bitovi/Deploy Amazon RDS DB instance
Deploys an AWS RDS database (Postgres, MySQL, MariaDB or MSSQL)
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Maintainedlast commit Oct 3, 2025
- License
- MIT
Pinned Snippet
uses: bitovi/github-actions-deploy-rds@72eb22cc597497bf59483140ac9425bc698ca2e3 # v0.1.8tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| bitops_code_only | Will run only the generation phase of BitOps, where the Terraform and Ansible code is built. | no | — |
| bitops_code_store | Store BitOps code as a GitHub artifact | no | false |
| aws_access_key_id | AWS access key ID | yes | — |
| aws_secret_access_key | AWS secret access key | yes | — |
| aws_session_token | AWS session token | no | — |
| aws_default_region | AWS default region | no | us-east-1 |
| aws_resource_identifier | Set to override the AWS resource identifier for the deployment. Defaults to `${org}-{repo}-{branch}`. Use with destroy to destroy specific resources. | no | — |
| aws_additional_tags | A JSON object of additional tags that will be included on created resources. Example: `{"key1": "value1", "key2": "value2"}` | no | — |
| tf_stack_destroy | Set to "true" to Destroy the stack through Terraform. | no | — |
| tf_state_file_name | Change this to be anything you want to. Careful to be consistent here. A missing file could trigger recreation, or stepping over destruction of non-defined objects. | no | — |
| tf_state_file_name_append | Append a string to the tf-state-file. Setting this to `unique` will generate `tf-state-aws-unique`. Can co-exist with the tf_state_file_name variable. | no | — |
| tf_state_bucket | AWS S3 bucket to use for Terraform state. Defaults to `${org}-${repo}-{branch}-tf-state` | no | — |
| tf_state_bucket_destroy | Force purge and deletion of S3 bucket defined. Any file contained there will be destroyed. `tf_stack_destroy` must also be `true` | no | — |
| aws_rds_db_enable | Set to true to enable an RDS DB. | no | true |
| aws_rds_db_proxy | Set to true to add a RDS DB Proxy | no | — |
| aws_rds_db_identifier | Database identifier that will appear in the AWS Console. Defaults to aws_resource_identifier if none set. | no | — |
| aws_rds_db_name | The name of the database to create when the DB instance is created. | no | — |
| aws_rds_db_user | Username for the db. Defaults to dbuser. | no | — |
| aws_rds_db_engine | Which Database engine to use. Default is postgres | no | — |
| aws_rds_db_engine_version | Which Database engine version to use. | no | — |
| aws_rds_db_ca_cert_identifier | Certificate to use with the database. Defaults to rds-ca-ecc384-g1 | no | — |
| aws_rds_db_security_group_name | The name of the database security group. Defaults to SG for aws_resource_identifier - RDS. | no | — |
| aws_rds_db_allowed_security_groups | Comma separated list of security groups to add to the DB SG | no | — |
| aws_rds_db_ingress_allow_all | Allow incoming traffic from 0.0.0.0/0. | no | — |
| aws_rds_db_publicly_accessible | Allow the database to be publicly accessible. | no | — |
| aws_rds_db_port | Port where the DB listens to. | no | — |
| aws_rds_db_subnets | Specify which subnets to use as a list of strings. | no | — |
| aws_rds_db_allocated_storage | Storage size. Defaults to 10. | no | — |
| aws_rds_db_max_allocated_storage | Max storage size. Defaults to 0 to disable auto-scaling. | no | — |
| aws_rds_db_storage_encrypted | Toggle storage encryption. Defaults to false. | no | — |
| aws_rds_db_storage_type | Storage type. Like gp2 / gp3. Defaults to gp2. | no | — |
| aws_rds_db_kms_key_id | The ARN for the KMS encryption key. | no | — |
| aws_rds_db_instance_class | DB instance server type. Defaults to db.t3.micro. | no | — |
| aws_rds_db_final_snapshot | Generates a snapshot of the database before deletion. | no | — |
| aws_rds_db_restore_snapshot_identifier | Name of the snapshot to restore the database from. | no | — |
| aws_rds_db_cloudwatch_logs_exports | Set of log types to enable for exporting to CloudWatch logs. | no | — |
| aws_rds_db_multi_az | Specifies if the RDS instance is multi-AZ | no | — |
| aws_rds_db_maintenance_window | The window to perform maintenance in. Eg: Mon:00:00-Mon:03:00 | no | — |
