compliance.tf
Terraform Modules for AWSDatabases, Caching & Analytics

Terraform AWS RDS

RDS instances with subnet groups, security groups, storage encryption, automated backups, maintenance windows, performance insights, IAM authentication, and log exports.

Controls enforced

These compliance controls are checked at terraform plan time.

Quick start

module "rds" {
  source  = "cisacyberessentials.compliance.tf/terraform-aws-modules/rds/aws"
  version = ">= 7.0.0"

  # ... your arguments here
}
module "rds" {
  source  = "ffiec.compliance.tf/terraform-aws-modules/rds/aws"
  version = ">= 7.0.0"

  # ... your arguments here
}
module "rds" {
  source  = "hipaa.compliance.tf/terraform-aws-modules/rds/aws"
  version = ">= 7.0.0"

  # ... your arguments here
}
module "rds" {
  source  = "nist800171.compliance.tf/terraform-aws-modules/rds/aws"
  version = ">= 7.0.0"

  # ... your arguments here
}
module "rds" {
  source  = "nist80053.compliance.tf/terraform-aws-modules/rds/aws"
  version = ">= 7.0.0"

  # ... your arguments here
}
module "rds" {
  source  = "fedrampmoderate.compliance.tf/terraform-aws-modules/rds/aws"
  version = ">= 7.0.0"

  # ... your arguments here
}
module "rds" {
  source  = "soc2.compliance.tf/terraform-aws-modules/rds/aws"
  version = ">= 7.0.0"

  # ... your arguments here
}
module "rds" {
  source  = "cfrpart11.compliance.tf/terraform-aws-modules/rds/aws"
  version = ">= 7.0.0"

  # ... your arguments here
}

View this module on the compliance.tf registry — versions, inputs, and outputs →

See the Get Started guide and Registry Endpoints for details on how to customize the module for your requirements.

Migration from upstream

Already using terraform-aws-modules? Change only the source URL:

module "rds" {
  source  = "terraform-aws-modules/rds/aws"
  version = ">= 7.0.0"
}
module "rds" {
  source  = "soc2.compliance.tf/terraform-aws-modules/rds/aws"
  version = ">= 7.0.0"
}

Same arguments. Same outputs. Controls are checked at terraform plan. See the Migration Guide for step-by-step instructions.

Reversibility

No lock-in. Switch back by reverting the source URL:

module "rds" {
  source  = "terraform-aws-modules/rds/aws"
}

Run terraform init -upgrade. Terraform state is unchanged — same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.

Mapped compliance frameworks

Booting Up: Things to Do First-1

164.308(a)(4)(i) Information access management

164.312(a)(2)(ii) Emergency access procedure

164.312(a)(2)(iv) Encryption and decryption

3.1.12: Monitor and control remote access sessions.

3.12.4 Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems

3.13.11 Employ FIPS-validated cryptography when used to protect the confidentiality of CUI

3.13.16: Protect the confidentiality of CUI at rest.

3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.

3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems

3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks

3.14.7: Identify unauthorized use of organizational systems.

3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity

3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions

3.6.1 Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities

3.6.2 Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization

AC-3(1) Restricted Access To Privileged Functions

AC-3(10) Audited Override Of Access Control Mechanisms

AU-12(1) System-Wide And Time-Correlated Audit Trial

AU-12(4) Query Parameter Audits Of Personally Identifiable Information

AU-6(3) Correlate Audit Record Repositories

AU-6(6) Correletion With Physical Monitoring

AU-6(9) Correletion With From Nontechnical Sources

Architecture And Provisioning For Name/Address Resolution Service (SC-22)

CP-10(2): Transaction Recovery

CP-2(6) Alternate Processing And Storage Sites

CP-6(1) Separation From Primary Site

Distributed Processing And Storage (SC-36)

SC-8(3) Cryptographic Protection For Message Externals

SC-8(4) Conceal Or Ramdomize Communications

SI-19(4) Removal, Masking, Encryption, Hashing, Or Replacement Of Direct Identifiers

SI-4(17) Integrated Situational Awareness

SI-4(2) Automated Tools For Real-Time Analysis

SI-7(8) Auditing Capability For Significant Events

Information Handling and Retention (SI-12)

Protection of Information at Rest (SC-28)

A1.2 The entity authorizes, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data back-up processes, and recovery infrastructure to meet its objectives

C1.1 The entity identifies and maintains confidential information to meet the entity's objectives related to confidentiality

CC1.3 COSO Principle 3: Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives

CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives

CC7.2: The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events.

CC7.3 The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures

CC7.4 The entity responds to identified security incidents by executing a defined incident response program to understand, contain, remediate, and communicate security incidents, as appropriate

CC7.5 The entity identifies, develops, and implements activities to recover from identified security incidents

PI1.3 Data is processed completely, accurately, and timely as authorized to meet the entity's processing integrity commitments and system requirements

PI1.5 Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's processing integrity commitments and system requirements

11.10(a) Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records

11.10(c) Protection of records to enable their accurate and ready retrieval throughout the records retention period

11.10(e) Use of secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records

11.10(k) Use of appropriate controls over systems documentation that includes adequate controls over the distribution of, access to, and use of documentation for system operation and maintenance

Framework coverage

Which controls from this module are active under each framework endpoint.

ControlHIPAA Omnibus Rule 2013SOC 2
RDS DB instances and clusters should have enhanced monitoring enabled●○
RDS databases and clusters should not use a database engine default port○○
RDS DB instance automatic minor version upgrade should be enabled○○
RDS DB instance backup should be enabled●●
RDS DB instances backup retention period should be greater than or equal to 7○○
RDS DB instances should be integrated with CloudWatch logs●●
RDS DB instances should be configured to copy tags to snapshots○●
RDS DB instances should have deletion protection enabled●●
RDS DB instance encryption at rest should be enabled●●
RDS DB instances should have iam authentication enabled●●
RDS instances should be deployed in a VPC○○
RDS DB instances should have logging enabled○○
RDS for MariaDB DB instances should publish logs to CloudWatch Logs○●
RDS DB instances should have multiple AZ enabled●○
RDS database instances should use a custom administrator username○○
RDS DB instances should not use public subnet○○
RDS for PostgreSQL DB instances should publish logs to CloudWatch Logs○●
RDS DB instances should prohibit public access○○
RDS for SQL Server DB instances should publish logs to CloudWatch Logs○●

● enforced by default · ○ not activated by this endpoint

Known Terraform limitations

Separately from the controls above, some things people ask this module for cannot be implemented by any module in any registry - they are limits of Terraform itself. Known limitations for this module lists the recurring ones: what causes each, the native workaround in full, and - where one exists - the opt-in Operational Rule that removes the need for a fork.

OpenSearch

Previous Page

RDS Aurora

Next Page

On this page

Controls enforcedQuick startMigration from upstreamReversibilityMapped compliance frameworksFramework coverageKnown Terraform limitations

Ask AI about this

Help improve this page