# rds-postgres

Creates an RDS PostgreSQL instance with Multi-AZ, KMS encryption, enhanced monitoring, read replicas, and RDS-managed master password.

Provisions an encrypted PostgreSQL RDS instance with gp3 storage autoscaling, a custom parameter group, Multi-AZ standby, automated backup, enhanced monitoring, Performance Insights, and optional read replicas. The master password can be managed by RDS and rotated automatically in Secrets Manager.

## Usage

```hcl
module "rds" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/database/rds-postgres/aws"
  version = "0.1.0"

  identifier         = "prod-postgres"
  db_name            = "appdb"
  subnet_ids         = module.vpc.isolated_subnet_id_list
  security_group_ids = [module.security_groups.ids["rds"]]
  kms_key_id         = module.kms.key_arn

  read_replicas = {
    ro1 = "db.t3.medium"
  }
}
```

<!-- BEGIN_TF_DOCS — DO NOT EDIT BELOW THIS LINE -->
## Requirements

| Name | Version |
| ---- | ------- |
| <a name="requirement_terraform"></a> [terraform](#requirement_terraform) | ~> 1.5 |
| <a name="requirement_aws"></a> [aws](#requirement_aws) | ~> 6.50 |

## Providers

| Name | Version |
| ---- | ------- |
| <a name="provider_aws"></a> [aws](#provider_aws) | 6.50.0 |

## Resources

| Name | Type |
| ---- | ---- |
| [aws_db_instance.replica](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance) | resource |
| [aws_db_instance.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance) | resource |
| [aws_db_parameter_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_parameter_group) | resource |
| [aws_db_subnet_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_subnet_group) | resource |

## Inputs

| Name | Description | Type | Default | Required |
| ---- | ----------- | ---- | ------- | :------: |
| <a name="input_db_name"></a> [db_name](#input_db_name) | Initial database name | `string` | n/a | yes |
| <a name="input_identifier"></a> [identifier](#input_identifier) | RDS instance identifier | `string` | n/a | yes |
| <a name="input_security_group_ids"></a> [security_group_ids](#input_security_group_ids) | Security group IDs for the RDS instance | `list(string)` | n/a | yes |
| <a name="input_allocated_storage"></a> [allocated_storage](#input_allocated_storage) | Initial allocated storage in GiB | `number` | `20` | no |
| <a name="input_backup_retention_period"></a> [backup_retention_period](#input_backup_retention_period) | Days to retain automated backups | `number` | `7` | no |
| <a name="input_backup_window"></a> [backup_window](#input_backup_window) | Preferred backup window (UTC) | `string` | `"03:00-04:00"` | no |
| <a name="input_deletion_protection"></a> [deletion_protection](#input_deletion_protection) | Enable deletion protection | `bool` | `true` | no |
| <a name="input_engine_version"></a> [engine_version](#input_engine_version) | PostgreSQL engine version | `string` | `"16.3"` | no |
| <a name="input_instance_class"></a> [instance_class](#input_instance_class) | RDS instance class | `string` | `"db.t3.medium"` | no |
| <a name="input_kms_key_id"></a> [kms_key_id](#input_kms_key_id) | KMS key ARN for storage encryption | `string` | `null` | no |
| <a name="input_maintenance_window"></a> [maintenance_window](#input_maintenance_window) | Preferred maintenance window | `string` | `"sun:05:00-sun:06:00"` | no |
| <a name="input_manage_master_user_password"></a> [manage_master_user_password](#input_manage_master_user_password) | Let RDS manage the master password in Secrets Manager | `bool` | `true` | no |
| <a name="input_max_allocated_storage"></a> [max_allocated_storage](#input_max_allocated_storage) | Maximum storage for autoscaling (0 disables) | `number` | `100` | no |
| <a name="input_monitoring_interval"></a> [monitoring_interval](#input_monitoring_interval) | Enhanced monitoring interval in seconds (0 disables) | `number` | `60` | no |
| <a name="input_multi_az"></a> [multi_az](#input_multi_az) | Enable Multi-AZ deployment | `bool` | `true` | no |
| <a name="input_parameter_group_family"></a> [parameter_group_family](#input_parameter_group_family) | DB parameter group family | `string` | `"postgres16"` | no |
| <a name="input_parameters"></a> [parameters](#input_parameters) | Map of DB parameter names to values | `map(string)` | `{}` | no |
| <a name="input_password"></a> [password](#input_password) | Master password (ignored when manage_master_user_password = true) | `string` | `null` | no |
| <a name="input_performance_insights_enabled"></a> [performance_insights_enabled](#input_performance_insights_enabled) | Enable Performance Insights | `bool` | `true` | no |
| <a name="input_performance_insights_kms_key_id"></a> [performance_insights_kms_key_id](#input_performance_insights_kms_key_id) | KMS key for Performance Insights encryption | `string` | `null` | no |
| <a name="input_read_replicas"></a> [read_replicas](#input_read_replicas) | Map of read replica logical names to instance class | `map(string)` | `{}` | no |
| <a name="input_skip_final_snapshot"></a> [skip_final_snapshot](#input_skip_final_snapshot) | Skip final snapshot on deletion | `bool` | `false` | no |
| <a name="input_subnet_group_name"></a> [subnet_group_name](#input_subnet_group_name) | DB subnet group name (created when subnet_ids is provided) | `string` | `null` | no |
| <a name="input_subnet_ids"></a> [subnet_ids](#input_subnet_ids) | Subnet IDs for the DB subnet group | `list(string)` | `[]` | no |
| <a name="input_tags"></a> [tags](#input_tags) | Resource tags to apply to all resources | `map(string)` | `{}` | no |
| <a name="input_username"></a> [username](#input_username) | Master username | `string` | `"postgres"` | no |

## Outputs

| Name | Description |
| ---- | ----------- |
| <a name="output_address"></a> [address](#output_address) | RDS instance hostname |
| <a name="output_arn"></a> [arn](#output_arn) | RDS instance ARN |
| <a name="output_db_name"></a> [db_name](#output_db_name) | Initial database name |
| <a name="output_endpoint"></a> [endpoint](#output_endpoint) | RDS instance connection endpoint |
| <a name="output_id"></a> [id](#output_id) | RDS instance identifier |
| <a name="output_master_user_secret_arn"></a> [master_user_secret_arn](#output_master_user_secret_arn) | Secrets Manager secret ARN for the master password (when manage_master_user_password = true) |
| <a name="output_port"></a> [port](#output_port) | RDS instance port |
| <a name="output_replica_endpoints"></a> [replica_endpoints](#output_replica_endpoints) | Map of replica logical key to endpoint |
<!-- END_TF_DOCS — DO NOT EDIT ABOVE THIS LINE -->