageCPUUtilization for metric type.

target_tracking_scaling_policy_configuration {
    predefined_metric_specification {
      predefined_metric_type = "RDSReaderAverageCPUUtilization"
    }

It would be good to make it configurable.
I have created PR to enable such configuration: #66

Hello,

Thanks for the great module. However with the avaibility zones variables being set, terraform wants to recreate the cluster on every apply as you can see on this issue (hashicorp/terraform#16724).

I guess a workaround would be to drop the availability_zones variables in the cluster.

Tx !

Hello everyone,

I'd like to know how I can use the "allowed_security_groups" with outputs from other modules.
Currently, when I do this :
allowed_security_groups = ["${module.bastion_access.bastion_security_group_id}"]
I have the famous : aws_security_group_rule.default_ingress: value of 'count' cannot be computed

Thanks for your help !

Module not compatible yet with Terraform v 0.12, creating PR.

I was trying to create a serverless Aurora database using the rds-aurora aurora module. I noticed that on main.tf line 82, an aws_rds_cluster_instance would be created, even if we choose a serverless engine_mode. This is of course unsupported because we cannot associate an instance with serverless.
This throws the error

Error: error creating RDS DB Instance: InvalidParameterValue: Instances cannot be added to Aurora Serverless clusters.
        status code: 400, request id: ...

My workaround was to download the Terraform script and comment out the part that creates the instance, but this is not a general or correct solution.

Is there any reason why there is +1 in the identifier number for instances, so that they go 1,2,.. instead of 0,1,..
identifier = "${var.name}-${count.index + 1}"

Is it better for some reason? (I feel index starting on 0 would feel better, and make it easier for me personally to import our current env.. =)

Has it anything to do with getting the same number as promotion_tier?
"${count.index}+1" ?

Will the module be released on registry.terraform.io with the current MIT license?
Curious about the implications of the 'Claranet Ltd' copyright notice.
Is that where you work @FutureSharks ?

I don't try to pass in any security groups, and just stick with what the module creates out of the box:

module "application-db" {
  source  = "terraform-aws-modules/rds-aurora/aws"
  version = "0.0.1"

  name = "${var.environment}db-tf"

  engine         = "aurora-postgresql"
  engine_version = "9.6.8"

  vpc_id = "${data.terraform_remote_state.network.qa_vpc_id}"

  subnets            = ["${data.terraform_remote_state.network.qa_vpc_private_subnets}"]
  availability_zones = ["us-east-1a", "us-east-1b", "us-east-1c"]

  replica_count                   = 1
  instance_type                   = "db.r4.large"
  storage_encrypted               = "false"
  apply_immediately               = "false"
  monitoring_interval             = 10
  db_parameter_group_name         = "default.aurora-postgresql9.6"
  db_cluster_parameter_group_name = "default.aurora-postgresql9.6"
  skip_final_snapshot             = true

  snapshot_identifier = "${var.db-snapshot}"
  username            = "${var.db-user}"
  password            = "${var.db-password}"

  tags = "${var.tags}"
}

On creation, I run into this error:
* aws_security_group.this: from_port (3306) and to_port (5432) must both be 0 to use the 'ALL' "-1" protocol!

I'm not entirely sure what changed, but this module worked a few days ago

Issue introduced in #99 - maybe we should create random_password with special = true ?

module.postgres1.aws_rds_cluster.this: Modifying... [id=postgres1-test-ee9e0b3a]

Error: Failed to modify RDS Cluster (postgres1-test-ee9e0b3a): InvalidParameterValue: The parameter MasterUserPassword is not a valid password. Only printable ASCII characters besides '/', '@', '"', ' ' may be used.
	status code: 400, request id: 5ad5b26f-e191-4e19-a673-9900b360a966

  on .terraform/modules/postgres1/terraform-aws-modules-terraform-aws-rds-aurora-3c73cc9/main.tf line 33, in resource "aws_rds_cluster" "this":
  33: resource "aws_rds_cluster" "this" {

Hi,

I would like to make use of AWS Secrets Manager to rotate root credentials for the aurora db mysql. Could you advise how to do it using this module or maybe you have some useful example where this is being done?

want to use the flag that AWS console offers to ask for replication not just to live master slave/replica in cluster, but also backup to separate region (not running db, just data/files). Is there option for that? Its part of DR plan type of requirement...

