Jon Chery
a9d8b31595
Add modules/l1/rds/ with interface.json (engine enum for postgres, mysql, mariadb, sqlserver, oracle), instance.json, README.md (full template with compliance extension points). Register in registry.json. Expand the adapter TYPE_MAP/INPUT_MAP/OUTPUT_MAP for aws:rds:instance -> aws_db_instance; emit backup_retention_period, deletion_protection, storage_encrypted, and skip_final_snapshot from NFRs/inputs. Add RDS to the primitives-plan matrix. Update tests for the new registry entry count (12) + RDS adapter emission. ---ci--- project: acdl phase: 27 milestone: v1.7 status: execute ---/ci---
94 lines
3.5 KiB
Markdown
94 lines
3.5 KiB
Markdown
# rds — RDS database instance
|
|
|
|
> **Module kind:** primitive | **Version:** 1.0.0
|
|
|
|
An RDS database instance. Supports multiple database engines (postgres,
|
|
mysql, mariadb, sqlserver, oracle) via the `engine` input. The adapter
|
|
translates the substrate-agnostic `aws:rds:instance` stack type to the
|
|
Terraform `aws_db_instance` resource.
|
|
|
|
## Resources
|
|
|
|
| Resource | Type | Purpose |
|
|
|----------|------|---------|
|
|
| `rds` | `aws_db_instance` | The RDS database instance |
|
|
|
|
## Inputs
|
|
|
|
| Name | Type | Required | Default | Description |
|
|
|------|------|----------|---------|-------------|
|
|
| `engine` | string | yes | — | Database engine (postgres, mysql, mariadb, sqlserver-ex, sqlserver-web, sqlserver-se, oracle-se2) |
|
|
| `engine_version` | string | yes | — | Engine version (e.g. 16.4 for postgres, 8.4 for mysql) |
|
|
| `instance_class` | string | yes | `db.t3.micro` | RDS instance class (e.g. db.t3.micro, db.r6g.large) |
|
|
| `allocated_storage` | number | no | 20 | Allocated storage in GB |
|
|
| `db_name` | string | yes | — | The database name (some engines have restrictions) |
|
|
| `username` | string | yes | — | Master username |
|
|
| `multi_az` | boolean | no | false | Multi-AZ deployment |
|
|
| `storage_encrypted` | boolean | no | true | Enable storage encryption |
|
|
| `region` | string | yes | — | AWS region the RDS instance is created in |
|
|
|
|
## Outputs
|
|
|
|
| Name | Type | Description |
|
|
|------|------|-------------|
|
|
| `db_endpoint` | string | The RDS instance endpoint (host:port) |
|
|
| `db_arn` | arn | The RDS instance ARN |
|
|
|
|
## NFRs
|
|
|
|
| Name | Type | Default | Description |
|
|
|------|------|---------|-------------|
|
|
| `backup_retention_period` | number | 7 | Backup retention period in days |
|
|
| `deletion_protection` | boolean | true | Enable deletion protection (default true for prod) |
|
|
|
|
## Usage
|
|
|
|
```json
|
|
{
|
|
"id": "rds",
|
|
"type": "aws:rds:instance",
|
|
"module": "rds@1.0.0",
|
|
"inputs": {
|
|
"engine": "postgres",
|
|
"engine_version": "16.4",
|
|
"instance_class": "db.t3.micro",
|
|
"allocated_storage": 20,
|
|
"db_name": "acdl_db",
|
|
"username": "acdl_admin",
|
|
"multi_az": false,
|
|
"storage_encrypted": true,
|
|
"region": "us-east-1"
|
|
},
|
|
"nfrs": {
|
|
"backup_retention_period": 7,
|
|
"deletion_protection": true
|
|
}
|
|
}
|
|
```
|
|
|
|
A concrete instance is at `instance.json` (used by the platform pipeline
|
|
as the regression baseline).
|
|
|
|
## Compliance extension points
|
|
|
|
- **KMS encryption** — add a customer-managed KMS key for storage
|
|
encryption (`kms_key_id` argument) (SOC2 CC6.1, HIPAA §164.312(a)(2)(iv),
|
|
GDPR Art.32).
|
|
- **Automated backups** — the `backup_retention_period` NFR controls
|
|
automated backup retention; extend with backup windows + copy tags to
|
|
another region for DR (SOX ITGC, DORA operational resilience).
|
|
- **Audit logging via CloudTrail** — RDS does not emit CloudTrail events
|
|
for data-plane access; add `aws_db_instance_automated_backups_replication`
|
|
+ CloudWatch Logs for database audit (SOX, SOC2 CC7.2, HIPAA
|
|
§164.312(b)).
|
|
- **IAM database authentication** — add `iam_database_authentication_enabled
|
|
= true` so IAM users/roles can authenticate to the database without
|
|
long-lived passwords (SOC2 CC6.1, HIPAA §164.308(a)(4)).
|
|
- **Read replicas** — add `aws_db_instance` with `replicate_source_db` for
|
|
read scaling and DR failover (SOC2 CC9.1, DORA operational resilience).
|
|
|
|
## Versioning
|
|
|
|
`1.0.0` — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps
|
|
require a new registry entry (immutable publication); old entries enter
|
|
a 12-month deprecation window. |