RDS proxy

[mabadir]

Greptile Summary

This PR adds a standalone RDS Proxy module and optional proxy creation to the existing RDS and Aurora modules.

• Creates proxy, target-group, IAM, security-group, output, documentation, and Ravion definition resources.
• Adds proxy configuration and outputs to the RDS and Aurora parent modules.
• Updates provider constraints, lock files, release metadata, and the generated module catalog.

Confidence Score: 4/5

The PR should not merge until the circular dependencies in the RDS and Aurora proxy integrations are removed.

Enabling the new proxy with the default module-managed security group makes each database depend on a security group that depends on a proxy targeting that same database, so Terraform cannot construct an acyclic plan.

Files Needing Attention: database/aurora/security_group.tf, database/aurora/rds_proxy.tf, database/rds/security_group.tf, database/rds/rds_proxy.tf

Important Files Changed

Filename	Overview
database/aurora/security_group.tf	Adds proxy ingress to the cluster security group but introduces a dependency cycle through the proxy target.
database/rds/security_group.tf	Adds the same circular proxy-to-database security-group dependency for RDS instances.
database/rds-proxy/db_proxy.tf	Defines the standalone proxy, default target group, and mutually exclusive database target registration.
database/rds-proxy/iam_role.tf	Creates a scoped service role for reading configured secrets and optionally decrypting them with specified KMS keys.
database/rds-proxy/rvn-rds-proxy-definition.yml	Adds the Ravion form, Terraform mapping, metrics, and documentation for standalone proxy deployments.
database/aurora/rds_proxy.tf	Integrates the proxy module with Aurora and contributes the target side of the circular dependency.
database/rds/rds_proxy.tf	Integrates the proxy module with RDS and contributes the target side of the circular dependency.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  DB["RDS instance / Aurora cluster"] -->|requires| DBSG["Database security group"]
  DBSG -->|references proxy SG output| Proxy["RDS Proxy module"]
  Proxy -->|registers target| DB

Loading

Prompt To Fix All With AI

### Issue 1
database/aurora/security_group.tf:40-47
**Circular proxy dependency graph**

When `proxy_creation_enabled` uses the default module-managed security group, the database depends on this security group, this rule depends on the proxy module, and the proxy targets the same database, causing Terraform to report a dependency cycle and reject the plan for both the Aurora and RDS integrations.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "update readme" | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

Context used (3)

• Knowledge Base — Database Modules: Aurora, RDS, DynamoDB
• Knowledge Base — Terraform Stack module and shared partials
• Knowledge Base — tools/ravion-modules

[greptile-apps]

Circular proxy dependency graph

When proxy_creation_enabled uses the default module-managed security group, the database depends on this security group, this rule depends on the proxy module, and the proxy targets the same database, causing Terraform to report a dependency cycle and reject the plan for both the Aurora and RDS integrations.

Knowledge Base Used: Database Modules: Aurora, RDS, DynamoDB

Prompt To Fix With AI

This is a comment left during a code review.
Path: database/aurora/security_group.tf
Line: 40-47

Comment:
**Circular proxy dependency graph**

When `proxy_creation_enabled` uses the default module-managed security group, the database depends on this security group, this rule depends on the proxy module, and the proxy targets the same database, causing Terraform to report a dependency cycle and reject the plan for both the Aurora and RDS integrations.

**Knowledge Base Used:** [Database Modules: Aurora, RDS, DynamoDB](https://app.greptile.com/flightcontrol/-/custom-context/knowledge-base/flightcontrolhq/modules/-/docs/database.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[github-actions]

Ravion Module Publish Plan

Dry run only. No Ravion API mutations were made.

🚨 Release Config Conflicts 🚨

These module versions already exist remotely with different compiled config. Publish a new version, or make the local definition match the existing remote version.

Module	Release Version	Latest Remote Version	Problem
rvn-aurora	1.1.1	1.1.1	Release version already exists remotely with different compiled config.
rvn-rds	1.1.1	1.1.1	Release version already exists remotely with different compiled config.

