aws_rds_cluster_instance should support setting custom security groups

[zuc]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Currently there's no way to set custom security groups for individual RDS/Aurora cluster instances. Only cluster-wide SG associations are possible.

We could add vpc_security_group_ids property also to aws_rds_cluster_instance resources in order to allow more granular security control over cluster instances (see example below).

New or Affected Resource(s)

• aws_rds_cluster_instance

Potential Terraform Configuration

resource "aws_rds_cluster_instance" "cluster_instances" {
  count                  = 2
  identifier             = "instance-${count.index}"
  cluster_identifier     = aws_rds_cluster.default.id
  instance_class         = "db.r4.large"
  vpc_security_group_ids = [] # No additional SGs for these instances
}

resource "aws_rds_cluster_instance" "cluster_instances_apps" {
  count                  = 3
  identifier             = "apps-instance-${count.index}"
  cluster_identifier     = aws_rds_cluster.default.id
  instance_class         = "db.r4.large"
  vpc_security_group_ids = [aws_security_group.sg_apps_rds.id]
}

resource "aws_rds_cluster" "default" {
  cluster_identifier     = "aurora-cluster-demo"
  availability_zones     = ["us-west-2a", "us-west-2b", "us-west-2c"]
  database_name          = "mydb"
  master_username        = "foo"
  master_password        = "barbut8chars"
  vpc_security_group_ids = [aws_security_group.sg_admins.id] # All cluster instances will inherit these SGs
}

resource "aws_security_group" "sg_admins" {
  name        = "rds_sg_admins"
  description = "Admins SG"
  vpc_id      = aws_vpc.my_vpc.id

  ingress {
    description = "Access everything from admins VPN"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = "10.254.0.0/24"
  }
}

resource "aws_security_group" "sg_apps_rds" {
  name        = "rds_sg_apps"
  description = "SG Apps"
  vpc_id      = aws_vpc.my_vpc.id

  ingress {
    description = "Access 3306/TCP from app subnets"
    from_port   = 3306
    to_port     = 3306
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/24", "10.0.1.0/24", "10.0.2.0/24"]
  }
}

References

• https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Overview.RDSSecurityGroups.html

[github-actions[bot]]

Marking this issue as stale due to inactivity. This helps our maintainers find and focus on the active issues. If this issue receives no comments in the next 30 days it will automatically be closed. Maintainers can also remove the stale label.

If this issue was automatically closed and you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thank you!

[github-actions[bot]]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.