Terraform, EKS and a aurora-mysql serverless RDS - subnets in same AZ

Question

I've started with Terraform a while back, and I've been working on an AWS dev env where I need to put up EKS and a aurora-mysql serverless RDS, and get them to talk to one another.

I used the excellent examples here:

https://github.com/terraform-aws-modules/terraform-aws-eks/tree/master/examples/managed_node_groups

and here:

https://github.com/terraform-aws-modules/terraform-aws-rds-aurora/tree/master/examples/serverless (this actually is set to put up a aurora-mysql serverless DB, not postgres as advertised, but mysql is what I'm looking for so, cheers).

So far so good, the serverless example uses the default VPC and that's fine for games. But I want to either:

1. Create the RDS in the same VPC as the EKS to simplify networking:

Towards that end, I added the contents of ....terraform-aws-rds-aurora/examples/serverless/main.tf to ....terraform-aws-eks/examples/managed_node_groups/main.tf and set the tf files from ....terraform-aws-rds-aurora to a folder, and set it like so:

module "aurora" {
  source = "../../modules/aurora"

and replaced:

data.aws_vpc.default.id

with

module.vpc.vpc_id

and I got:

Error: error creating RDS cluster: InvalidParameterValue: Aurora Serverless doesn't support DB subnet groups with subnets in the same Availability Zone. Choose a DB subnet group with subnets in different Availability Zones. status code: 400, request id: 7d2e359f-6609-4dde-b63e-11a16d1efaf2 on ../../modules/aurora/main.tf line 33, in resource "aws_rds_cluster" "this": 33: resource "aws_rds_cluster" "this" {

fair is fair, I read some and realized that I might prefer a different VPC for EKS and RDS in order for each to have redundancy over all AZs in us-west-2. So now I tried -

Creating a new VPC for RDS:

I went back to ..../terraform-aws-rds-aurora/tree/master/examples/serverless/main.tf , and set:

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 2.6"

  name                 = "${var.env}-mysql-vpc"
  cidr                 = "172.16.0.0/16"
  azs                  = data.aws_availability_zones.available.names
  private_subnets      = ["172.16.7.0/24", "172.16.8.0/24", "172.16.9.0/24"]
  public_subnets       = ["172.16.10.0/24", "172.16.11.0/24", "172.16.12.0/24"]
  enable_nat_gateway   = true
  single_nat_gateway   = true
  enable_dns_hostnames = true
}

data "aws_vpc" "created" {
  id = module.vpc.vpc_id
}

data "aws_subnet_ids" "all" {
  vpc_id = data.aws_vpc.created.id
}

and got the same message!

I'm stumped. I don't want to use the default VPC for RDS, and eventually I'll want to edit the VPC for security/configurations.

My questions are:

Is it possible and practical for both EKS and RDS live together in the same VPC?
Seeing that the example runs fine with the default VPC, what am I missing with the VPC creation for RDS?
Can Terraform create an "empty" VPC and the aurora module will then create subnets in it? Or is there a simple way for me to then create the missing subnets (while specifying the AZ for each) and the rest of the VPC requirements for serverless?

I realize that this falls between AWS and Terraform, but will appreciate your help.

Hi, can you validate the db subnet group thats getting created only has 1 az? — Chris Williams
When running successfully with the default vpc, the subnet group has four subnbets, each in a different az — Nahshon paz
But the Aurora DB subnet group, can you validate what its creating? — Chris Williams
@mokugo-devops I'm thinking that the issue is that when creating subnets using the terraform-aws-modules/vpc/aws source , I can't ensure that the subnets will be created each in a different az per the RDS serverles requirement. I'm looking into other examples of creating a minimal VPC for serverless, will appreciate directions/examples... — Nahshon paz

Nahshon paz Nahshon paz · Accepted Answer · 2020-05-25T07:22:21

Thanks to @mokugo-devops comments I was able to create a new VPC where each subnet had a different AZ. But as it turns out, EKS and Aurora Serverless can live in the same VPC, I just needed to get the public subnets only (that are created by terraform-aws-modules/vpc/aws in different AZs) for serverless, like so:

and have the module "aurora" read them them like so:

module "aurora" {
  source                = "../../modules/aurora"
  name                  = "aurora-serverless"
  engine                = "aurora"
  engine_mode           = "serverless"
  replica_scale_enabled = false
  replica_count         = 0
  backtrack_window = 10 # ignored in serverless

  subnets               = module.vpc.public_subnets

Terraform, EKS and a aurora-mysql serverless RDS - subnets in same AZ

1 Answers