Latest Remote vs Compiled

rvn-aurora 1.1.1 -> 1.1.1

--- remote
+++ compiled
     show_when:
       security_group_creation_enabled: true
     type: string_array
+  - id: section_proxy
+    label: Connection pooling
+    type: section
+  - default: false
+    description: Create an RDS Proxy in front of the cluster for connection pooling and improved failover handling.
+    id: proxy_creation_enabled
+    label: RDS Proxy
+    type: boolean
+  - add_button_label: Add secret ARN
+    collapsible: true
+    description: Secrets Manager secrets containing database credentials for the proxy. Leave blank to use the managed master user secret.
+    id: proxy_auth_secret_arns
+    label: Auth secret ARNs
+    placeholder: arn:aws:secretsmanager:...
+    required: false
+    show_when:
+      proxy_creation_enabled: true
+    type: string_array
+  - add_button_label: Add KMS key ARN
+    collapsible: true
+    description: KMS keys used to encrypt the auth secrets when using customer-managed keys. The master user secret KMS key is included automatically.
+    id: proxy_secret_kms_key_arns
+    label: Auth secret KMS key ARNs
+    placeholder: arn:aws:kms:...
+    required: false
+    show_when:
+      proxy_creation_enabled: true
+    type: string_array
+  - collapsible: true
+    default: false
+    description: Require IAM authentication for client connections to the proxy.
+    id: proxy_iam_auth_enabled
+    label: IAM authentication
+    show_when:
+      proxy_creation_enabled: true
+    type: boolean
+  - collapsible: true
+    default: true
+    description: Require TLS for client connections to the proxy.
+    id: proxy_tls_requirement_enabled
+    label: Require TLS
+    show_when:
+      proxy_creation_enabled: true
+    type: boolean
+  - collapsible: true
+    default: false
+    description: Log detailed connection information, including SQL statements, to CloudWatch Logs.
+    id: proxy_debug_logging_enabled
+    label: Debug logging
+    show_when:
+      proxy_creation_enabled: true
+    type: boolean
+  - collapsible: true
+    default: 1800
+    id: proxy_idle_client_timeout
+    label: Idle client timeout (seconds)
+    max: 28800
+    min: 1
+    show_when:
+      proxy_creation_enabled: true
+    type: number
+  - collapsible: true
+    default: 120
+    id: proxy_connection_borrow_timeout
+    label: Connection borrow timeout (seconds)
+    min: 0
+    show_when:
+      proxy_creation_enabled: true
+    type: number
+  - collapsible: true
+    default: 100
+    description: Maximum size of the connection pool as a percentage of the database max_connections setting.
+    id: proxy_max_connections_percent
+    label: Max connections (%)
+    max: 100
+    min: 1
+    show_when:
+      proxy_creation_enabled: true
+    type: number
+  - collapsible: true
+    default: 50
+    description: Maximum idle connections kept open, as a percentage of the database max_connections setting.
+    id: proxy_max_idle_connections_percent
+    label: Max idle connections (%)
+    max: 100
+    min: 0
+    show_when:
+      proxy_creation_enabled: true
+    type: number
+  - add_button_label: Add filter
+    collapsible: true
+    id: proxy_session_pinning_filters
+    label: Session pinning filters
+    required: false
+    show_when:
+      proxy_creation_enabled: true
+    type: string_array
+    values:
+      - label: EXCLUDE_VARIABLE_SETS
+        value: EXCLUDE_VARIABLE_SETS
+  - collapsible: true
+    description: SQL statements the proxy runs when opening each new database connection.
+    id: proxy_init_query
+    label: Initialization query
+    placeholder: SET time_zone = 'UTC'
+    required: false
+    show_when:
+      proxy_creation_enabled: true
+    type: string
   - id: section_readers
     label: Readers
     type: section
@@
 
   The Ravion UI charts Aurora CloudWatch metrics for CPU utilization, freeable memory, database connections, serverless capacity and ACU utilization, storage used, read and write latency, replica lag, buffer cache hit ratio, commit latency, deadlocks, network throughput, and volume IOPS.
 
