Terraform AWS RDS Aurora

Aurora clusters and instances with private subnet placement, storage encryption, automated backups, reader endpoints, IAM authentication, log exports, and multi AZ high availability.

Controls enforced

These compliance controls are checked at terraform plan time.

RDS Aurora clusters should have backtracking enabled(low effort)
Aurora MySQL DB clusters should have audit logging enabled(low effort)
Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs(low effort)
RDS DB clusters should be configured to copy tags to snapshots(low effort)
RDS clusters should have deletion protection enabled(low effort)
RDS DB clusters should be encrypted with CMK(low effort)
RDS DB clusters should be encrypted at rest(low effort)
RDS DB clusters should have IAM authentication configured(low effort)
RDS DB clusters should be configured for multiple Availability Zones(low effort)
RDS database clusters should use a custom administrator username(low effort)

Quick start

module "rds-aurora" {
  source  = "iso27001.compliance.tf/terraform-aws-modules/rds-aurora/aws"
  version = "1.0"

  # ... your arguments here
}

module "rds-aurora" {
  source  = "pcidss.compliance.tf/terraform-aws-modules/rds-aurora/aws"
  version = "1.0"

  # ... your arguments here
}

module "rds-aurora" {
  source  = "nis2.compliance.tf/terraform-aws-modules/rds-aurora/aws"
  version = "1.0"

  # ... your arguments here
}

module "rds-aurora" {
  source  = "soc2.compliance.tf/terraform-aws-modules/rds-aurora/aws"
  version = "1.0"

  # ... your arguments here
}

module "rds-aurora" {
  source  = "acscessentialeight.compliance.tf/terraform-aws-modules/rds-aurora/aws"
  version = "1.0"

  # ... your arguments here
}

module "rds-aurora" {
  source  = "nistcsf.compliance.tf/terraform-aws-modules/rds-aurora/aws"
  version = "1.0"

  # ... your arguments here
}

module "rds-aurora" {
  source  = "cfrpart11.compliance.tf/terraform-aws-modules/rds-aurora/aws"
  version = "1.0"

  # ... your arguments here
}

module "rds-aurora" {
  source  = "cisv500.compliance.tf/terraform-aws-modules/rds-aurora/aws"
  version = "1.0"

  # ... your arguments here
}

See the Get Started guide and Registry Endpoints for details on how to customize the module for your requirements.

Migration from upstream

Already using terraform-aws-modules? Change only the source URL:

module "rds-aurora" {
  source  = "terraform-aws-modules/rds-aurora/aws"
  version = "1.0"
}

module "rds-aurora" {
  source  = "soc2.compliance.tf/terraform-aws-modules/rds-aurora/aws"
  version = "1.0"
}

Same arguments. Same outputs. Controls are checked at terraform plan. See the Migration Guide for step-by-step instructions.

Reversibility

No lock-in. Switch back by reverting the source URL:

module "rds-aurora" {
  source  = "terraform-aws-modules/rds-aurora/aws"
}

Run terraform init -upgrade. Terraform state is unchanged — same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.

Mapped compliance frameworks

A.5.13 Labelling of information

RDS DB clusters should be configured to copy tags to snapshots

A.8.11 Data masking

A.8.14 Redundancy of information processing facilities

RDS DB clusters should be configured for multiple Availability Zones

A.8.15 Logging

Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs

A.8.24 Use of cryptography

10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.

Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs

10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.

Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs

10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.

Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs

10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.

Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs

10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.

Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs

10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.

Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs

10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.

Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs

10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.

Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs

10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.

Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs

10.3.1: Audit logs are protected from destruction and unauthorized modifications.

Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs

10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.

3.5.1: Primary account number (PAN) is secured wherever it is stored.

5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.

Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs

7.2.1: Access to system components and data is appropriately defined and assigned.

RDS DB clusters should have IAM authentication configured

7.2.2: Access to system components and data is appropriately defined and assigned.

RDS DB clusters should have IAM authentication configured

7.2.5: Access to system components and data is appropriately defined and assigned.

RDS DB clusters should have IAM authentication configured

7.3.1: Access to system components and data is managed via an access control system(s).

RDS DB clusters should have IAM authentication configured

7.3.2: Access to system components and data is managed via an access control system(s).

RDS DB clusters should have IAM authentication configured

7.3.3: Access to system components and data is managed via an access control system(s).

RDS DB clusters should have IAM authentication configured

8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.

RDS DB clusters should have IAM authentication configured

8.2.8: If a user session has been idle for more than 15 minutes, the user is required to re-authenticate to re-activate the terminal or session

RDS DB clusters should have IAM authentication configured

8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.

RDS DB clusters should have IAM authentication configured

8.3.2: Strong authentication for users and administrators is established and managed.

8.3.2: Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components

8.3.4: Strong authentication for users and administrators is established and managed.

RDS DB clusters should have IAM authentication configured

A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.

Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs

A1.2.3: Processes or mechanisms are implemented for reporting and addressing suspected or confirmed security incidents and vulnerabilities

Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs

11 Access control

3 Incident handling

Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs

4 Business continuity and crisis management

RDS Aurora clusters should have backtracking enabled

C1.1 The entity identifies and maintains confidential information to meet the entity's objectives related to confidentiality

RDS clusters should have deletion protection enabled

PI1.3 Data is processed completely, accurately, and timely as authorized to meet the entity's processing integrity commitments and system requirements

Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs

PI1.5 Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's processing integrity commitments and system requirements

ACSC-EE-ML2-7.7: Multi-factor authentication ML2

Aurora MySQL DB clusters should have audit logging enabled

ACSC-EE-ML3-5.3: Restrict administrative privileges ML3

RDS DB clusters should have IAM authentication configured

ACSC-EE-ML3-8.3: Regular backups ML3

RDS Aurora clusters should have backtracking enabled

PR.DS-01

RDS DB clusters should be encrypted at rest

PR.DS-3

RDS clusters should have deletion protection enabled

PR.DS-4

RDS clusters should have deletion protection enabled

PR.PT-5

RDS clusters should have deletion protection enabled

RC.RP-04

11.10(a) Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records

RDS clusters should have deletion protection enabled

2 Storage

RDS DB clusters should be configured for multiple Availability Zones

Framework coverage

Which controls from this module are active under each framework endpoint.

Control	PCI DSS v4.0	SOC 2
RDS Aurora clusters should have backtracking enabled	○	○
Aurora MySQL DB clusters should have audit logging enabled	●	○
Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs	●	●
RDS DB clusters should be configured to copy tags to snapshots	○	○
RDS clusters should have deletion protection enabled	○	●
RDS DB clusters should be encrypted with CMK	●	●
RDS DB clusters should be encrypted at rest	●	●
RDS DB clusters should have IAM authentication configured	●	○
RDS DB clusters should be configured for multiple Availability Zones	○	○
RDS database clusters should use a custom administrator username	○	○

● enforced by default · ○ not activated by this endpoint