Please add another input variable availability_zones to aws rds cluster

resource "aws_rds_cluster" "default" {
  availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"]
}

Thanks

When passing iam db role to iam_roles variable, e.g. iam_roles = [<db_role_arn>] , it fails to apply role to Aurora postgres db cluster with following error -

Error: InvalidParameterValue: The feature-name parameter must be provided with the current operation for the Aurora (PostgreSQL) engine.
        status code: 400, request id: 7bbd3ff5-0d7c-44ad-af95-607b212da013

HI,

is this module support backtrack on aurora mysql(5.6) ?

I got this error:
"Error: module "db_ecomm_mysql": "backtrack_window" is not a valid argument"

Would it be a good idea to update the description for snapshot_identifier, for the case it's not used anymore once the database is already created?

There is no support for AWS IAM authentication in the module. This would be an improvement to the current module. Enabling it should be simple enough, however since not all versions and engines are supported it is probably good to validate the engine to see if it is possible.

Using the module.example_security_group.this_security_group_id output from the Security Group module (https://github.com/terraform-aws-modules/terraform-aws-security-group) to apply security groups to this module fails to update if the security group is replaced for some reason (eg. description change).

The new replacement security group is created, but not attached to the Aurora cluster. The old group fails to delete, and stays attached to the Aurora cluster with all inbound and outbound rules removed.

I am able to manually fix it by adding the new SGs and removing the old ones to the Aurora cluster from the RDS Console, then deleting the old ones in the EC2 console, but this is not ideal.

We see the following error when trying to create an RDS cluster with this module in a US Gov region:

Error: Provider produced inconsistent result after apply

When applying changes to
module.rds.module.rds.aws_iam_role_policy_attachment.rds_enhanced_monitoring[0],
provider "aws" produced an unexpected new value for was present, but now
absent.

This is a bug in the provider, which should be reported in the provider's own
issue tracker.

I don't think it's a provider issue, but rather an issue with how this module is coded. It looks like the policy_arn in in main.tf (line 133) is hard coded to:
arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole

However that arn isn't valid in US Gov regions, it is actually:
arn:aws-us-gov:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole

See AWS docs on this: https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/using-govcloud-arns.html
(note this is also an issue for China which has "aws-cn" instead of "aws" or "aws-us-gov")

instance_type is not required for aurora serverless but the module makes this as required. Is it possible to give an example for how to create a serverless instance?

Hi,

Can we please get the minimum IAM permissions needed for an IAM user or IAM role to create an RDS cluster.

This is missing from the README's/Docs, it would be helpful if we can get one.

Thanks.

It would be nice if the module supports the publicly_accessible boolean in order to allow access from outside of the VPC.

Hi,

How can i provision Multi-AZ? Is this supported?
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.MultiAZ.html

I'm using these two modules.

module "vpc_rds" {
  source = "terraform-aws-modules/vpc/aws"

  name = "vpc-${var.environment}"
  cidr = "10.0.0.0/16"

  create_database_subnet_group           = true
  create_database_subnet_route_table     = true
  create_database_internet_gateway_route = true

  enable_dns_hostnames                   = true
  enable_dns_support                     = true

  # Three Availability Zone
  azs              = var.availability_zones
  private_subnets  = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  public_subnets   = ["10.0.11.0/24", "10.0.12.0/24", "10.0.13.0/24"]
  database_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"]

  enable_nat_gateway = false

  tags = {
    Creator : "me"
  }
}

module "aurora" {
  source                              = "terraform-aws-modules/rds-aurora/aws"
  version                             = "~> 2.0"
  name                                = "aurora-api-mysql-${var.environment}"
  engine                              = "aurora-mysql"
  engine_version                      = "5.7.mysql_aurora.2.04.6"

  # Creds
  username                            = var.username
  password                            = var.password
  iam_database_authentication_enabled = false

  # Misc
  deletion_protection                 = false
  replica_count                       = 1
  instance_type                       = "db.t3.small"
  apply_immediately                   = true
  skip_final_snapshot                 = true
  db_parameter_group_name             = aws_db_parameter_group.aurora_db_57_parameter_group.id
  db_cluster_parameter_group_name     = aws_rds_cluster_parameter_group.aurora_57_cluster_parameter_group.id
  enabled_cloudwatch_logs_exports     = ["audit", "error", "general", "slowquery"]

  # Network
  subnets                             = module.vpc_rds.database_subnets
  vpc_id                              = module.vpc_rds.vpc_id
  publicly_accessible                 = true

  allowed_cidr_blocks                 = ["0.0.0.0/0", "10.0.1.0/24"]
  create_security_group = true
}

