| name |
Identifier for the RDS Proxy. Must be unique per region. |
string |
n/a |
yes |
| engine_family |
Engine family the proxy supports. Valid values: MYSQL, POSTGRESQL, SQLSERVER. |
string |
n/a |
yes |
| vpc_subnet_ids |
List of VPC subnet IDs to associate with the proxy. |
list(string) |
n/a |
yes |
| security_group_ids |
List of VPC security group IDs to associate with the proxy. |
list(string) |
n/a |
yes |
| auth |
Map of auth entries for the proxy. Each entry supports: auth_scheme, secret_arn, iam_auth (optional), username (optional), description (optional). |
map(object({
auth_scheme = string
secret_arn = string
iam_auth = optional(string, "DISABLED")
username = optional(string, null)
description = optional(string, null)
})) |
n/a |
yes |
| db_instance_identifier |
Identifier of the RDS DB instance to register as the proxy target. Mutually exclusive with db_cluster_identifier. |
string |
null |
no |
| db_cluster_identifier |
Identifier of the Aurora DB cluster to register as the proxy target. Mutually exclusive with db_instance_identifier. |
string |
null |
no |
| iam_role_arn |
ARN of an existing IAM role for the proxy. When set, the module does not create an IAM role or policy. |
string |
null |
no |
| iam_role_name |
Name for the IAM role created by the module. Defaults to <name>-rds-proxy-role. Ignored when iam_role_arn is set. |
string |
null |
no |
| iam_role_path |
Path for the IAM role created by the module. Ignored when iam_role_arn is set. |
string |
"/" |
no |
| iam_role_permissions_boundary |
ARN of the IAM policy to use as a permissions boundary for the created role. Ignored when iam_role_arn is set. |
string |
null |
no |
| iam_policy_name |
Name for the inline IAM policy attached to the created role. Defaults to <name>-rds-proxy-policy. Ignored when iam_role_arn is set. |
string |
null |
no |
| kms_key_arns |
List of KMS key ARNs the proxy IAM role may use for decrypting Secrets Manager secrets. Ignored when iam_role_arn is set. |
list(string) |
[] |
no |
| debug_logging |
Whether the proxy includes detailed information about SQL statements in its logs. |
bool |
false |
no |
| idle_client_timeout |
Number of seconds a client connection can remain idle before the proxy closes it. Range: 1–28800. |
number |
1800 |
no |
| require_tls |
Whether TLS encryption is required for connections to the proxy. |
bool |
true |
no |
| max_connections_percent |
Maximum size of the connection pool as a percentage of max_connections for the RDS DB instance. Range: 1–100. |
number |
100 |
no |
| max_idle_connections_percent |
Controls how actively the proxy closes idle database connections in the connection pool. Range: 0–100. |
number |
50 |
no |
| connection_borrow_timeout |
Number of seconds the proxy waits for a connection from the pool before returning a timeout error. Range: 1–3600. |
number |
120 |
no |
| init_query |
One or more SQL statements for the proxy to run when opening each new DB connection. Typically used for SET statements. |
string |
null |
no |
| session_pinning_filters |
List of conditions that cause the proxy to pin a session to a specific DB connection. Supported value: EXCLUDE_VARIABLE_SETS. |
list(string) |
[] |
no |
| create_endpoint |
Whether to create the custom proxy endpoint resources defined in custom_endpoint. |
bool |
true |
no |
| custom_endpoint |
Map of custom proxy endpoints to create. Each key is used as the endpoint name unless overridden by the name field. Each entry supports: name (optional), vpc_subnet_ids, vpc_security_group_ids (optional), target_role (READ_WRITE or READ_ONLY, optional). |
map(object({
name = optional(string, null)
vpc_subnet_ids = list(string)
vpc_security_group_ids = optional(list(string), [])
target_role = optional(string, "READ_WRITE")
})) |
{} |
no |
| region |
AWS region to create the proxy endpoint in. Required when creating custom endpoints. |
string |
"us-west-2" |
no |
| tags |
Map of tags to apply to all resources created by the module. |
map(string) |
{} |
no |