add(outputs): paramter_group_name and option_group_name

.github/mergify.yml

@@ -1 +1,76 @@
-extends: .github
+# https://docs.mergify.io/conditions.html
+# https://docs.mergify.io/actions.html
+pull_request_rules:
+- name: "approve automated PRs that have passed checks"
+  conditions:
+  - "author~=^(cloudpossebot|renovate\\[bot\\])$"
+  - "-closed"
+  - "head~=^(auto-update|renovate)/.*"
+  - "check-success=test/bats"
+  - "check-success=test/readme"
+  - "check-success=test/terratest"
+  - "check-success=validate-codeowners"
+  - or:
+    - "base=master"
+    - "base=main"
+    - "base~=^release/v\\d{1,2}$"
+
+  actions:
+    review:
+      type: "APPROVE"
+      bot_account: "cloudposse-mergebot"
+      message: "We've automatically approved this PR because the checks from the automated Pull Request have passed."
+
+- name: "merge automated PRs when approved and tests pass"
+  conditions:
+  - "author~=^(cloudpossebot|renovate\\[bot\\])$"
+  - "-closed"
+  - "head~=^(auto-update|renovate)/.*"
+  - "check-success=test/bats"
+  - "check-success=test/readme"
+  - "check-success=test/terratest"
+  - "check-success=validate-codeowners"
+  - "#approved-reviews-by>=1"
+  - "#changes-requested-reviews-by=0"
+  - "#commented-reviews-by=0"
+  - or:
+    - "base=master"
+    - "base=main"
+    - "base~=^release/v\\d{1,2}$"
+
+  actions:
+    merge:
+      method: "squash"
+
+- name: "delete the head branch after merge"
+  conditions:
+  - "merged"
+  actions:
+    delete_head_branch: {}
+
+- name: "ask to resolve conflict"
+  conditions:
+  - "conflict"
+  - "-closed"
+  actions:
+    comment:
+      message: "This pull request is now in conflict. Could you fix it @{{author}}? 🙏"
+
+- name: "remove outdated reviews"
+  conditions:
+  - or:
+    - "base=master"
+    - "base=main"
+    - "base~=^release/v\\d{1,2}$"
+  actions:
+    dismiss_reviews:
+      changes_requested: true
+      approved: true
+      message: "This Pull Request has been updated, so we're dismissing all reviews."
+
+- name: "close Pull Requests without files changed"
+  conditions:
+    - "#files=0"
+  actions:
+    close:
+      message: "This pull request has been automatically closed by Mergify because there are no longer any changes."

.github/workflows/feature-branch.yml

@@ -11,9 +11,9 @@ permissions:
   pull-requests: write
   id-token: write
   contents: write
-  issues: write
 
 jobs:
   terraform-module:
     uses: cloudposse/github-actions-workflows-terraform-module/.github/workflows/feature-branch.yml@main
-    secrets: inherit
+    secrets:
+      github_access_token: ${{ secrets.REPO_ACCESS_TOKEN }}

.github/workflows/release-branch.yml

@@ -4,17 +4,20 @@ on:
   push:
     branches:
       - main
-      - release/v*
+      - release/**
     paths-ignore:
       - '.github/**'
       - 'docs/**'
       - 'examples/**'
       - 'test/**'
-      - 'README.md'
+      - 'README.*'
 
-permissions: {}
+permissions:
+  contents: write
+  id-token: write
 
 jobs:
   terraform-module:
     uses: cloudposse/github-actions-workflows-terraform-module/.github/workflows/release-branch.yml@main
-    secrets: inherit
+    secrets:
+      github_access_token: ${{ secrets.REPO_ACCESS_TOKEN }}

.github/workflows/release-published.yml

@@ -5,9 +5,10 @@ on:
     types:
       - published
 
-permissions: {}
+permissions:
+  contents: write
+  id-token: write
 
 jobs:
   terraform-module:
     uses: cloudposse/github-actions-workflows-terraform-module/.github/workflows/release-published.yml@main
-    secrets: inherit