+  ## Connection pooling
+
+  Enable RDS Proxy to place a managed connection pool in front of the cluster. The proxy authenticates with the Secrets Manager master user secret by default, requires TLS, and allows the same security group and CIDR sources configured for the cluster. Pool sizing, idle timeouts, session pinning, IAM authentication, and custom auth secrets are configurable in the Connection pooling section.
+
   ## Configuration
 
   | Field | Required | Default | Notes |
@@
   | Deletion protection | No | true | Helps prevent accidental deletion. |
   | Performance insights | No | true | Enables AWS Performance Insights. |
   | CloudWatch alarms | No | true | Adds CPU, memory, and connection alarms. |
+  | RDS Proxy | No | false | Creates an RDS Proxy connection pool in front of the cluster. |
   | Global database | No | false | Create or join an Aurora global database. |
   | Activity stream | No | false | Enables Database Activity Streams with a required KMS key. |
   | Tags | No | Blank | Merged with Ravion standard tags. |
@@
           preferred_backup_window: << module.input.preferred_backup_window >>
           preferred_maintenance_window: << module.input.preferred_maintenance_window >>
           promotion_tier: << module.input.promotion_tier >>
+          proxy_auth_secret_arns: << module.input.proxy_auth_secret_arns >>
+          proxy_connection_borrow_timeout: << module.input.proxy_connection_borrow_timeout >>
+          proxy_creation_enabled: << module.input.proxy_creation_enabled >>
+          proxy_debug_logging_enabled: << module.input.proxy_debug_logging_enabled >>
+          proxy_iam_auth_enabled: << module.input.proxy_iam_auth_enabled >>
+          proxy_idle_client_timeout: << module.input.proxy_idle_client_timeout >>
+          proxy_init_query: << module.input.proxy_init_query >>
+          proxy_max_connections_percent: << module.input.proxy_max_connections_percent >>
+          proxy_max_idle_connections_percent: << module.input.proxy_max_idle_connections_percent >>
+          proxy_secret_kms_key_arns: << module.input.proxy_secret_kms_key_arns >>
+          proxy_session_pinning_filters: << module.input.proxy_session_pinning_filters >>
+          proxy_tls_requirement_enabled: << module.input.proxy_tls_requirement_enabled >>
           public_access_enabled: << module.input.public_access_enabled >>
           reader_count: << module.input.reader_count >>
           reader_instance_class: << module.input.reader_instance_class >>

rvn-rds 1.1.1 -> 1.1.1

--- remote
+++ compiled
     show_when:
       security_group_creation_enabled: true
     type: string_array
+  - id: section_proxy
+    label: Connection pooling
+    show_when:
+      engine:
+        - mysql
+        - postgres
+        - mariadb
+        - sqlserver-ee
+        - sqlserver-se
+        - sqlserver-ex
+        - sqlserver-web
+    type: section
+  - default: false
+    description: Create an RDS Proxy in front of the database for connection pooling and improved failover handling.
+    id: proxy_creation_enabled
+    label: RDS Proxy
+    show_when:
+      engine:
+        - mysql
+        - postgres
+        - mariadb
+        - sqlserver-ee
+        - sqlserver-se
+        - sqlserver-ex
+        - sqlserver-web
+    type: boolean
+  - add_button_label: Add secret ARN
+    collapsible: true
+    description: Secrets Manager secrets containing database credentials for the proxy. Leave blank to use the managed master user secret.
+    id: proxy_auth_secret_arns
+    label: Auth secret ARNs
+    placeholder: arn:aws:secretsmanager:...
+    required: false
+    show_when:
+      proxy_creation_enabled: true
+    type: string_array
+  - add_button_label: Add KMS key ARN
+    collapsible: true
+    description: KMS keys used to encrypt the auth secrets when using customer-managed keys. The master user secret KMS key is included automatically.
+    id: proxy_secret_kms_key_arns
+    label: Auth secret KMS key ARNs
+    placeholder: arn:aws:kms:...
+    required: false
+    show_when:
+      proxy_creation_enabled: true
+    type: string_array
+  - collapsible: true
+    default: false
+    description: Require IAM authentication for client connections to the proxy.
+    id: proxy_iam_auth_enabled
+    label: IAM authentication
+    show_when:
+      proxy_creation_enabled: true
+    type: boolean
+  - collapsible: true
+    default: true
+    description: Require TLS for client connections to the proxy.
+    id: proxy_tls_requirement_enabled
+    label: Require TLS
+    show_when:
+      proxy_creation_enabled: true
+    type: boolean
+  - collapsible: true
+    default: false
+    description: Log detailed connection information, including SQL statements, to CloudWatch Logs.
+    id: proxy_debug_logging_enabled
+    label: Debug logging
+    show_when:
+      proxy_creation_enabled: true
+    type: boolean
+  - collapsible: true
+    default: 1800
+    id: proxy_idle_client_timeout
+    label: Idle client timeout (seconds)
+    max: 28800
+    min: 1
+    show_when:
+      proxy_creation_enabled: true
+    type: number
+  - collapsible: true
+    default: 120
+    id: proxy_connection_borrow_timeout
+    label: Connection borrow timeout (seconds)
+    min: 0
+    show_when:
+      proxy_creation_enabled: true
+    type: number
+  - collapsible: true
+    default: 100
+    description: Maximum size of the connection pool as a percentage of the database max_connections setting.
+    id: proxy_max_connections_percent
+    label: Max connections (%)
+    max: 100
+    min: 1
+    show_when:
+      proxy_creation_enabled: true
+    type: number
+  - collapsible: true
+    default: 50
+    description: Maximum idle connections kept open, as a percentage of the database max_connections setting.
+    id: proxy_max_idle_connections_percent
+    label: Max idle connections (%)
+    max: 100
+    min: 0
+    show_when:
+      proxy_creation_enabled: true
+    type: number
+  - add_button_label: Add filter
+    collapsible: true
+    id: proxy_session_pinning_filters
+    label: Session pinning filters
+    required: false
+    show_when:
+      proxy_creation_enabled: true
+    type: string_array
+    values:
+      - label: EXCLUDE_VARIABLE_SETS
+        value: EXCLUDE_VARIABLE_SETS
+  - collapsible: true
+    description: SQL statements the proxy runs when opening each new database connection.
+    id: proxy_init_query
+    label: Initialization query
+    placeholder: SET time_zone = 'UTC'
+    required: false
+    show_when:
+      proxy_creation_enabled: true
+    type: string
   - id: section_availability
     label: Availability & replicas
     type: section
@@
 
