Terraform AWS RDS Aurora

Aurora clusters and instances with private subnet placement, storage encryption, automated backups, reader endpoints, IAM authentication, log exports, and multi AZ high availability.

Controls enforced

These compliance controls are checked at terraform plan time.

RDS Aurora clusters should have backtracking enabled(low effort)
Aurora MySQL DB clusters should have audit logging enabled(low effort)
Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs(low effort)
RDS DB clusters should have automatic minor version upgrade enabled(low effort)
RDS DB clusters should be configured to copy tags to snapshots(low effort)
RDS clusters should have deletion protection enabled(low effort)
RDS DB clusters should be encrypted with CMK(low effort)
RDS DB clusters should be encrypted at rest(low effort)
RDS DB clusters should have IAM authentication configured(low effort)
RDS DB clusters should be configured for multiple Availability Zones(low effort)
RDS database clusters should use a custom administrator username(low effort)
RDS Aurora cluster parameter groups should require TLS for client connections

Quick start

module "rds-aurora" {
  source  = "pcidss.compliance.tf/terraform-aws-modules/rds-aurora/aws"
  version = ">= 10.0.0, < 11.0.0"

  # ... your arguments here
}

module "rds-aurora" {
  source  = "iso27001.compliance.tf/terraform-aws-modules/rds-aurora/aws"
  version = ">= 10.0.0, < 11.0.0"

  # ... your arguments here
}

module "rds-aurora" {
  source  = "soc2.compliance.tf/terraform-aws-modules/rds-aurora/aws"
  version = ">= 10.0.0, < 11.0.0"

  # ... your arguments here
}

module "rds-aurora" {
  source  = "cfrpart11.compliance.tf/terraform-aws-modules/rds-aurora/aws"
  version = ">= 10.0.0, < 11.0.0"

  # ... your arguments here
}

module "rds-aurora" {
  source  = "eugmpannex11.compliance.tf/terraform-aws-modules/rds-aurora/aws"
  version = ">= 10.0.0, < 11.0.0"

  # ... your arguments here
}

module "rds-aurora" {
  source  = "nis2.compliance.tf/terraform-aws-modules/rds-aurora/aws"
  version = ">= 10.0.0, < 11.0.0"

  # ... your arguments here
}

module "rds-aurora" {
  source  = "acscessentialeight.compliance.tf/terraform-aws-modules/rds-aurora/aws"
  version = ">= 10.0.0, < 11.0.0"

  # ... your arguments here
}

module "rds-aurora" {
  source  = "nistcsf.compliance.tf/terraform-aws-modules/rds-aurora/aws"
  version = ">= 10.0.0, < 11.0.0"

  # ... your arguments here
}

View this module on the compliance.tf registry — versions, inputs, and outputs →

See the Get Started guide and Registry Endpoints for details on how to customize the module for your requirements.

Migration from upstream

Already using terraform-aws-modules? Change only the source URL:

module "rds-aurora" {
  source  = "terraform-aws-modules/rds-aurora/aws"
  version = ">= 10.0.0, < 11.0.0"
}

module "rds-aurora" {
  source  = "soc2.compliance.tf/terraform-aws-modules/rds-aurora/aws"
  version = ">= 10.0.0, < 11.0.0"
}

Same arguments. Same outputs. Controls are checked at terraform plan. See the Migration Guide for step-by-step instructions.

Reversibility

No lock-in. Switch back by reverting the source URL:

module "rds-aurora" {
  source  = "terraform-aws-modules/rds-aurora/aws"
}

Run terraform init -upgrade. Terraform state is unchanged — same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.

Mapped compliance frameworks

10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.

Aurora MySQL DB clusters should have audit logging enabled

3.5.1: Primary account number (PAN) is secured wherever it is stored.

RDS DB clusters should be encrypted at rest

7.2.1: Access to system components and data is appropriately defined and assigned.

RDS DB clusters should have IAM authentication configured

7.2.2: Access to system components and data is appropriately defined and assigned.

RDS DB clusters should have IAM authentication configured

7.2.5: Access to system components and data is appropriately defined and assigned.

RDS DB clusters should have IAM authentication configured

7.3.1: Access to system components and data is managed via an access control system(s).

RDS DB clusters should have IAM authentication configured

7.3.2: Access to system components and data is managed via an access control system(s).

RDS DB clusters should have IAM authentication configured

7.3.3: Access to system components and data is managed via an access control system(s).

RDS DB clusters should have IAM authentication configured

8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.

RDS DB clusters should have IAM authentication configured

8.2.8: If a user session has been idle for more than 15 minutes, the user is required to re-authenticate to re-activate the terminal or session

RDS DB clusters should have IAM authentication configured

8.3.2: Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components

RDS DB clusters should be encrypted at rest

8.3.4: Strong authentication for users and administrators is established and managed.

RDS DB clusters should have IAM authentication configured

A.5.13 Labelling of information

RDS DB clusters should be configured to copy tags to snapshots

A.8.14 Redundancy of information processing facilities

RDS DB clusters should be configured for multiple Availability Zones

A.8.24 Use of cryptography

RDS DB clusters should be encrypted at rest

CC6.7 The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity's objectives

RDS Aurora cluster parameter groups should require TLS for client connections

CC7.2: The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events.

Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs

PI1.5 Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's processing integrity commitments and system requirements

RDS DB clusters should be encrypted at rest

11.10(c) Protection of records to enable their accurate and ready retrieval throughout the records retention period

11.10(d) Limiting system access to authorized individuals

RDS DB clusters should have IAM authentication configured

12.1 Security

RDS DB clusters should have IAM authentication configured

7.1 Data Storage - Damage Protection

11 Access control

4 Business continuity and crisis management

RDS Aurora clusters should have backtracking enabled

ACSC-EE-ML2-7.7: Multi-factor authentication ML2

Aurora MySQL DB clusters should have audit logging enabled

ACSC-EE-ML3-5.3: Restrict administrative privileges ML3

RDS DB clusters should have IAM authentication configured

ACSC-EE-ML3-8.3: Regular backups ML3

RDS Aurora clusters should have backtracking enabled

PR.DS-01

RDS DB clusters should be encrypted at rest

PR.DS-3

RDS clusters should have deletion protection enabled

PR.DS-4

RDS clusters should have deletion protection enabled

PR.PT-5

RDS clusters should have deletion protection enabled

RC.RP-04

RDS DB clusters should be configured for multiple Availability Zones

Framework coverage

Which controls from this module are active under each framework endpoint.

Control	PCI DSS v4.0	SOC 2
RDS Aurora clusters should have backtracking enabled	○	○
Aurora MySQL DB clusters should have audit logging enabled	●	○
Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs	○	●
RDS DB clusters should have automatic minor version upgrade enabled	○	○
RDS DB clusters should be configured to copy tags to snapshots	○	○
RDS clusters should have deletion protection enabled	○	○
RDS DB clusters should be encrypted with CMK	○	○
RDS DB clusters should be encrypted at rest	●	●
RDS DB clusters should have IAM authentication configured	●	○
RDS DB clusters should be configured for multiple Availability Zones	○	○
RDS database clusters should use a custom administrator username	○	○
RDS Aurora cluster parameter groups should require TLS for client connections	○	●

● enforced by default · ○ not activated by this endpoint

Known Terraform limitations

Separately from the controls above, some things people ask this module for cannot be implemented by any module in any registry - they are limits of Terraform itself. Known limitations for this module lists the recurring ones: what causes each, the native workaround in full, and - where one exists - the opt-in Operational Rule that removes the need for a fork.