.github/workflows/scheduled.yml

@@ -13,4 +13,5 @@ permissions:
 jobs:
   scheduled:
     uses: cloudposse/github-actions-workflows-terraform-module/.github/workflows/scheduled.yml@main
-    secrets: inherit
+    secrets:
+      github_access_token: ${{ secrets.REPO_ACCESS_TOKEN }}

README.md

@@ -235,7 +235,7 @@ Available targets:
 | <a name="input_database_password"></a> [database\_password](#input\_database\_password) | Password for the primary DB user. Required unless a `snapshot_identifier` or `replicate_source_db` is provided. | `string` | `null` | no |
 | <a name="input_database_port"></a> [database\_port](#input\_database\_port) | Database port (\_e.g.\_ `3306` for `MySQL`). Used in the DB Security Group to allow access to the DB instance from the provided `security_group_ids` | `number` | n/a | yes |
 | <a name="input_database_user"></a> [database\_user](#input\_database\_user) | Username for the primary DB user. Required unless a `snapshot_identifier` or `replicate_source_db` is provided. | `string` | `null` | no |
-| <a name="input_db_options"></a> [db\_options](#input\_db\_options) | A list of DB options to apply with an option group. Depends on DB engine | <pre>list(object({<br>    db_security_group_memberships  = list(string)<br>    option_name                    = string<br>    port                           = number<br>    version                        = string<br>    vpc_security_group_memberships = list(string)<br><br>    option_settings = list(object({<br>      name  = string<br>      value = string<br>    }))<br>  }))</pre> | `[]` | no |
+| <a name="input_db_options"></a> [db\_options](#input\_db\_options) | A list of DB options to apply with an option group. Depends on DB engine | <pre>list(object({<br>    option_name                    = string<br>    port                           = optional(number, null)<br>    version                        = string<br>    db_security_group_memberships  = optional(list(string), [])<br>    vpc_security_group_memberships = optional(list(string), [])<br>    option_settings = optional(list(object({<br>      name  = string<br>      value = string<br>    })), [])<br>  }))</pre> | `[]` | no |
 | <a name="input_db_parameter"></a> [db\_parameter](#input\_db\_parameter) | A list of DB parameters to apply. Note that parameters may differ from a DB family to another | <pre>list(object({<br>    apply_method = string<br>    name         = string<br>    value        = string<br>  }))</pre> | `[]` | no |
 | <a name="input_db_parameter_group"></a> [db\_parameter\_group](#input\_db\_parameter\_group) | The DB parameter group family name. The value depends on DB engine used. See [DBParameterGroupFamily](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBParameterGroup.html#API_CreateDBParameterGroup_RequestParameters) for instructions on how to retrieve applicable value. | `string` | n/a | yes |
 | <a name="input_db_subnet_group_name"></a> [db\_subnet\_group\_name](#input\_db\_subnet\_group\_name) | Name of DB subnet group. DB instance will be created in the VPC associated with the DB subnet group. Specify one of `subnet_ids`, `db_subnet_group_name` or `availability_zone` | `string` | `null` | no |
@@ -302,7 +302,9 @@ Available targets:
 | <a name="output_instance_id"></a> [instance\_id](#output\_instance\_id) | ID of the instance |
 | <a name="output_master_user_secret"></a> [master\_user\_secret](#output\_master\_user\_secret) | Secret object if configured with `var.database_manage_master_user_password = true`. |
 | <a name="output_option_group_id"></a> [option\_group\_id](#output\_option\_group\_id) | ID of the Option Group |
+| <a name="output_option_group_name"></a> [option\_group\_name](#output\_option\_group\_name) | Name of the Option Group |
 | <a name="output_parameter_group_id"></a> [parameter\_group\_id](#output\_parameter\_group\_id) | ID of the Parameter Group |
+| <a name="output_parameter_group_name"></a> [parameter\_group\_name](#output\_parameter\_group\_name) | Name of the Parameter Group |
 | <a name="output_resource_id"></a> [resource\_id](#output\_resource\_id) | The RDS Resource ID of this instance. |
 | <a name="output_security_group_id"></a> [security\_group\_id](#output\_security\_group\_id) | ID of the Security Group |
 | <a name="output_subnet_group_id"></a> [subnet\_group\_id](#output\_subnet\_group\_id) | ID of the created Subnet Group |

