# AWS with Terraform Tutorial: AWS RDS Instances (13) > Using the Terraform aws_db_instance resource block to configure, launch, and secure RDS instances. - Source: https://www.itwonderlab.com/aws-terraform-tutorial-aws-rds/ - Published: 2024-03-19 - Updated: 2026-10-05 - Author: Javier Ruiz Jiménez (https://www.javierruizjimenez.com/) - Site: IT Wonder Lab (https://www.itwonderlab.com/) --- ## How to create Amazon Relational Database Service (RDS) Instances with Terraform **Using the Terraform `aws_db_instance` resource block to configure, launch, and secure RDS instances.** Welcome to our tutorial series where we dive into cloud infrastructure deployment using **[Terraform or OpenTofu on AWS](https://www.itwonderlab.com/tag/aws-terraform-essential-guide/)**. In this series, the fundamentals are shown, guiding you through the process of minimizing resource usage and simplifying the deployment complexities associated with cloud infrastructure. This comprehensive **OpenTofu and Terraform tutorial** guides you step-by-step through creating infrastructure in AWS using Terraform. ![Terraform Basics, AWS Basics, Terraform AWS Provider, AWS VPC, AWS Subnets, AWS Internet Gateway, AWS NAT Gateway, AWS Routing Tables, AWS Security Groups, AWS Key Pairs, AWS AMIs, AWS EC2 Instances, AWS RDS, AWS Route 53 (DNS), AWS Auto Scaling, AWS Load Balancers, Terraform AWS & Ansible, Terraform Modules, Terraform Backends, Terraform Tools, Terraform CI/CD.](https://www.itwonderlab.com/media/tutorials/AWS-Terraform-Essentials/ITWL-Tutorials-AWS-Terraform-Essentials-Steps.svg) Infrastructure as Code (IaC) helps maintain consistency, enables version control, enhances collaboration among teams, allows for easier replication of environments, streamlines the deployment and management of infrastructure boosting efficiency, and reducing errors in managing complex systems. ### Prerequisites Read the previous sections of the tutorial, listed in the [series index](#series) at the end of this page. ### AWS RDS [Amazon RDS (Relational Database Service)](https://www.itwonderlab.com/aws-rds/) is a cloud-based service offered by Amazon Web Services (AWS) that simplifies the setup, operation, and scaling of relational databases such as MySQL, PostgreSQL, SQL Server, Oracle, and MariaDB and Amazon Aurora. It provides features like automated backups, high availability, and scalability, making it easier for developers to manage their databases without worrying about the underlying infrastructure. ![Amazon RDS in a VPC: the web servers reach the primary database in a private subnet, RDS replicates synchronously to a standby in another Availability Zone, and the password is stored in Secrets Manager](https://www.itwonderlab.com/media/tutorials/AWS-Terraform-Essentials/ITWL-AWS-Terraform-RDS-Multi-AZ.svg "RDS with a Multi-AZ standby, Secrets Manager and KMS") RDS instances require an RDS Subnet (called a *DB subnet group* in AWS) that includes at least two availability zones for redundancy and to enable Multi-AZ deployments and database maintenance operations (upgrades), a security rule, and optionally a KMS Key for RDS credentials. #### Connectivity Diagrams Security should be taken as a priority when designing any infrastructure. Databases should be placed in private subnets and have limited exposure through [security groups](https://www.itwonderlab.com/aws-security-groups/) that deny all inbound traffic except the one originating from the back-end server `ditwl-ec-back-end-123`. ![AWS Terraform Essentials Security Groups RDS Design](https://www.itwonderlab.com/media/tutorials/AWS-Terraform-Essentials/ITWL-Tutorials-AWS-Terraform-Essentials-Security-Groups-RDS-Design_4.svg) ### Definition