| aws_rds_db_apply_immediately | Specifies whether any database modifications are applied immediately, or during the next maintenance window | no | — |
| aws_rds_db_performance_insights_enable | Enables performance insights for the database. Defaults to false. | no | — |
| aws_rds_db_performance_insights_retention | Number of days to retain performance insights data. Defaults to 7. | no | — |
| aws_rds_db_performance_insights_kms_key_id | KMS key ID to use for encrypting performance insights data. | no | — |
| aws_rds_db_monitoring_interval | The interval, in seconds, between points when Enhanced Monitoring metrics are collected for the DB instance. To disable, set to 0. | no | — |
| aws_rds_db_monitoring_role_arn | The ARN for the IAM role that permits RDS to send enhanced monitoring metrics to CloudWatch Logs. | no | — |
| aws_rds_db_insights_mode | The mode for Performance Insights. | no | — |
| aws_rds_db_allow_major_version_upgrade | Indicates that major version upgrades are allowed. | no | — |
| aws_rds_db_auto_minor_version_upgrade | Indicates that minor version upgrades are allowed. | no | — |
| aws_rds_db_backup_retention_period | The number of days to retain backups for. Must be between 0 (disabled) and 35. | no | — |
| aws_rds_db_backup_window | The window during which backups are taken. | no | — |
| aws_rds_db_copy_tags_to_snapshot | Indicates whether to copy tags to snapshots. | no | — |
| aws_rds_db_additional_tags | A JSON object of additional tags that will be included on created resources. Example: `{"key1": "value1", "key2": "value2"}` | no | — |
| aws_db_proxy_name | DB Proxy name | no | — |
| aws_db_proxy_client_password_auth_type | Auth type to use, will use the following, depending on DB the family. MYSQL_NATIVE_PASSWORD, POSTGRES_SCRAM_SHA_256, and SQL_SERVER_AUTHENTICATION | no | — |
| aws_db_proxy_tls | Toggle TLS enforcement for connection | no | — |
| aws_db_proxy_security_group_name | Name for the proxy security group. Default to aws_resource_identifier if none. | no | — |
| aws_db_proxy_database_security_group_allow | Will add an incoming rule from every security group associated with the DB | no | — |
| aws_db_proxy_allowed_security_group | Comma separated list of SG Ids to add. | no | — |
| aws_db_proxy_allow_all_incoming | Allow all incoming traffic to the DB Proxy. Mind that the proxy is only available from the internal network except manually exposed. | no | — |
| aws_db_proxy_cloudwatch_enable | Toggle Cloudwatch logs. Will be stored in /aws/rds/proxy/rds_proxy.name | no | — |
| aws_db_proxy_cloudwatch_retention_days | Number of days to retain logs | no | — |
| aws_db_proxy_additional_tags | A list of strings that will be added to created resources | no | — |
| aws_vpc_create | Define if a VPC should be created | no | — |
| aws_vpc_name | Set a specific name for the VPC | no | — |
| aws_vpc_cidr_block | Define Base CIDR block which is divided into subnet CIDR blocks. Defaults to 10.0.0.0/16. | no | — |
| aws_vpc_public_subnets | Comma separated list of public subnets. Defaults to 10.10.110.0/24 | no | — |
| aws_vpc_private_subnets | Comma separated list of private subnets. If none, none will be created. | no | — |
| aws_vpc_availability_zones | Comma separated list of availability zones. Defaults to `aws_default_region`. | no | — |
| aws_vpc_id | AWS VPC ID. Accepts `vpc-###` values. | no | — |
| aws_vpc_subnet_id | Specify a Subnet to be used with the instance. If none provided, will pick one. | no | — |
| aws_vpc_enable_nat_gateway | Enables NAT gateway | no | — |
| aws_vpc_single_nat_gateway | Creates only one NAT gateway | no | — |
| aws_vpc_external_nat_ip_ids | Comma separated list of IP IDS to reuse in the NAT gateways | no | — |
| aws_vpc_additional_tags | A JSON object of additional tags that will be included on created resources. Example: `{"key1": "value1", "key2": "value2"}` | no | — |
Outputs
| name | description |
|---|---|
| aws_vpc_id | The selected VPC ID used. |
| db_endpoint | RDS Endpoint |
| db_secret_details_name | AWS Secret name containing db credentials |
| db_sg_id | SG ID for the RDS instance |
| db_proxy_rds_endpoint | Database proxy endpoint |
| db_proxy_secret_name_rds | AWS Secret name containing proxy credentials |
| db_proxy_sg_id_rds | SG ID for the RDS Proxy instance |