docs/terraform.md

@@ -58,7 +58,7 @@
 | <a name="input_database_password"></a> [database\_password](#input\_database\_password) | Password for the primary DB user. Required unless a `snapshot_identifier` or `replicate_source_db` is provided. | `string` | `null` | no |
 | <a name="input_database_port"></a> [database\_port](#input\_database\_port) | Database port (\_e.g.\_ `3306` for `MySQL`). Used in the DB Security Group to allow access to the DB instance from the provided `security_group_ids` | `number` | n/a | yes |
 | <a name="input_database_user"></a> [database\_user](#input\_database\_user) | Username for the primary DB user. Required unless a `snapshot_identifier` or `replicate_source_db` is provided. | `string` | `null` | no |
-| <a name="input_db_options"></a> [db\_options](#input\_db\_options) | A list of DB options to apply with an option group. Depends on DB engine | <pre>list(object({<br>    db_security_group_memberships  = list(string)<br>    option_name                    = string<br>    port                           = number<br>    version                        = string<br>    vpc_security_group_memberships = list(string)<br><br>    option_settings = list(object({<br>      name  = string<br>      value = string<br>    }))<br>  }))</pre> | `[]` | no |
+| <a name="input_db_options"></a> [db\_options](#input\_db\_options) | A list of DB options to apply with an option group. Depends on DB engine | <pre>list(object({<br>    option_name                    = string<br>    port                           = optional(number, null)<br>    version                        = string<br>    db_security_group_memberships  = optional(list(string), [])<br>    vpc_security_group_memberships = optional(list(string), [])<br>    option_settings = optional(list(object({<br>      name  = string<br>      value = string<br>    })), [])<br>  }))</pre> | `[]` | no |
 | <a name="input_db_parameter"></a> [db\_parameter](#input\_db\_parameter) | A list of DB parameters to apply. Note that parameters may differ from a DB family to another | <pre>list(object({<br>    apply_method = string<br>    name         = string<br>    value        = string<br>  }))</pre> | `[]` | no |
 | <a name="input_db_parameter_group"></a> [db\_parameter\_group](#input\_db\_parameter\_group) | The DB parameter group family name. The value depends on DB engine used. See [DBParameterGroupFamily](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBParameterGroup.html#API_CreateDBParameterGroup_RequestParameters) for instructions on how to retrieve applicable value. | `string` | n/a | yes |
 | <a name="input_db_subnet_group_name"></a> [db\_subnet\_group\_name](#input\_db\_subnet\_group\_name) | Name of DB subnet group. DB instance will be created in the VPC associated with the DB subnet group. Specify one of `subnet_ids`, `db_subnet_group_name` or `availability_zone` | `string` | `null` | no |
@@ -125,7 +125,9 @@
 | <a name="output_instance_id"></a> [instance\_id](#output\_instance\_id) | ID of the instance |
 | <a name="output_master_user_secret"></a> [master\_user\_secret](#output\_master\_user\_secret) | Secret object if configured with `var.database_manage_master_user_password = true`. |
 | <a name="output_option_group_id"></a> [option\_group\_id](#output\_option\_group\_id) | ID of the Option Group |
+| <a name="output_option_group_name"></a> [option\_group\_name](#output\_option\_group\_name) | Name of the Option Group |
 | <a name="output_parameter_group_id"></a> [parameter\_group\_id](#output\_parameter\_group\_id) | ID of the Parameter Group |
+| <a name="output_parameter_group_name"></a> [parameter\_group\_name](#output\_parameter\_group\_name) | Name of the Parameter Group |
 | <a name="output_resource_id"></a> [resource\_id](#output\_resource\_id) | The RDS Resource ID of this instance. |
 | <a name="output_security_group_id"></a> [security\_group\_id](#output\_security\_group\_id) | ID of the Security Group |
 | <a name="output_subnet_group_id"></a> [subnet\_group\_id](#output\_subnet\_group\_id) | ID of the created Subnet Group |