of RDS Instances with Terraform Previous sections of this [AWS with Terraform guide](https://www.itwonderlab.com/tag/aws-terraform-essential-guide/) have covered basic information about Terraform and AWS and have configured and used the AWS Terraform provider to create a VPC, four subnets, one Internet Gateway, two NAT Gateways, three Routing Tables, Security Groups, and a Private Key. Add the following blocks to the `terraform-aws-tutorial.tf` created in previous sections. #### RDS Subnet: ditwl-dbsng-zab-pro-pri An RDS Subnet expanding private subnets: `ditwl-sn-za-pro-pri-02` and `ditwl-sn-zb-pro-pri-06` providing: - **High Availability**: Deploying RDS instances across multiple subnets ensures high availability by distributing the instances across different availability zones (AZs). In case of failures in one AZ, the instances in the other AZs remain operational, minimizing downtime. - **Fault Tolerance**: Having RDS instances in multiple subnets increases fault tolerance. If one subnet or availability zone experiences issues such as network failures or hardware problems, the RDS instances in other subnets can continue to operate normally. - **Maintenance and failover**: with subnets in at least two availability zones, RDS can place the standby replica of a Multi-AZ deployment in a different zone, and recover the database in another zone if a zone is lost. RDS Subnets are created using terraform resource block `aws_db_subnet_group`. ```hcl # Subnet group for the RDS service resource "aws_db_subnet_group" "ditwl-dbsng-zab-pro-pri" { name = "ditwl-dbsng-zab-pro-pri" subnet_ids = [aws_subnet.ditwl-sn-za-pro-pri-02.id, aws_subnet.ditwl-sn-zb-pro-pri-06.id] } ``` #### Security group: ditwl-sg-rds-001 A security group for the RDS Instances. It enables inbound connectivity only from the back-end server `ditwl-ec-back-end-123`. Security Groups for RDS are created the same way as for EC2, using terraform resource blocks `aws_security_group` and `aws_security_group_rule`. ```hcl # Create a Security Group for the RDS Instances resource "aws_security_group" "ditwl-sg-rds-001" { name = "ditwl-sg-rds-001" vpc_id = aws_vpc.ditlw-vpc.id description = "RDS Instance Security" } # Allow access from the back-end to port TCP 3306 (MariaDb) resource "aws_security_group_rule" "ditwl-sr-back-end-to-db" { security_group_id = aws_security_group.ditwl-sg-back-end.id type = "ingress" from_port = 3306 to_port = 3306 protocol = "tcp" source_security_group_id = aws_security_group.ditwl-sg-back-end.id description = "Allow access from the back-end to port TCP 3306 (MariaDb)" } ``` #### KMS Key: ditwl-kmsalias-rds-001-key With `manage_master_user_password = true`, RDS generates a secure random password for the administrator, stores it in [AWS Secrets Manager](https://www.itwonderlab.com/aws-secrets-manager/) and rotates it periodically, which reduces the risk of unauthorized access and keeps the password out of the Terraform code and state. The secret is encrypted with an [AWS Key Management Service (KMS)](https://www.itwonderlab.com/aws-kms/) key, which can be the default AWS managed key or a key created for the database. KMS Keys are created using the Terraform resource block `aws_kms_key`, an alias can be specified to give an easy-to-remember name using the Terraform resource block `aws_kms_alias`. ```hcl # KMS Secrets Manager resource "aws_kms_key" "ditwl-kms-rds-001-key" { description = "RDS ditwl-rds-001 Key" tags = { "Name" = "ditwl-kms-rds-001-key" } } # KMS Alias resource "aws_kms_alias" "ditwl-kmsalias-rds-001-key" { name = "alias/ditwl-kms-rds-001-key" target_key_id = aws_kms_key.ditwl-kms-rds-001-key.key_id } ``` **RDS Instance/s: ditwl-rds-001** RDS Instances