Terraform AWS RDS Aurora
Aurora clusters and instances with private subnet placement, storage encryption, automated backups, reader endpoints, IAM authentication, log exports, and multi AZ high availability.
Quick start
module "rds-aurora" {
source = "pcidss.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
# ... your arguments here
}module "rds-aurora" {
source = "iso27001.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
# ... your arguments here
}module "rds-aurora" {
source = "soc2.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
# ... your arguments here
}module "rds-aurora" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
# ... your arguments here
}module "rds-aurora" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
# ... your arguments here
}module "rds-aurora" {
source = "nis2.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
# ... your arguments here
}module "rds-aurora" {
source = "nist80053.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
# ... your arguments here
}module "rds-aurora" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
# ... your arguments here
}This module on the compliance.tf registry lists its versions, inputs and outputs. The Get Started guide and Registry Endpoints cover authentication and how to customize the module for your requirements.
Migration from upstream
Already using terraform-aws-modules? Change only the source URL:
module "rds-aurora" {
source = "terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
}module "rds-aurora" {
source = "soc2.compliance.tf/terraform-aws-modules/rds-aurora/aws"
version = "~> 10.4"
}Same arguments. Same outputs. Controls are checked at terraform plan. The Migration Guide has the step-by-step version.
Reversibility
No lock-in. Switch back by reverting the source URL:
module "rds-aurora" {
source = "terraform-aws-modules/rds-aurora/aws"
}Run terraform init -upgrade. Terraform state is unchanged: same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.
Controls enforced
Up to 16 controls are checked at terraform plan when this module comes from a compliance.tf endpoint. Which ones are active depends on the endpoint; see Framework coverage.
Mapped compliance frameworks
| Clause | Controls from this module |
|---|---|
| 1.3.1: Network access to and from the cardholder data environment is restricted. | |
| 1.3.2: Network access to and from the cardholder data environment is restricted. | |
| 10.3.2: Audit logs are protected from destruction and unauthorized modifications. | |
| 10.3.3: Audit log files, including those for externalfacing technologies, are promptly backed up to a secure, central, internal log server(s) or other media that is difficult to modify | |
| 10.3.4: File integrity monitoring or change-detection mechanisms is used on audit logs to ensure that existing log data cannot be changed without generating alerts | |
| 10.5.1: Retain audit log history for at least 12 months, with at least the most recent three months immediately available for analysis | |
| 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. | |
| 3.2.1: Storage of account data is kept to a minimum. | |
| 3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization. | |
| 3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization. | |
| 3.3.2: Sensitive authentication data (SAD) is not stored after authorization. | |
| 3.3.3: Sensitive authentication data (SAD) is not stored after authorization. | |
| 3.5.1: Primary account number (PAN) is secured wherever it is stored. | |
| 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. | |
| 7.2.1: Access to system components and data is appropriately defined and assigned. | |
| 7.2.2: Access to system components and data is appropriately defined and assigned. | |
| 7.2.5: Access to system components and data is appropriately defined and assigned. | |
| 7.3.1: Access to system components and data is managed via an access control system(s). | |
| 7.3.2: Access to system components and data is managed via an access control system(s). | |
| 7.3.3: Access to system components and data is managed via an access control system(s). | |
| 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. | |
| 8.2.8: If a user session has been idle for more than 15 minutes, the user is required to re-authenticate to re-activate the terminal or session | |
| 8.3.2: Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components | |
| 8.3.4: Strong authentication for users and administrators is established and managed. | |
| A1.2.3: Processes or mechanisms are implemented for reporting and addressing suspected or confirmed security incidents and vulnerabilities |
| Clause | Controls from this module |
|---|---|
| A.5.13 Labelling of information | |
| A.8.14 Redundancy of information processing facilities | |
| A.8.15 Logging | |
| A.8.16 Monitoring activities | |
| A.8.24 Use of cryptography |
| Clause | Controls from this module |
|---|---|
| C1.2 The entity disposes of confidential information to meet the entity's objectives related to confidentiality | |
| CC6.7 The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity's objectives | |
| CC7.2: The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events. | |
| CC7.3 The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures | |
| P4.2 The entity retains personal information consistent with the entity's objectives related to privacy | |
| PI1.4 System outputs are complete, accurate, distributed only to intended parties, and retained to meet the entity's processing integrity commitments and system requirements | |
| PI1.5 Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's processing integrity commitments and system requirements |
| Clause | Controls from this module |
|---|---|
| 11.10(c) Protection of records to enable their accurate and ready retrieval throughout the records retention period | |
| 11.10(d) Limiting system access to authorized individuals | |
| 11.10(e) Use of secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records | |
| 11.30 Controls for open systems |
| Clause | Controls from this module |
|---|---|
| 12.1 Security | |
| 17 Archiving | |
| 7.1 Data Storage - Damage Protection |
| Clause | Controls from this module |
|---|---|
| 1 Policy on the security of network and information systems | |
| 11 Access control | |
| 3 Incident handling | |
| 4 Business continuity and crisis management |
| Clause | Controls from this module |
|---|---|
| AC-16(b) | |
| AU-11(1) Long-Term Retrieval Capability | |
| AU-12(1) System-Wide And Time-Correlated Audit Trial | |
| AU-12(2) Standardized Formats | |
| AU-12(3) Changes By Authorized Individuals | |
| AU-14(a) | |
| AU-14(b) | |
| AU-6(3) Correlate Audit Record Repositories | |
| AU-6(4) Central Review And Analysis | |
| AU-6(6) Correletion With Physical Monitoring | |
| AU-6(9) Correletion With From Nontechnical Sources | |
| AU-9(3) Cryptographic Protection | |
| Audit Record Retention (AU-11) | |
| CA-7(b) | |
| CP-9(d) | |
| Continuous Monitoring Strategy (PM-31) | |
| Information Management and Retention (SI-12) | |
| Non-Repudiation (AU-10) | |
| PM-14(a)(1) | |
| PM-14(b) | |
| PM-21(b) | |
| SC-13(a) | |
| SC-28(1): Cryptographic Protection | |
| SC-28(2) Offline Storage | |
| SC-7(13): Isolation Of Security Tools, Mechanisms, And Support Components | |
| SC-7: Boundary Protection | |
| SC-8(3) Cryptographic Protection For Message Externals | |
| SC-8(4) Conceal Or Ramdomize Communications | |
| SI-19(4) Removal, Masking, Encryption, Hashing, Or Replacement Of Direct Identifiers | |
| SI-4(17) Integrated Situational Awareness |
| Clause | Controls from this module |
|---|---|
| AC-4: Information Flow Enforcement | |
| AU-6(1)(3) | |
| Audit Record Retention (AU-11) | |
| Information Handling and Retention (SI-12) | |
| Protection of Audit Information (AU-9) | |
| Protection of Information at Rest (SC-28) | |
| SC-7: Boundary Protection |
Framework coverage
Which controls from this module are active under each framework endpoint. Your framework preferences choose the columns.
Known Terraform limitations
Separately from the controls above, some things people ask this module for cannot be implemented by any module in any registry: they are limits of Terraform itself. Known limitations for this module lists the recurring ones: what causes each, the native workaround in full, and, where one exists, the opt-in Operational Rule that removes the need for a fork.
16 controls enforced with a source URL change.