AWS Amazon RDS Instance Role Association
This page shows how to write Terraform and CloudFormation for Amazon RDS Instance Role Association and write them securely.
aws_db_instance_role_association (Terraform)
The Instance Role Association in Amazon RDS can be configured in Terraform with the resource name aws_db_instance_role_association
. The following sections describe 5 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "aws_db_instance_role_association" "instance_role_association" {
count = length(var.instance_role_association)
db_instance_identifier = element(var.db_instance_identifier, lookup(var.instance_role_association[count.index], "instance_id"))
feature_name = lookup(var.instance_role_association[count.index], "feature_name")
role_arn = element(var.role_arn, lookup(var.instance_role_association[count.index], "role_id"))
resource "aws_db_instance_role_association" "db_instance_role_association" {
count = var.enable_db_instance_role_association ? 1 : 0
db_instance_identifier = var.db_instance_role_association_db_instance_identifier != "" && ! var.enable_db_instance ? var.db_instance_role_association_db_instance_identifier : element(concat(aws_db_instance.db_instance.*.id, [""]), 0)
feature_name = var.db_instance_role_association_feature_name
role_arn = var.db_instance_role_association_role_arn
resource "aws_db_instance_role_association" "this" {
db_instance_identifier = var.db_instance_identifier
feature_name = var.feature_name
role_arn = var.role_arn
}
resource "aws_db_instance_role_association" "db_instance_role_association" {
count = var.enable_db_instance_role_association ? 1 : 0
db_instance_identifier = var.db_instance_role_association_db_instance_identifier != "" && !var.enable_db_instance ? var.db_instance_role_association_db_instance_identifier : element(concat(aws_db_instance.db_instance.*.id, [""]), 0)
feature_name = var.db_instance_role_association_feature_name
role_arn = var.db_instance_role_association_role_arn
resource "aws_db_instance_role_association" "db_instance_role_association" {
count = var.enable_db_instance_role_association ? 1 : 0
db_instance_identifier = var.db_instance_role_association_db_instance_identifier != "" && !var.enable_db_instance ? var.db_instance_role_association_db_instance_identifier : element(concat(aws_db_instance.db_instance.*.id, [""]), 0)
feature_name = var.db_instance_role_association_feature_name
role_arn = var.db_instance_role_association_role_arn
Parameters
-
db_instance_identifier
required - string -
feature_name
required - string -
id
optional computed - string -
role_arn
required - string
Explanation in Terraform Registry
Manages an RDS DB Instance association with an IAM Role. Example use cases:
- Amazon RDS Oracle integration with Amazon S3
- Importing Amazon S3 Data into an RDS PostgreSQL DB Instance -> To manage the RDS DB Instance IAM Role for Enhanced Monitoring, see the
aws_db_instance
resourcemonitoring_role_arn
argument instead.
Tips: Best Practices for The Other AWS Amazon RDS Resources
In addition to the aws_db_instance, AWS Amazon RDS has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
aws_db_instance
Ensure backup retension of your RDS instance is specified
It's better to set it explicitly to reduce the risk of availability issues.
aws_rds_cluster
Ensure backup retension of your RDS cluster is specified
It's better to set it explicitly to reduce the risk of availability issues.
aws_rds_cluster_instance
Ensure your RDS cluster instance blocks unwanted access
It's better to limit accessibily to the minimum that is required for the application to work.
AWS::RDS::DBInstance DBInstanceRole (CloudFormation)
The DBInstance DBInstanceRole in RDS can be configured in CloudFormation with the resource name AWS::RDS::DBInstance DBInstanceRole
. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
An example could not be found in GitHub.
Parameters
FeatureName
The name of the feature associated with the AWS Identity and Access Management (IAM) role. IAM roles that are associated with a DB instance grant permission for the DB instance to access other AWS services on your behalf. For the list of supported feature names, see the SupportedFeatureNames
description in DBEngineVersion in the Amazon RDS API Reference.
Required: Yes
Type: String
Update requires: No interruption
RoleArn
The Amazon Resource Name (ARN) of the IAM role that is associated with the DB instance.
Required: Yes
Type: String
Update requires: No interruption
Explanation in CloudFormation Registry
Describes an AWS Identity and Access Management (IAM) role that is associated with a DB instance.
Frequently asked questions
What is AWS Amazon RDS Instance Role Association?
AWS Amazon RDS Instance Role Association is a resource for Amazon RDS of Amazon Web Service. Settings can be wrote in Terraform and CloudFormation.
Where can I find the example code for the AWS Amazon RDS Instance Role Association?
For Terraform, the mikamakusa/terraform, SebastianUA/terraform-aws-rds and niveklabs/aws source code examples are useful. See the Terraform Example section for further details.