Add Terraform equivalent of RDS/RDS_PIOPS.yaml

[samanthataylor3]

Summary

Adds RDS/RDS_PIOPS_terraform/ — a Terraform configuration functionally equivalent to RDS/RDS_PIOPS.yaml. The original CloudFormation file is untouched.

New files:

File	Purpose
main.tf	random_password (16-char, excludes "@/\), aws_secretsmanager_secret + _version, aws_db_instance (MySQL, 100 GB, io1/1000 IOPS, encrypted, not public, skip_final_snapshot = true)
variables.tf	var.db_user — sensitive, validated to match CFN AllowedPattern (^[a-zA-Z][a-zA-Z0-9]*$, 1-16 chars)
outputs.tf	db_instance_endpoint, db_instance_arn, secret_arn

Key mapping notes:

• CFN infers storage_type from Iops; Terraform requires explicit storage_type = "io1".
• CFN has no skip_final_snapshot concept; Terraform requires it — set to true with a comment recommending final_snapshot_identifier for production.
• override_special on random_password is set to a whitelist of allowed specials (excluding "@/\), matching the CFN ExcludeCharacters.

Passes terraform fmt and terraform validate.

Link to Devin session: https://app.devin.ai/sessions/29bda0e77a9e466db92ab7af6e81c855
Requested by: @samanthataylor3

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

💡 Connect your GitHub account to enable automatic code reviews.

[devin-ai-integration]

Original prompt from Samantha

In the repository COG-GTM/aws-cloudformation-templates, create a new Terraform configuration that is functionally equivalent to RDS/RDS_PIOPS.yaml.

#``# Source file
RDS/RDS_PIOPS.yaml — a CloudFormation template that creates:

1. An AWS::SecretsManager::Secret (DBCredential) with GenerateSecretString (16-char password, excluding "@/\, requiring each character type).
2. An AWS::RDS::DBInstance (myDB) — MySQL, 100 GB allocated storage, db.t3.small, 1000 provisioned IOPS, 7-day backup retention, not publicly accessible, storage encrypted, master username from a parameter, master password resolved from the Secrets Manager secret.

#``# Output
Create the file RDS/RDS_PIOPS_terraform/main.tf (and optionally variables.tf and outputs.tf) with the following Terraform resources:

#``#``# variables.tf

• variable "db_user" — sensitive string, with validation that it is 1-16 chars, starts with a letter, and is alphanumeric only (mirroring the CFN AllowedPattern [a-zA-Z][a-zA-Z0-9]*).

#``#``# main.tf

1. A terraform block requiring aws provider >= 5.0 and random provider >= 3.0.
2. A random_password resource to generate a 16-character password, with override_special set to exclude "@/\ (matching the CFN ExcludeCharacters).
3. An aws_secretsmanager_secret resource for the DB credential.
4. An aws_secretsmanager_secret_version resource that stores the generated password in the secret.
5. An aws_db_instance resource with:
   • allocated_storage = 100
   • instance_class = "db.t3.small"
   • backup_retention_period = 7
   • engine = "mysql"
   • iops = 1000
   • storage_type = "io1" (required by Terraform for provisioned IOPS; CFN infers this)
   • username = var.db_user
   • password = random_password.db_password.result
   • publicly_accessible = false
   • storage_encrypted = true
   • skip_final_snapshot = true (Terraform requires this to be set explicitly; add a comment noting that production usage should use `final_... (502 chars truncated...)

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring