RDS Database - Ravion Docs

Type: rvn-rds · Latest version: 0.4.2

Dependencies and consumers

Every dependency input can be specified manually to reference existing external infrastructure rather than a Ravion module.

Readme

Creates and manages an Amazon RDS database. Supports PostgreSQL, MySQL, MariaDB, Oracle, and SQL Server engines.

Overview

Use this module when an application needs a managed relational database in AWS. It provisions an RDS instance with subnet placement, security group access, backups, monitoring, optional read replicas, and CloudWatch alarms. The module supports PostgreSQL, MySQL, MariaDB, Oracle, and SQL Server engines. Aurora uses a different AWS resource model and is not configured by this module.

Use cases

Scenario	Benefit
Application database	Create a private RDS instance attached to an existing Ravion VPC network.
Production database	Enable Multi-AZ, deletion protection, automated backups, performance insights, and CloudWatch alarms.
Read-heavy workload	Add read replicas for supported engines.
Sensitive data	Keep public access disabled, use encryption, manage credentials in Secrets Manager, and restrict ingress.

Networking

Select a VPC network first. Ravion maps the network’s AWS account, region, VPC ID, and private subnet IDs into this module. The database subnet group uses the selected private subnets by default. Public access is disabled by default. Keep it disabled for normal application databases and allow access through security group IDs from application services or controlled CIDR blocks.

Database engine and sizing

Choose the engine, optional engine major version, optional engine minor version, instance class, and allocated storage. If engine major version is blank, AWS selects the latest available version for that engine. Storage type defaults to gp3. Max allocated storage controls RDS storage autoscaling; keep it at 0 to disable autoscaling. AWS supports increasing allocated storage after creation, but not reducing it in place.

Credentials and security

Manage password in Secrets Manager is enabled by default, so AWS creates and stores the master password for the database. Disable it only when you need to provide a master password yourself. Storage encryption is enabled by default. Provide a storage KMS key ARN when you need a customer-managed key for storage. IAM database authentication is shown only for MySQL and PostgreSQL.

Availability, backups, and maintenance

Multi-AZ creates a standby in another availability zone for failover. The single availability zone field is hidden when Multi-AZ is enabled. Read replicas are shown only for engines that support RDS read replicas and are hidden for SQL Server. Automated backups default to 7 days. You can set the backup window and control final snapshot behavior. Deletion protection is enabled by default. Automatic minor engine version upgrades are configured next to the engine version fields and, when enabled, happen during the configured maintenance window. Major version upgrades and immediate changes are opt-in.

Observability

Performance insights is enabled by default with 7 days of retention. Enhanced monitoring can be enabled by setting a monitoring interval. CloudWatch alarms are optional. When enabled, the module can alarm on CPU utilization, free storage space, and database connections. The free storage alarm threshold is entered in GiB in Ravion and converted to bytes for Terraform. The Ravion UI also shows RDS CloudWatch metrics for CPU, free storage, connections, read IOPS, and write IOPS.

Configuration

Field	Required	Default	Notes
VPC network	Yes	None	Supplies AWS account, region, VPC ID, and private subnet IDs.
Name slug	Yes	Project and environment given IDs	Prefix for RDS resources.
Engine	Yes	postgres	PostgreSQL, MySQL, MariaDB, Oracle, and SQL Server variants are supported.
Engine major version	Yes	None	Sets the RDS major engine version, such as 15 for PostgreSQL or 8.0 for MySQL.
Engine minor version	No	Blank	Appended to the major version when an exact version is required.
Auto minor version upgrades	No	true	Applies minor engine upgrades during the configured maintenance window.
Instance class	Yes	None	Use an RDS class such as db.t4g.micro or db.r6g.large.
Allocated storage	Yes	20	Storage in GiB.
Master username	Yes	dbadmin	Master database user. Do not use reserved engine words such as admin.
Storage KMS key ARN	No	Blank	Uses a customer-managed KMS key for storage encryption.
Initial database name	No	Blank	Creates an initial database when supported by the engine. Reserved RDS engine words such as database are blocked.
Publicly accessible	No	false	Leave disabled unless public database access is intentional.
Security group creation	No	true	Creates ingress rules from allowed security groups and CIDRs.
Multi-AZ	No	false	Enables high availability standby.
Read replicas	No	false	Creates read replicas when supported by the engine.
Manage password in Secrets Manager	No	true	Stores generated master credentials in AWS Secrets Manager.
Backup retention days	No	7	Set to 0 to disable automated backups.
Deletion protection	No	true	Helps prevent accidental deletion.
Performance insights	No	true	Enables AWS Performance Insights.
CloudWatch alarms	No	false	Adds CPU, free storage, and connection alarms.
Free storage alarm threshold	No	5 GiB	Converted to bytes before Terraform runs.
Tags	No	Blank	Merged with Ravion standard tags.

Advanced configuration

Use parameter group settings for engine parameters. Oracle settings and SQL Server settings are shown in separate engine-specific sections. Option group settings are shown only for Oracle and SQL Server engines; blue/green updates are shown only for MySQL and MariaDB. Use advanced Terraform variables for one-off overrides not represented directly in the UI. Values in advanced Terraform variables override generated variables. Terraform settings let you override the OpenTofu version, Terraform execution environment inherited from the VPC network, and Ravion state backend workspace name.

Design decisions

RDS instances are placed in private subnets by default through the VPC network reference. Secrets Manager password management, encryption at rest, performance insights, and deletion protection default on because they are safer defaults for long-lived databases. The module keeps primary database choices visible and tucks optional engine, engine-specific, storage, backup, monitoring, maintenance, parameter group, and option group details behind collapsible controls. Source repository and stack plumbing remain managed by Ravion.

Learn more

Inputs reference

All inputs for rvn-rds version 0.4.2. Use the name shown for each field as the input key in module config.

$ref:rvn-aws-network

required

VPC network.

Immutable after creation

Database

string

required

Name slug. Name prefix for all RDS resources.

Default: <<project.given_id>>-<<environment.given_id>>
Immutable after creation
Pattern: ^[a-z0-9]([a-z0-9-]{0,38}[a-z0-9])?$ — 1-40 lowercase letters, numbers, and hyphens. Start and end with a letter or number.

string

required

Create or restore.

Default: none
Allowed values: none (New empty database), snapshot (Restore from snapshot), point_in_time (Point-in-time restore)
Immutable after creation

string

required

Database name.

Immutable after creation
Pattern: ^[a-z][a-z0-9_]{0,63}$ — 1-64 lowercase letters, numbers, and underscores. Start with a letter.
Pattern: ^(?:|[^adimnoprst].*|a(?:|[^d].*|d(?:|[^m].*|m(?:|[^i].*|i(?:|[^n].*|n.+))))|d(?:|[^a].*|a(?:|[^t].*|t(?:|[^a].*|a(?:|[^b].*|b(?:|[^a].*|a(?:|[^s].*|s(?:|[^e].*|e(?:[^s].*|s.+))))))))|i(?:|[^n].*|n(?:|[^f].*|f(?:|[^o].*|o(?:|[^r].*|r(?:|[^m].*|m(?:|[^a].*|a(?:|[^t].*|t(?:|[^i].*|i(?:|[^o].*|o(?:|[^n].*|n(?:|[^_].*|_(?:|[^s].*|s(?:|[^c].*|c(?:|[^h].*|h(?:|[^e].*|e(?:|[^m].*|m(?:|[^a].*|a.+)))))))))))))))))|m(?:|[^y].*|y(?:|[^s].*|s(?:|[^q].*|q(?:|[^l].*|l.+))))|n(?:|[^u].*|u(?:|[^l].*|l(?:|[^l].*|l.+)))|o(?:|[^r].*|r(?:|[^a].*|a(?:|[^c].*|c(?:|[^l].*|l(?:|[^e].*|e.+)))))|p(?:|[^eo].*|e(?:|[^r].*|r(?:|[^f].*|f(?:|[^o].*|o(?:|[^r].*|r(?:|[^m].*|m(?:|[^a].*|a(?:|[^n].*|n(?:|[^c].*|c(?:|[^e].*|e(?:|[^_].*|_(?:|[^s].*|s(?:|[^c].*|c(?:|[^h].*|h(?:|[^e].*|e(?:|[^m].*|m(?:|[^a].*|a.+))))))))))))))))|o(?:|[^s].*|s(?:|[^t].*|t(?:|[^g].*|g(?:|[^r].*|r(?:|[^e].*|e(?:|[^s].*|s.+)))))))|r(?:|[^do].*|d(?:|[^s].*|s(?:|[^a].*|a(?:|[^d].*|d(?:|[^m].*|m(?:|[^i].*|i(?:|[^n].*|n.+))))))|o(?:|[^o].*|o(?:|[^t].*|t.+)))|s(?:|[^y].*|y(?:|[^s].*|s.+))|t(?:|[^e].*|e(?:|[^m].*|m(?:|[^p].*|p(?:|[^l].*|l(?:|[^a].*|a(?:|[^t].*|t(?:|[^e].*|e(?:|[^01].*|0.+|1.+)))))))))$ — Pick a different name, this is reserved by AWS.
Shown when: {"engine":["mysql","postgres","mariadb","oracle-ee","oracle-se2","oracle-se2-cdb"],"restore_mode":"none"}

string

required

Username.

Default: dbadmin
Immutable after creation
Pattern: ^[A-Za-z][A-Za-z0-9_]{0,62}$ — Invalid RDS master username. Start with a letter. Letters, numbers, and underscores only.
Shown when: {"restore_mode":"none"}

string

Snapshot to restore. Snapshot identifier or ARN to restore into this new database. The snapshot must be compatible with the selected engine and instance settings.

Immutable after creation
Shown when: {"restore_mode":"snapshot"}

boolean

Use latest restorable time. Restore to the latest time AWS can recover from the selected source database backup.

Default: true
Immutable after creation
Shown when: {"restore_mode":"point_in_time"}

string

Restore time. Restore to this UTC timestamp instead of the latest restorable time.

Immutable after creation
Shown when: {"point_in_time_use_latest_restorable_time":false,"restore_mode":"point_in_time"}

string

Source DB instance identifier. Source DB instance identifier to restore from.

Immutable after creation
Shown when: {"restore_mode":"point_in_time"}

string

Source automated backups ARN. ARN of the source automated backups to restore from. Use this for cross-region or retained automated backup restores.

Immutable after creation
Shown when: {"restore_mode":"point_in_time"}

string

Source DB resource ID. Source DB resource ID to restore from when using automated backups.

Immutable after creation
Shown when: {"restore_mode":"point_in_time"}

Version

string

required

Engine.

Default: postgres
Allowed values: postgres (PostgreSQL), mysql (MySQL), mariadb (MariaDB), oracle-ee (Oracle Enterprise Edition), oracle-se2 (Oracle Standard Edition 2), oracle-se2-cdb (Oracle Standard Edition 2 CDB), sqlserver-ee (SQL Server Enterprise), sqlserver-se (SQL Server Standard), sqlserver-ex (SQL Server Express), sqlserver-web (SQL Server Web)
Immutable after creation

string

required

Engine major version. Examples: 15 for PostgreSQL or SQL Server, 8.0 for MySQL, 19 for Oracle.

Immutable after creation

string

Engine minor version. Optional minor engine version appended to the major version. Example: major 15 and minor 4 becomes 15.4.

boolean

Auto minor version upgrades. Enable automatic minor engine version upgrades during the configured maintenance window.

Default: true

Size & Storage

string

required

Instance class. RDS instance size, such as db.t4g.micro or db.r6g.large.

Default: db.t4g.micro

number

required

Allocated storage (GiB). AWS supports increasing allocated storage after creation, but not reducing it in place.

Default: 20
Min: 20
Max: 65536

number

Max allocated storage (GiB). Upper limit for RDS storage autoscaling. Use 0 to disable. AWS can grow storage up to this limit, but storage cannot be reduced in place.

Default: 0
Min: 0
Max: 65536

string

Storage type.

Default: gp3
Allowed values: gp3, gp2, io1, io2, standard

number

Provisioned IOPS.

Min: 1000
Max: 256000
Shown when: {"storage_type":["gp3","io1","io2"]}

number

Storage throughput (MiB/s).

Min: 125
Max: 1000
Shown when: {"storage_type":"gp3"}

string

Storage KMS key ARN.

Immutable after creation

string

CA certificate identifier.

Network access

boolean

Publicly accessible. Keep disabled for production databases unless public access is intentional.

Default: false

number

Port. Leave blank to use the engine default port.