In my case, my AWS account I am using permissions boundary to avoid creating a new role with bigger permissions. So any new role must set these permissions.
To run the resource aws_iam_role. rds_enhanced_monitoring, it is needed to set these permissions boundary.
Example:

resource "aws_iam_role" "rds_enhanced_monitoring" {

  name               = "rds-enhanced-monitoring-${var.name}"
  assume_role_policy = data.aws_iam_policy_document.monitoring_rds_assume_role.json

  permissions_boundary = var.permissions_boundary
}

looking at the docs, I'd expect identifier_prefix to be used in the cluster id, instance id, and elsewhere. however, grepping the code, it seems like it's not used anywhere:

$ ag identifier_prefix ../../modules/aws-rds-aurora/
../../modules/aws-rds-aurora/README.md
74:| final_snapshot_identifier_prefix | The prefix name to use when creating a final snapshot on cluster destroy, appends a random 8 digits to name to ensure it's unique too. | string | `final` | no |
75:| identifier_prefix | Prefix for cluster and instance identifier | string | `` | no |

../../modules/aws-rds-aurora/main.tf
27:  final_snapshot_identifier       = "${var.final_snapshot_identifier_prefix}-${var.name}-${random_id.snapshot_identifier.hex}"

../../modules/aws-rds-aurora/variables.tf
10:variable "identifier_prefix" {
53:variable "final_snapshot_identifier_prefix" {

If these values are null AWS will create and pick the correct default group for the engine type being deployed.

variable "db_parameter_group_name" {
  description = "The name of a DB parameter group to use"
  type        = string
  default     = null
}

variable "db_cluster_parameter_group_name" {
  description = "The name of a DB Cluster parameter group to use"
  type        = string
  default     = null
}

I was trying to schedule an Aurora Postgres engine upgrade from 10.7 to 10.11 for the next maintenance window. I have explicit apply_immediately = false in the module. However when I went to apply the changes, it just immediately tried to update and actually failed.

The change I made to attempt to schedule the upgrade was engine_version = "10.7" to engine_version = "10.11"

Here's a snippet of the plan with most of the irrelevant information redacted

  # module.vault_db.aws_rds_cluster.this will be updated in-place
  ~ resource "aws_rds_cluster" "this" {
        apply_immediately                   = false
        engine                              = "aurora-postgresql"
        engine_mode                         = "provisioned"
      ~ engine_version                      = "10.7" -> "10.11"

        preferred_maintenance_window        = "sun:05:00-sun:06:00"

    }

  # module.vault_db.aws_rds_cluster_instance.this[0] must be replaced
-/+ resource "aws_rds_cluster_instance" "this" {
        apply_immediately               = false
        auto_minor_version_upgrade      = true
        engine                          = "aurora-postgresql"
      ~ engine_version                  = "10.7" -> "10.11" # forces replacement
        preferred_maintenance_window    = "sun:05:00-sun:06:00"

    }

I was hoping that the warning about the DB Instance being replaced was a false alarm, and that it would just be replaced during the maintenance window, but it immediately started to delete the instance. What's worse is that it even failed to upgrade the cluster. It deleted the two DB Instances but then couldn't upgrade the cluster itself because no instances were running.

module.vault_db.aws_rds_cluster_instance.this[1]: Destroying... [id=redacted-2]
module.vault_db.aws_rds_cluster_instance.this[0]: Destroying... [id=redacted-1]
module.vault_db.aws_rds_cluster.this: Modifying... [id=redacted]
module.vault_db.aws_rds_cluster_instance.this[1]: Still destroying... [id=redacted-2, 10s elapsed]
module.vault_db.aws_rds_cluster_instance.this[0]: Still destroying... [id=redacted-1, 10s elapsed]
module.vault_db.aws_rds_cluster.this: Still modifying... [id=redacted, 10s elapsed]
module.vault_db.aws_rds_cluster_instance.this[1]: Still destroying... [id=redacted-2, 20s elapsed]
module.vault_db.aws_rds_cluster_instance.this[0]: Still destroying... [id=redacted-1, 20s elapsed]
module.vault_db.aws_rds_cluster.this: Still modifying... [id=redacted, 20s elapsed]
module.vault_db.aws_rds_cluster_instance.this[1]: Still destroying... [id=redacted-2, 30s elapsed]
module.vault_db.aws_rds_cluster_instance.this[0]: Still destroying... [id=redacted-1, 30s elapsed]
module.vault_db.aws_rds_cluster.this: Still modifying... [id=redacted, 30s elapsed]
module.vault_db.aws_rds_cluster.this: Modifications complete after 33s [id=redacted]
...
Error: error creating RDS DB Instance: InvalidParameterCombination: The engine version that you requested for your DB instance (10.11) does not match the engine version of your DB cluster (10.7).
        status code: 400, request id: 8cce8f94-7ba3-4dc6-97b0-610d177f6e27

  on .terraform/modules/vault_db/main.tf line 81, in resource "aws_rds_cluster_instance" "this":
  81: resource "aws_rds_cluster_instance" "this" {

I'm not sure if this is user error, a bug in the module, or in the provider. I searched in both this module and the provider for anything relating to this, but couldn't find anything.