   CloudWatch alarms are optional. When enabled, the module can alarm on CPU utilization, free storage space, and database connections. The free storage alarm threshold is entered in GiB in Ravion and converted to bytes for Terraform. The Ravion UI also shows RDS CloudWatch metrics for CPU, free storage, connections, read IOPS, and write IOPS.
 
+  ## Connection pooling
+
+  Enable RDS Proxy to place a managed connection pool in front of the database. The proxy authenticates with the Secrets Manager master user secret by default, requires TLS, and allows the same security group and CIDR sources configured for the database. Pool sizing, idle timeouts, session pinning, IAM authentication, and custom auth secrets are configurable in the Connection pooling section. RDS Proxy is not available for Oracle engines.
+
   ## Configuration
 
   | Field | Required | Default | Notes |
@@
   | Performance insights | No | true | Enables AWS Performance Insights. |
   | CloudWatch alarms | No | true | Adds CPU, free storage, and connection alarms. |
   | Free storage alarm threshold | No | 5 GiB | Converted to bytes before Terraform runs. |
+  | RDS Proxy | No | false | Creates an RDS Proxy connection pool in front of the database. Not available for Oracle engines. |
   | Tags | No | Blank | Merged with Ravion standard tags. |
 
   ## Advanced configuration
@@
           performance_insights_kms_key_id: << module.input.performance_insights_kms_key_id >>
           performance_insights_retention_period: << module.input.performance_insights_retention_period >>
           port: << module.input.port >>
+          proxy_auth_secret_arns: << module.input.proxy_auth_secret_arns >>
+          proxy_connection_borrow_timeout: << module.input.proxy_connection_borrow_timeout >>
+          proxy_creation_enabled: << module.input.proxy_creation_enabled >>
+          proxy_debug_logging_enabled: << module.input.proxy_debug_logging_enabled >>
+          proxy_iam_auth_enabled: << module.input.proxy_iam_auth_enabled >>
+          proxy_idle_client_timeout: << module.input.proxy_idle_client_timeout >>
+          proxy_init_query: << module.input.proxy_init_query >>
+          proxy_max_connections_percent: << module.input.proxy_max_connections_percent >>
+          proxy_max_idle_connections_percent: << module.input.proxy_max_idle_connections_percent >>
+          proxy_secret_kms_key_arns: << module.input.proxy_secret_kms_key_arns >>
+          proxy_session_pinning_filters: << module.input.proxy_session_pinning_filters >>
+          proxy_tls_requirement_enabled: << module.input.proxy_tls_requirement_enabled >>
           public_access_enabled: << module.input.public_access_enabled >>
           read_replica_availability_zones: << module.input.read_replica_availability_zones >>
           read_replica_count: << module.input.read_replica_count >>