are available for multiple database engines and instance classes. Additionally, it can be configured in Multi-AZ deployment where at least 2 instances are deployed in different availability zones and its data is replicated automatically. Multi-AZ maintains a primary node and a standby instance with automatic database failover that typically takes one to two minutes. A more advanced configuration (Multi-AZ DB cluster) has two readable standby instances and a failover of about 35 seconds. > [!WARNING] > The example uses `skip_final_snapshot = true` and `backup_retention_period = 0` to make the demo cheap and easy to destroy. For a production database keep automated backups, take a final snapshot when the database is deleted and set `deletion_protection = true` (see [How to disable AWS instance destroy with Terraform](https://www.itwonderlab.com/avoiding-instance-destroy-aws-with-terraform/)). RDS Instances are created using the Terraform resource block `aws_db_instance`. ```hcl # RDS (Database) resource "aws_db_instance" "ditwl-rds-001" { identifier = "ditwl-rds-001" engine = "mariadb" //oracle-ee db_name = "ditwldb01" //The name of the database to create allocated_storage = 20 instance_class = "db.t4g.micro" //2vCPU 1G Mem (Burstable Graviton2 Processor 64-bit Arm) db_subnet_group_name = "ditwl-dbsng-zab-pro-pri" username = "admin" manage_master_user_password = true master_user_secret_kms_key_id = aws_kms_key.ditwl-kms-rds-001-key.key_id skip_final_snapshot = true backup_retention_period = 0 depends_on = [ aws_db_subnet_group.ditwl-dbsng-zab-pro-pri ] } ``` ### Run the Terraform Plan Open a command line shell in the directory where the file `terraform-aws-tutorial.tf` is located, and run the Terraform or OpenTofu `plan` and `apply` commands. #### Plan using OpenTofu Run `tofu plan` to generate and review the execution plan. Check each line and value to make sure that it corresponds to the desired change. Terraform will refresh the state by comparing it with the Cloud resources and produce a plan for the resources that need to be created, updated, or destroyed. In the previous section of the tutorial, some resources were commented out to reduce the infrastructure cost during development. The RDS instances have dependencies with some previous resources, please uncomment all resources to proceed with the Terraform plan. Run the Terraform plan: ```shell $ tofu plan data.aws_ami.ubuntu-23-04-arm64-minimal: Reading... ... aws_main_route_table_association.ditwl-rta-default: Refreshing state... [id=rtbassoc-09cc07db0cbfb0a7a] OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create OpenTofu will perform the following actions: # aws_db_instance.ditwl-rds-001 will be created + resource "aws_db_instance" "ditwl-rds-001" { + allocated_storage = 20 + db_name = "ditwldb01" + db_subnet_group_name = "ditwl-dbsng-zab-pro-pri" + engine = "mariadb" + identifier = "ditwl-rds-001" + instance_class = "db.t4g.micro" + manage_master_user_password = true ... + tags_all = { + "cost_center" = "marketing-department" + "environment" = "pro" + "owner" = "IT Wonder Lab" } + timezone = (known after apply) + username = "admin" + vpc_security_group_ids = (known after apply) } # aws_db_subnet_group.ditwl-dbsng-zab-pro-pri will be created + resource "aws_db_subnet_group" "ditwl-dbsng-zab-pro-pri" { + name = "ditwl-dbsng-zab-pro-pri" + subnet_ids = [ + "subnet-006842d378df0ac09", + "subnet-06a52a222034e1007", ] ... } # aws_kms_alias.ditwl-kmsalias-rds-001-key will be created + resource "aws_kms_alias" "ditwl-kmsalias-rds-001-key" { + name = "alias/ditwl-kms-rds-001-key" } # aws_kms_key.ditwl-kms-rds-001-key will be created + resource "aws_kms_key" "ditwl-kms-rds-001-key" { + description = "RDS ditwl-rds-001 Key" + tags_all = { + "Name" = "ditwl-kms-rds-001-key" + "cost_center" = "marketing-department" + "environment" = "pro" + "owner" = "IT Wonder Lab" } } # aws_security_group.ditwl-sg-rds-001 will be created + resource "aws_security_group" "ditwl-sg-rds-001" { + arn = (known after apply) + description = "RDS Instance Security" + name = "ditwl-sg-rds-001" + tags_all = { + "cost_center" = "marketing-department" + "environment" = "pro" + "owner" = "IT Wonder Lab" } + vpc_id = "vpc-0b0b93490d844bd26" } # aws_security_group_rule.ditwl-sr-back-end-to-db will be created + resource "aws_security_group_rule" "ditwl-sr-back-end-to-db" { + description = "Allow access from the back-end to port TCP 3306 (MariaDb)" + from_port = 3306 + protocol = "tcp" + security_group_id = "sg-08c87b959de8e880f" + security_group_rule_id = (known after apply) + source_security_group_id = "sg-08c87b959de8e880f" + to_port = 3306 + type = "ingress" } Plan: 6 to add, 0 to change, 0 to destroy. ``` #### Apply the changes using OpenTofu Run `tofu apply` to generate and **apply** the execution plan. OpenTofu will generate a new plan and ask for confirmation before applying the changes. Review the changes and answer yes or no to apply the changes in AWS. ```shell $ tofu apply data.aws_ami.ubuntu-23-04-arm64-minimal: Reading... ... aws_main_route_table_association.ditwl-rta-default: Refreshing state... [id=rtbassoc-09cc07db0cbfb0a7a] OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create OpenTofu will perform the following actions: # aws_db_instance.ditwl-rds-001 will be created + resource "aws_db_instance" "ditwl-rds-001" { ... } # aws_db_subnet_group.ditwl-dbsng-zab-pro-pri will be created + resource "aws_db_subnet_group" "ditwl-dbsng-zab-pro-pri" { ... } # aws_kms_alias.ditwl-kmsalias-rds-001-key will be created + resource "aws_kms_alias" "ditwl-kmsalias-rds-001-key" { ... } # aws_kms_key.ditwl-kms-rds-001-key will be created + resource "aws_kms_key" "ditwl-kms-rds-001-key" { ... } # aws_security_group.ditwl-sg-rds-001 will be created + resource "aws_security_group" "ditwl-sg-rds-001" { ... } # aws_security_group_rule.ditwl-sr-back-end-to-db will be created + resource "aws_security_group_rule" "ditwl-sr-back-end-to-db" { ... } Plan: 6 to add, 0 to change, 0 to destroy. Do you want to perform these actions? OpenTofu will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes aws_security_group_rule.ditwl-sr-back-end-to-db: Creating... aws_kms_key.ditwl-kms-rds-001-key: Creating... aws_db_subnet_group.ditwl-dbsng-zab-pro-pri: Creating... aws_security_group.ditwl-sg-rds-001: Creating... aws_security_group_rule.ditwl-sr-back-end-to-db: Creation complete after 2s [id=sgrule-3481528461] aws_db_subnet_group.ditwl-dbsng-zab-pro-pri: Creation complete after 3s [id=ditwl-dbsng-zab-pro-pri] aws_security_group.ditwl-sg-rds-001: Creation complete after 5s [id=sg-0beca4086969e7711] aws_kms_key.ditwl-kms-rds-001-key: Creation complete after 8s [id=85140d6a-5030-4408-90d0-e8fe73218960] aws_kms_alias.ditwl-kmsalias-rds-001-key: Creating... aws_db_instance.ditwl-rds-001: Creating... aws_kms_alias.ditwl-kmsalias-rds-001-key: Creation complete after 0s [id=alias/ditwl-kms-rds-001-key] aws_db_instance.ditwl-rds-001: Still creating... [10s elapsed] ... aws_db_instance.ditwl-rds-001: Still creating... [3m50s elapsed] aws_db_instance.ditwl-rds-001: Creation complete after 3m52s [id=db-5YYLZZV5SR65HM2GAWM3YRXOQM] Apply complete! Resources: 6 added, 0 changed, 0 destroyed ``` Review the result, it should be 6 (resource) added, 0 changed, and 0 destroyed. You can check that the RDS instance has been created in the AWS Console. Navigate to [AWS Console: RDS