If you set create_security_group to false the quoted line below fails in the compact call.

Error: Invalid index

  on .terraform/modules/db_cluster/terraform-aws-modules-terraform-aws-rds-aurora-9bd85d0/main.tf line 48, in resource "aws_rds_cluster" "this":
  48:   vpc_security_group_ids              = compact(concat([aws_security_group.this[0].id], var.vpc_security_group_ids))
    |----------------
    | aws_security_group.this is empty tuple

The given key does not identify an element in this collection value.

Would it work to include a ternary within that contact call - something like?

compact(concat(var.create_security_group ? [aws_security_group.this[0].id] : [], var.vpc_security_group_ids))

Hi!

When I switch from the default kms/rds key to a self managed kms key, the autoscaling group is not created anymore.

The apply succeeds, but instead a single-region single instance cluster is created rather than a multi-az cluster even though my module arguments didn't change and the replica count is still at 2, no replicas is created and no error is thrown during apply.

Allow conditional creation of RDS Aurora resources similar to how terraform-aws-vpc module handles uses create_vpc.

This is for a personal use case where we have many isolated smaller state files in use and sometimes do not wish for a specific Aurora cluster to be created/in use yet would want a workspace defined and valid TF state to exist (containing no Aurora resources).

Remaining things to fix before big announcements on the registry:

• Add all outputs for all resources (get names from official documentation for each resource))
• Review all variables for all resources (get names from official documentation for each resource)). Also copy defaults which are in the official documentation.
• Make examples executable, add README there, add outputs. And run them all.

After the release (any time later):

• Review the code. It should be possible to create several RDS clusters with the same name, so use name_prefix or synonyms on all resources.
• Add conditional creation of optional resources (security group, db subnet group can be provided externally).
• Add conditional creation of RDS cluster also.

add argument enabled_cloudwatch_logs_exports as supported by terraform resource aws_rds_cluster (https://www.terraform.io/docs/providers/aws/r/rds_cluster.html)

terraform version
Terraform v0.11.10

• provider.aws v1.59.0
• provider.mysql v1.5.1
• provider.null v2.0.0
• provider.random v2.0.0

The current Serverless example for PostgreSQL does not work. It is using Parameter Group aurora5.6 which is for Serverless MySQL 5.6. Instead, it should be using aurora-postgresql10 for PostgreSQL which can be found in AWS Aurora Serverless Documentation

I will be creating a PR and associate it with this Issue.

Currently, when Aurora Cluster is created, only Cluster ID is exposed in output.

We have a use case where we need instance IDs as well to setup CloudWatch Alarms on each instance.

It would be helpful if we can get the instance IDs as well in outputs.

Thanks.

Running the postgres example fails on terraform apply with this error message:

* aws_rds_cluster.this: error creating RDS cluster: InvalidParameterCombination: Engine aurora-postgresql 9.6.3 does not support exporting to CloudWatch Logs. For supported engine versions, see the documentation.

I have a use case that involves outgoing connections from the aurora rds cluster

I propose an additional resource to main.tf like so:

resource "aws_security_group_rule" "default_egress" {
  count = "${var.allowed_security_groups_count}"

  type                     = "egress"
  from_port                = "${aws_rds_cluster.this.port}"
  to_port                  = "${aws_rds_cluster.this.port}"
  protocol                 = "tcp"
  source_security_group_id = "${element(var.allowed_security_groups, count.index)}"
  security_group_id        = "${aws_security_group.this.id}"
}

Once this pull request is merged in the ability to pass ca_cert_identifier through this module will also be needed before the March deadline to update the certificate.

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL-certificate-rotation.html

Hi,

i just started experimenting with this. While testing an upgrade of the instance_type i noticed that both instances would be upgrade at the same time, which causes downtime.

