Skip to content

Latest commit

 

History

History
71 lines (58 loc) · 9.78 KB

README.md

File metadata and controls

71 lines (58 loc) · 9.78 KB
Raw

AWS RDS Secret Rotation

A Terraform module that creates an AWS Secrets Manager secret for RDS, with optional rotation support.

Features

  • Creates secret with the correct format required by RDS.
  • Supports PostgreSQL but is easy to add other engines.
  • When rotation is enabled, all required infrastructure is created (lambda, security group, etc)

Secret rotation is not only a great thing to do from a security perspective, but it negates the worry about the aws_rds_cluster resource storing passwords in state.

Usage

PostgreSQL Aurora Serverless

module "root_user" {
  source = "JCapriotti/rds-secret-rotation"

  db_cluster_identifier = "my-db"
  engine                = "postgres"
  host                  = "my-db.cluster-xxxxxxxx.us-east-1.rds.amazonaws.com"
  name_prefix           = "my-db-"
  port                  = 5432
  username              = "root"
  password              = "SomethingSecret!"
  rotation_days         = 7

  rotation_lambda_subnet_ids = ["subnet-0123456789", "subnet-abcdef0123"]
  rotation_lambda_vpc_id     = "vpc-0123456789"
  db_security_group_id       = aws_security_group.rds.id
}

Inputs

Name Description Type Default Required
db_cluster_identifier The DB cluster identifier string yes
db_security_group_id The security group ID for the database. Required for secret rotation. string null no
engine The database engine type string yes
host The host name of the database instance string yes
master_secret_arn The superuser credentials used to update another secret in the multiuser rotation strategy. Required when using multipleuser rotation strategy. string null no
name_prefix The prefix for names of created resources. string yes
password The password for the user. string yes
port The port number of the database instance. number yes
rotation_days The number of days between rotations. When set to null (the default) rotation is not configured. number null no
rotation_lambda_env_variables Optional environment variables for the rotation lambda; useful for integration with for certain layer providers. map(string) {} no
rotation_lambda_handler An optional lambda handler name; useful integration with for certain layer providers. string null no
rotation_lambda_layers Optional layers for the rotation lambda. list(string) null no
rotation_lambda_policy_jsons Additional policies to add to the rotation lambda; useful for integration with layer providers. list(string) [] no
rotation_lambda_subnet_ids The VPC subnets that the rotation lambda runs in. Required for secret rotation. list(string) [] no
rotation_lambda_vpc_id The VPC that the secret rotation lambda runs in. Required for secret rotation. string null no
rotation_strategy Specifies how the secret is rotated, either by updating credentials for the user itself (single) or by using a superuser's credentials to change another user's credentials (multiuser). string single no
secret_recovery_window_days The number of days that Secrets Manager waits before deleting a secret. number 0 no
tags Tags to use for created resources. map(string) {} no
username The username. string yes
recreate_missing_package Whether to recreate missing Lambda package if it is missing locally or not. bool true no

Outputs

Name Description
default_rotation_lambda_handler The default lambda handler for the built-in function. Useful for when integrating with a layer.
rotation_lambda_role_name The name of the IAM role created for the rotation lambda.
rotation_lambda_runtime The runtime of the rotation lambda.
rotation_lambda_security_group_id The security group created for the rotation lambda.
secret_arn The ARN of the secret that was created.
secret_name The name of the secret that was created.