Create AWS RDS instance in non default VPC using terraform

Question

I am using Terraform v0.10.2. I have created VPC in modules/vpc/main.tf and modules/acl/main.tf. I am accessing it using it's output.

I can successfully create ec2 instance in public subnet in above vpc like so:

subnet_id = "${element(module.vpc.public_subnet_ids, count.index)}"

I want to add the RDS instance to private subnet. I tried what the terraform doc said:

vpc_security_group_ids    = [
  "${aws_security_group.db_access_sg.id}"
]
db_subnet_group_name = "${module.vpc.aws_db_subnet_group_database}"

But, it is adding to the default VPC. If i put the subnet outside the module and access the resource, it gives the variable not found error.

I have referred many GitHub examples, but without success. Am i missing something ?

And this is one of the link i referred: https://github.com/hashicorp/terraform/issues/13739

Contents of modules/vpc/main.tf

resource "aws_vpc" "mod" {
  cidr_block = "${var.cidr}"

  tags {
    Name = "${var.name}"
  }
}

resource "aws_internet_gateway" "mod" {
  vpc_id = "${aws_vpc.mod.id}"
}

resource "aws_route_table" "public" {
  vpc_id           = "${aws_vpc.mod.id}"
  propagating_vgws = ["${compact(split(",", var.public_propagating_vgws))}"]

  tags {
    Name = "${var.name}-public"
  }
}

resource "aws_route" "public_internet_gateway" {
  route_table_id         = "${aws_route_table.public.id}"
  destination_cidr_block = "0.0.0.0/0"
  gateway_id             = "${aws_internet_gateway.mod.id}"
}

resource "aws_route_table" "private" {
  vpc_id           = "${aws_vpc.mod.id}"
  propagating_vgws = ["${compact(split(",", var.private_propagating_vgws))}"]

  tags {
    Name = "${var.name}-private"
  }
}

resource "aws_subnet" "private" {
  vpc_id            = "${aws_vpc.mod.id}"
  cidr_block        = "${element(split(",", var.private_subnets), count.index)}"
  availability_zone = "${element(split(",", var.azs), count.index)}"
  count             = "${length(compact(split(",", var.private_subnets)))}"

  tags {
    Name = "${var.name}-private"
  }
}

resource "aws_subnet" "public" {
  vpc_id            = "${aws_vpc.mod.id}"
  cidr_block        = "${element(split(",", var.public_subnets), count.index)}"
  availability_zone = "${element(split(",", var.azs), count.index)}"
  count             = "${length(compact(split(",", var.public_subnets)))}"

  tags {
    Name = "${var.name}-public"
  }

  map_public_ip_on_launch = true
}

resource "aws_db_subnet_group" "database" {
  name         = "${var.name}-rds-subnet-group-${count.index}"
  description  = "Database subnet groups for ${var.name}"
  subnet_ids   = ["${aws_subnet.private.*.id}"]
  #tags        = "${merge(var.tags, map("Name", format("%s-database-subnet-group", var.name)))}"
  count        = "${length(compact(split(",", var.private_subnets)))}"
}

resource "aws_route_table_association" "private" {
  count          = "${length(compact(split(",", var.private_subnets)))}"
  subnet_id      = "${element(aws_subnet.private.*.id, count.index)}"
  route_table_id = "${aws_route_table.private.id}"
}

resource "aws_route_table_association" "public" {
  count          = "${length(compact(split(",", var.public_subnets)))}"
  subnet_id      = "${element(aws_subnet.public.*.id, count.index)}"
  route_table_id = "${aws_route_table.public.id}"
}

Contents of modules/vpc/outputs.tf

output "vpc_id" {
  value = "${aws_vpc.mod.id}"
}

output "public_subnet_ids" {
  value = ["${aws_subnet.public.*.id}"]
}

output "private_subnet_ids" {
  value = ["${aws_subnet.private.*.id}"]
}

output "aws_db_subnet_group_database" {
  value = "${aws_db_subnet_group.database.name}"
}

Contents of modules/acl/main.tf

resource "aws_network_acl" "private_app_subnets" {
  vpc_id = "${var.vpc_id}"

  subnet_ids = ["${var.private_subnet_ids}"]
}

Can you post your full modules/vpc/main.tf and modules/acl/main.tf ? — strongjz
Why do you have a count on your aws_db_subnet_group? The subnet group spans multiple subnets and then you put the database instance inside the aws_db_subnet_group allowing it to move across the subnets specified by the subnet group. I'm a little surprised that your VPC module output isn't failing because there shouldn't be a aws_db_subnet_group.database.name value due to the use of a count. Removing the count from the subnet group should be enough to make it work though. — ydaetskcoR

Suhas Rao Suhas Rao · Accepted Answer · 2017-09-01T04:59:06

The issue was, i had enabled the "Publicly Accessible" to true, while trying to add the RDS instance to private subnet. I had to remove the count from aws_db_subnet_group like ydaetskcoR told me to, of course.

Create AWS RDS instance in non default VPC using terraform

1 Answers