databases](https://us-east-1.console.aws.amazon.com/rds/home?region=us-east-1#databases:). ![RDS us east](https://www.itwonderlab.com/media/tutorials/AWS-Terraform-Essentials/RDS-us-east-1-730x1024.png) Access the RDS admin password using the [AWS Console: AWS Secrets Manager: Secrets](https://us-east-1.console.aws.amazon.com/secretsmanager/listsecrets?region=us-east-1). ![rds db Secrets Manager Secrets Manager us east](https://www.itwonderlab.com/media/tutorials/AWS-Terraform-Essentials/rds-db-Secrets-Manager-Secrets-Manager-us-east-1-1024x996.png) #### Accessing the Database The RDS database instances are located in private subnets that don’t give public IP addresses to their instances. Accessing private RDS instances requires a VPN (Site-to-Site VPN, Direct Connect) or a bastion instance. [AWS Systems Manager Session Manager](https://www.itwonderlab.com/aws-systems-manager/) can forward a local port to the database through an instance, without opening any inbound port. #### Destroy the infrastructure using OpenTofu AWS will bill the time that the infrastructure is running. To reduce the cost during Terraform development or when the infrastructure is not needed anymore `terraform destroy` will be used. Terraform destroy terminates all the resources created by the plan. Run `tofu destroy` to generate and **apply** the destruction plan. OpenTofu will generate a new plan with the resources to terminate and ask for confirmation before applying the changes. **All data will be lost but you will be able to recreate the infrastructure when needed using tofu apply**. ```yaml $ tofu destroy ... aws_subnet.ditwl-sn-za-pro-pri-02: Destroying... [id=subnet-06a52a222034e1007] aws_kms_key.ditwl-kms-rds-001-key: Destruction complete after 1s aws_subnet.ditwl-sn-za-pro-pri-02: Destruction complete after 2s aws_subnet.ditwl-sn-zb-pro-pri-06: Destruction complete after 2s aws_vpc.ditlw-vpc: Destroying... [id=vpc-0b0b93490d844bd26] aws_vpc.ditlw-vpc: Destruction complete after 3s Destroy complete! ``` ### AWS RDS Cost RDS instances have different prices depending on their type, region, purchase model (on-demand, saving plan, or spot), and Multi-AZ configuration. Check [Amazon RDS Pricing](https://aws.amazon.com/rds/pricing/). ### Common Questions About AWS RDS #### Can Terraform manage RDS backups and maintenance? Yes, Terraform can manage RDS backups and maintenance. Automated backups and retention period (`backup_retention_period`) can be configured using Terraform. A configurable maintenance window controls when maintenance tasks, such as updates and patching, occur on the RDS instances. #### Is it possible to modify existing RDS instances with Terraform? Terraform allows you to modify existing RDS instances by updating the corresponding resource blocks in the Terraform configuration file. Some changes require RDS Instance destruction, other parameters can be applied without destroying the databases. #### What are the advantages of using Terraform with AWS RDS? Using Terraform with AWS RDS offers several advantages, including: - **Infrastructure as code**: Define and manage RDS resources using version-controlled configuration files. - **Automation**: Easily provision, modify, and tear down RDS instances and associated resources programmatically. - **Consistency**: Ensure consistency across environments by deploying RDS instances using the same configuration every time. - **Collaboration**: Enable teams to collaborate on infrastructure changes using Terraform configuration files stored in a shared repository. ### Next Steps Continue with [AWS Route 53 (DNS)](https://www.itwonderlab.com/aws-with-terraform-tutorial-aws-route-53/), or see the [full series index](#series).