Is it possible to upgrade the nodes one at a time with this module? (And therefore make use of the failver)

module "rds"{
  source = "git::ssh://..."
  name = "internal-mysql"

  vpc_id  = module.vpc.vpc_id
  subnets = module.vpc.intra_subnets

  engine         = "aurora-mysql"
  engine_version = "5.7.12"

  replica_count = 1


  password = "testing123"

  # performance_insights_enabled = true

  instance_type       = "db.r3.large"
  apply_immediately   = true
  skip_final_snapshot = true
  storage_encrypted   = true


  backup_retention_period = 7

  deletion_protection = false

  db_parameter_group_name         = aws_db_parameter_group.aurora_db_57_parameter_group.id
  db_cluster_parameter_group_name = aws_rds_cluster_parameter_group.aurora_57_cluster_parameter_group.id
  enabled_cloudwatch_logs_exports = ["audit", "error", "general", "slowquery"]
  allowed_cidr_blocks             = local.subnets["private"]

  create_security_group = true

  tags = merge(local.tags, {
    type   = "mysql",
    backup = "daily"
  })
}

regards,
strowi

The resource identifier is needed when creating rds-db connect IAM policies for example and is returned by the aws_rds_cluster.cluster_resource_id.

as an example of where this is needed:

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Effect": "Allow",
         "Action": [
             "rds-db:connect"
         ],
         "Resource": [
             "arn:aws:rds-db:us-east-2:1234567890:dbuser:db-ABCDEFGHIJKL01234/db_user"
         ]
      }
   ]
}

currently there is no way to retrieve the resource identifier db-ABCDEFGHIJKL01234 from the module.

I've actually just commented out these:,

  #db_parameter_group_name         = "default"
  #db_cluster_parameter_group_name = "default"

I'm not even sure why I need them. And then I've got error:

module.db.aws_rds_cluster.this: Creating...

Error: error creating RDS cluster: DBClusterParameterGroupNotFound: DBClusterParameterGroup not found: default.aurora5.6
        status code: 404, request id: 8b417ecc-9600-4d03-b24d-9c525d320894

  on .terraform/modules/db/terraform-aws-modules-terraform-aws-rds-aurora-08cef85/main.tf line 24, in resource "aws_rds_cluster" "this":
  24: resource "aws_rds_cluster" "this" {

The default param also doesn't work:

 DBClusterParameterGroup not found: default

Also tried to use the one which I've found on aws: default.postgres10 as I'm using 10.7 postgresql version, but it's also saying it's not found

So what should I put in here?

Add support for MySQL Servers with an example on how to use scaling configurations

scaling_configuration {
auto_pause = true
max_capacity = 256
min_capacity = 2
seconds_until_auto_pause = 60
}

The variable names and descriptions are a bit confusing in some cases:

1. skip_final_snapshot. If True, then no snapshot will be taken when the cluster is destroyed. However, the description states "Should a final snapshot be created on cluster destroy," which if true, would mean that a final snapshot will be created. (the opposite) Something like "Skip the creation of a final snapshot on cluster destruction" would align with the variable name.
2. The variable names, like db_name/name subnets/subnet_ids, are not consistent between your terraform-aws-rds and terraform-aws-rds-aurora modules. It would be helpful to have consistent variable names and descriptions for the same variables across your modules.

Thanks for the helpful modules!

J

I got this error when I run terraform plan.

Acquiring state lock. This may take a few moments...

Error: Unsupported argument

  on .terraform/modules/aurora/terraform-aws-modules-terraform-aws-rds-aurora-9bd85d0/main.tf line 67, in resource "aws_rds_cluster" "this":
  67:       timeout_action           = lookup(scaling_configuration.value, "timeout_action", null)

An argument named "timeout_action" is not expected here.

Here is my config snippet:

#############
# RDS Aurora
#############
module "aurora" {
  source         = "terraform-aws-modules/rds-aurora/aws"
  name           = "aurora-serverless"
  engine         = "aurora-postgresql"
  engine_version = "10.7"

  engine_mode   = "serverless"
  replica_count = 1

  backtrack_window = 10 # ignored in serverless

  subnets                         = data.aws_subnet_ids.all.ids
  vpc_id                          = data.aws_vpc.default.id
  monitoring_interval             = 60
  instance_type                   = "db.r4.large"
  apply_immediately               = true
  skip_final_snapshot             = true
  storage_encrypted               = true
  db_parameter_group_name         = aws_db_parameter_group.aurora_db_postgres96_parameter_group.id
  db_cluster_parameter_group_name = aws_rds_cluster_parameter_group.aurora_cluster_postgres96_parameter_group.id

  scaling_configuration = {
    auto_pause               = true
    max_capacity             = 256
    min_capacity             = 2
    seconds_until_auto_pause = 300
    timeout_action           = "ForceApplyCapacityChange"
  }
}