Min: 1
Max: 65535

boolean

Security group creation.

Default: true
Immutable after creation

string

Existing security group ID.

Shown when: {"security_group_creation_enabled":false}

string_array

Allowed security groups.

Shown when: {"security_group_creation_enabled":true}

string_array

Allowed CIDR blocks.

Shown when: {"security_group_creation_enabled":true}

Availability & replicas

boolean

Multi-AZ.

Default: false

string

Availability zone. Single-AZ placement. Hidden when Multi-AZ is enabled because AWS chooses standby placement.

Shown when: {"multi_az_enabled":false}

boolean

Read replicas.

Default: false
Shown when: {"engine":["mysql","postgres","mariadb","oracle-ee","oracle-se2","oracle-se2-cdb"]}

number

Read replica count.

Default: 1
Min: 0
Max: 15
Shown when: {"engine":["mysql","postgres","mariadb","oracle-ee","oracle-se2","oracle-se2-cdb"],"read_replica_creation_enabled":true}

string

Read replica instance class.

Shown when: {"engine":["mysql","postgres","mariadb","oracle-ee","oracle-se2","oracle-se2-cdb"],"read_replica_creation_enabled":true}

string_array

Read replica AZs.

Shown when: {"engine":["mysql","postgres","mariadb","oracle-ee","oracle-se2","oracle-se2-cdb"],"read_replica_creation_enabled":true}

Credentials & authentication

string

Secrets Manager KMS key ARN.

Shown when: {"restore_mode":"none"}

boolean

IAM database authentication.

Default: false
Shown when: {"engine":["mysql","postgres"]}

SQL Server settings

string

License model.

Allowed values: license-included, bring-your-own-license
Immutable after creation
Shown when: {"engine":["sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"]}

string

Character set.

Immutable after creation
Shown when: {"engine":["sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"]}

string

SQL Server time zone.

Immutable after creation
Shown when: {"engine":["sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"]}

string

Active Directory directory ID.

Immutable after creation
Shown when: {"engine":["sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"]}

string

Active Directory IAM role name.

Immutable after creation
Shown when: {"domain":{"not":""},"engine":["sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"]}

Oracle settings

string

License model.

Allowed values: license-included, bring-your-own-license
Immutable after creation
Shown when: {"engine":["oracle-ee","oracle-se2","oracle-se2-cdb"]}

string

Character set.

Immutable after creation
Shown when: {"engine":["oracle-ee","oracle-se2","oracle-se2-cdb"]}

Backups

number

Backup retention days.

Default: 7
Min: 0
Max: 35

string

Backup window.

Shown when: {"backup_retention_period":{"not":0}}

boolean

Copy tags to snapshots.

Default: true

boolean

Delete automated backups. Delete retained automated backups when the database is deleted. Disable this to preserve automated backups after deletion.

Default: true
Shown when: {"backup_retention_period":{"not":0}}

boolean

Create final snapshot.

Default: true

string

Final snapshot identifier.

Shown when: {"final_snapshot_creation_enabled":true}

boolean

Deletion protection.

Default: true

Maintenance

string

Maintenance window.

boolean

Allow major version upgrades.

Default: false

boolean

Apply changes immediately.

Default: false

Monitoring

string_array

CloudWatch log exports.

number

Enhanced monitoring interval.

Default: 0
Allowed values: 0 (0), 1 (1), 5 (5), 10 (10), 15 (15), 30 (30), 60 (60)

boolean

Monitoring IAM role creation.

Default: true
Immutable after creation
Shown when: {"monitoring_interval":{"not":0}}

string

Monitoring IAM role ARN.

Shown when: {"monitoring_interval":{"not":0},"monitoring_role_creation_enabled":false}

boolean

Performance insights.

Default: true

number

Performance insights retention days.

Default: 7
Shown when: {"performance_insights_enabled":true}

string

Performance insights KMS key ARN.

Shown when: {"performance_insights_enabled":true}

CloudWatch alarms

boolean

Create CloudWatch alarms.

Default: true

number

CPU alarm threshold (%).

Default: 80
Min: 0
Max: 100
Shown when: {"cloudwatch_alarms_creation_enabled":true}

number

Free storage alarm threshold (GiB). Displayed in GiB. Ravion converts this to bytes for Terraform.

