Migrate RDS

RDS database instance module with compliance controls for encryption at rest, backup retention, deletion protection, IAM authentication, CloudWatch logging, and public access restrictions. Encryption at rest may require a snapshot-restore cycle if not already enabled.

Minor Fixes · 15-30 minutes per instance

Before and After

The migration is a source URL change. Your arguments, outputs, and Terraform state remain the same.

PCI DSS v4.0

Before (terraform-aws-modules):

module "rds" {
  source  = "terraform-aws-modules/rds/aws"
  version = "~> 7.0"

  identifier = "my-app-db"

  engine         = "mysql"
  engine_version = "8.0"
  instance_class = "db.t3.micro"

  allocated_storage = 20
  db_name           = "myapp"
  username          = "dbadmin"

  tags = {
    Environment = "production"
  }
}

After (compliance.tf / PCI DSS v4.0):

module "rds" {
  source  = "pcidss.compliance.tf/terraform-aws-modules/rds/aws"
  version = "~> 7.0"

  identifier = "my-app-db"

  engine         = "mysql"
  engine_version = "8.0"
  instance_class = "db.t3.micro"

  allocated_storage = 20
  db_name           = "myapp"
  username          = "dbadmin"

  tags = {
    Environment = "production"
  }
}

SOC 2

Before (terraform-aws-modules):

module "rds" {
  source  = "terraform-aws-modules/rds/aws"
  version = "~> 7.0"

  identifier = "my-app-db"

  engine         = "mysql"
  engine_version = "8.0"
  instance_class = "db.t3.micro"

  allocated_storage = 20
  db_name           = "myapp"
  username          = "dbadmin"

  tags = {
    Environment = "production"
  }
}

After (compliance.tf / SOC 2):

module "rds" {
  source  = "soc2.compliance.tf/terraform-aws-modules/rds/aws"
  version = "~> 7.0"

  identifier = "my-app-db"

  engine         = "mysql"
  engine_version = "8.0"
  instance_class = "db.t3.micro"

  allocated_storage = 20
  db_name           = "myapp"
  username          = "dbadmin"

  tags = {
    Environment = "production"
  }
}

What Changes

• Source URL points to compliance.tf registry
• Compliance controls are enforced via validation rules
• terraform plan will fail if required controls are not satisfied

What Stays the Same

• All input variables (same interface as upstream terraform-aws-modules)
• All output values
• Resource addresses in Terraform state
• Provider configuration
• Version constraints

Step-by-Step Migration

1. Change the source URL in your module block to your framework subdomain
2. Run terraform init -upgrade to download the compliance.tf module
3. Run terraform plan to review changes. Expect a clean plan or validation errors for missing values
4. Fix validation errors if any (see Common Issues below)
5. Run terraform apply
6. Verify by checking .compliancetf-manifest.json in .terraform/modules/

Common Issues and Fixes

Version Compatibility

State Impact

No terraform state mv needed in typical cases. Resource addresses are unchanged because compliance.tf modules use the same internal resource structure as upstream. If a compliance control adds a new resource (rare), terraform plan will show the addition.

Controls Enforced

PCI DSS v4.0

• RDS DB instance automatic minor version upgrade should be enabled
• RDS DB instance backup should be enabled
• RDS DB instances backup retention period should be greater than or equal to 7
• RDS DB instances should be integrated with CloudWatch logs
• RDS DB instance encryption at rest should be enabled
• RDS DB instances should have iam authentication enabled
• RDS DB instances should have logging enabled
• RDS for MariaDB DB instances should publish logs to CloudWatch Logs
• RDS DB instances should not use public subnet
• RDS for PostgreSQL DB instances should publish logs to CloudWatch Logs
• RDS DB instances should prohibit public access
• RDS for SQL Server DB instances should publish logs to CloudWatch Logs

SOC 2

• RDS DB instance backup should be enabled
• RDS DB instances backup retention period should be greater than or equal to 7
• RDS DB instances should be integrated with CloudWatch logs
• RDS DB instances should be configured to copy tags to snapshots
• RDS DB instances should have deletion protection enabled
• RDS DB instance encryption at rest should be enabled
• RDS DB instances should have iam authentication enabled
• RDS DB instances should have logging enabled
• RDS for MariaDB DB instances should publish logs to CloudWatch Logs
• RDS DB instances should not use public subnet
• RDS for PostgreSQL DB instances should publish logs to CloudWatch Logs
• RDS DB instances should prohibit public access
• RDS for SQL Server DB instances should publish logs to CloudWatch Logs

Rollback

To revert, change the source URL back and re-initialize:

1. Change source back to "terraform-aws-modules/rds/aws"
2. Run terraform init -upgrade
3. Run terraform plan to confirm no resource changes
4. Compliance controls are no longer enforced, but existing configurations remain in place

Migration Guide · Compatibility · RDS Module