main.tf

@@ -142,21 +142,22 @@ resource "aws_db_parameter_group" "default" {
 }
 
 resource "aws_db_option_group" "default" {
-  count = length(var.option_group_name) == 0 && module.this.enabled ? 1 : 0
-
-  name_prefix          = "${module.this.id}${module.this.delimiter}"
+  name                 = var.option_group_name
+  count                = 1
   engine_name          = var.engine
-  major_engine_version = local.major_engine_version
-  tags                 = module.this.tags
+  major_engine_version = var.major_engine_version
+  tags                 = var.tags
 
   dynamic "option" {
     for_each = var.db_options
     content {
-      db_security_group_memberships  = lookup(option.value, "db_security_group_memberships", null)
-      option_name                    = option.value.option_name
-      port                           = lookup(option.value, "port", null)
-      version                        = lookup(option.value, "version", null)
-      vpc_security_group_memberships = lookup(option.value, "vpc_security_group_memberships", null)
+      option_name = option.value.option_name
+      version     = lookup(option.value, "version", null)
+
+      # Include port and security groups only if they are defined and not for SQLSERVER_BACKUP_RESTORE
+      db_security_group_memberships  = option.value.option_name != "SQLSERVER_BACKUP_RESTORE" ? lookup(option.value, "db_security_group_memberships", []) : null
+      vpc_security_group_memberships = option.value.option_name != "SQLSERVER_BACKUP_RESTORE" ? lookup(option.value, "vpc_security_group_memberships", []) : null
+      port                           = option.value.option_name != "SQLSERVER_BACKUP_RESTORE" ? lookup(option.value, "port", null) : null
 
       dynamic "option_settings" {
         for_each = lookup(option.value, "option_settings", [])
@@ -167,12 +168,7 @@ resource "aws_db_option_group" "default" {
       }
     }
   }
-
-  lifecycle {
-    create_before_destroy = true
-  }
 }
-
 resource "aws_db_subnet_group" "default" {
   count = module.this.enabled && local.subnet_ids_provided && !local.db_subnet_group_name_provided ? 1 : 0
 

outputs.tf

@@ -28,11 +28,21 @@ output "security_group_id" {
   description = "ID of the Security Group"
 }
 
+output "parameter_group_name" {
+  value       = join("", aws_db_parameter_group.default[*].name)
+  description = "Name of the Parameter Group"
+}
+
 output "parameter_group_id" {
   value       = join("", aws_db_parameter_group.default[*].id)
   description = "ID of the Parameter Group"
 }
 
+output "option_group_name" {
+  value       = join("", aws_db_option_group.default[*].name)
+  description = "Name of the Option Group"
+}
+
 output "option_group_id" {
   value       = join("", aws_db_option_group.default[*].id)
   description = "ID of the Option Group"

variables.tf

@@ -251,19 +251,17 @@ variable "db_parameter" {
 
 variable "db_options" {
   type = list(object({
-    db_security_group_memberships  = list(string)
     option_name                    = string
-    port                           = number
+    port                           = optional(number, null)
     version                        = string
-    vpc_security_group_memberships = list(string)
-
-    option_settings = list(object({
+    db_security_group_memberships  = optional(list(string), [])
+    vpc_security_group_memberships = optional(list(string), [])
+    option_settings = optional(list(object({
       name  = string
       value = string
-    }))
+    })), [])
   }))
-
-  default     = []
+  default = []
   description = "A list of DB options to apply with an option group. Depends on DB engine"
 }