Default: 5
Min: 0
Shown when: {"cloudwatch_alarms_creation_enabled":true}

number

Connections alarm threshold.

Default: 100
Min: 1
Shown when: {"cloudwatch_alarms_creation_enabled":true}

number

Alarm evaluation periods.

Default: 2
Min: 1
Shown when: {"cloudwatch_alarms_creation_enabled":true}

number

Alarm period seconds.

Default: 300
Allowed values: 10 (10), 30 (30), 60 (60), 300 (300), 900 (900), 3600 (3600)
Shown when: {"cloudwatch_alarms_creation_enabled":true}

string_array

Alarm action ARNs.

Shown when: {"cloudwatch_alarms_creation_enabled":true}

string_array

OK action ARNs.

Shown when: {"cloudwatch_alarms_creation_enabled":true}

Parameter group

boolean

Parameter group creation. Create a parameter group for this database. Disable this only when you want to attach an existing parameter group.

Default: true
Immutable after creation

string

Existing parameter group name. Name of an existing parameter group to attach when this module is not creating one.

Immutable after creation
Shown when: {"parameter_group_creation_enabled":false}

string

Parameter group family. Parameter group family, such as postgres15 or mysql8.0. Leave blank to derive it from the selected engine and major version.

Immutable after creation
Shown when: {"parameter_group_creation_enabled":true}

object_array

Parameters. Custom database engine parameters to apply to the created parameter group. Many changes require a database reboot depending on the parameter.

Default: []
Shown when: {"parameter_group_creation_enabled":true}

Show item fields

string

required

Name. Engine parameter name, such as log_statement or max_connections.

string

required

Value. Parameter value to set.

string

Apply method. Apply immediately when supported, or wait until the next database reboot.

Default: immediate
Allowed values: immediate, pending-reboot

Option group

boolean

Option group creation.

Default: false
Immutable after creation
Shown when: {"engine":["oracle-ee","oracle-se2","oracle-se2-cdb","sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"]}

string

Existing option group name.

Immutable after creation
Shown when: {"engine":["oracle-ee","oracle-se2","oracle-se2-cdb","sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"],"option_group_creation_enabled":false}

string

Option group engine version.

Immutable after creation
Shown when: {"engine":["oracle-ee","oracle-se2","oracle-se2-cdb","sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"],"option_group_creation_enabled":true}

array

Options.

Default: []
Shown when: {"engine":["oracle-ee","oracle-se2","oracle-se2-cdb","sqlserver-ee","sqlserver-se","sqlserver-ex","sqlserver-web"],"option_group_creation_enabled":true}

Blue/green deployments

boolean

Blue/green updates.

Default: false
Shown when: {"engine":["mysql","mariadb"]}

Misc

keyvalue

Tags. A map of tags to assign to all resources. Default tags are Owner, ProjectGivenId, EnvironmentGivenId, ModuleGivenId, ModuleId

Terraform settings

string

OpenTofu version override. Override the environment’s default version for this module

string

Ravion Terraform workspace name. Override Terraform state backend workspace name. Defaults to project + environment + module given ids.

Immutable after creation

object

Advanced Terraform variables. Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.

Default: {}

​Dependencies and consumers

​Readme

​Overview

​Use cases

​Networking

​Database engine and sizing

​Credentials and security

​Availability, backups, and maintenance

​Observability

​Configuration

​Advanced configuration

​Design decisions

​Learn more

​Inputs reference

​Database

​Version

​Size & Storage

​Network access

​Availability & replicas

​Credentials & authentication

​SQL Server settings

​Oracle settings

​Backups

​Maintenance

​Monitoring

​CloudWatch alarms

​Parameter group

​Option group

​Blue/green deployments

​Misc

​Terraform settings

Dependencies and consumers

Readme

Overview

Use cases

Networking

Database engine and sizing

Credentials and security

Availability, backups, and maintenance

Observability

Configuration

Advanced configuration

Design decisions

Learn more

Inputs reference

Database

Version

Size & Storage

Network access

Availability & replicas

Credentials & authentication

SQL Server settings

Oracle settings

Backups

Maintenance

Monitoring

CloudWatch alarms

Parameter group

Option group

Blue/green deployments

Misc

Terraform settings