/creating-amazon-aurora-db-cluster-with-instances

Create Aurora Database Cluster with Instance

Overview

This SOP creates a complete Amazon Aurora database setup by first creating an empty Aurora cluster, then adding a database instance to make it queryable. The SOP uses AWS Secrets Manager for password management and includes proper status monitoring with retry logic.

Parameters

• cluster_identifier (required): Unique identifier for the Aurora cluster
• instance_identifier (required): Unique identifier for the Aurora instance
• engine (required): Database engine type (aurora-mysql or aurora-postgresql)
• engine_version (optional): Specific engine version to use
• master_username (required): Master username for the database
• instance_class (optional, default: db.t3.medium): Instance class for the database instance (e.g., db.r6g.large)
• database_name (optional): Name of the initial database to create
• vpc_security_group_ids (optional): Comma-separated list of VPC security group IDs
• db_subnet_group_name (optional): Name of the DB subnet group
• backup_retention_period (optional, default: 7): Number of days to retain backups
• preferred_backup_window (optional): Preferred backup window in UTC
• preferred_maintenance_window (optional): Preferred maintenance window
• storage_encrypted (optional, default: true): Enable encryption at rest for the database
• kms_key_id (optional): KMS key ID for encryption (uses default if not specified)

Steps

1. Verify Dependencies

Check for required tools and warn the user if any are missing.

Constraints:

• You MUST verify the following tools are available in your context: call_aws
• You MUST inform the user about any missing tools with a clear message
• You MUST ask if the user wants to proceed anyway despite missing tools
• You MUST respect the user's decision to proceed or abort

2. Validate AWS Credentials and Permissions

Verify that AWS credentials are configured and have necessary permissions.

Constraints:

• You MUST check current AWS identity using aws sts get-caller-identity
• You MUST verify the user has permissions to create RDS clusters and instances
• You SHOULD inform the user about the AWS account and region being used
• You MUST abort if credentials are not properly configured
• You MUST NOT retrieve or display the actual password value because passwords should never be exposed in logs or outputs

3. Create Aurora Database Cluster

Create the Aurora cluster with the specified configuration.

Constraints:

• You MUST use call_aws to create the cluster with: aws rds create-db-cluster --db-cluster-identifier {cluster_identifier} --engine {engine} --master-username {master_username} --manage-master-user-password --master-user-secret-kms-key-id alias/aws/secretsmanager --storage-encrypted
• You MUST add --kms-key-id {kms_key_id} if kms_key_id parameter is provided
• You MUST add --no-storage-encrypted only if storage_encrypted is explicitly set to false (encryption is recommended for production)
• You MUST NOT use any password-related parameters like --master-user-password because managed passwords from Secrets Manager must be used exclusively
• You SHOULD include optional parameters like --engine-version, --database-name, --vpc-security-group-ids, --db-subnet-group-name, --backup-retention-period, --preferred-backup-window, --preferred-maintenance-window if provided
• You MUST capture the cluster creation response for monitoring purposes

4. Monitor Cluster Creation Status

Wait for the cluster to become available before creating the instance.

Constraints:

• You MUST use call_aws to check cluster status with: aws rds describe-db-clusters --db-cluster-identifier {cluster_identifier}
• You MUST retry status checks using only the call_aws tool and MUST NOT use any system tools for waiting or sleeping because system tools are not available in this context
• You MUST check the cluster status by making repeated call_aws calls
• You MUST continue monitoring until the cluster status is "available"
• You MUST abort if the cluster status becomes "failed" or remains in a pending state for more than 20 minutes
• You MUST provide status updates to the user during the waiting period

5. Create Database Instance

Create the database instance and attach it to the cluster.

Constraints:

• You MUST use call_aws to create the instance with: aws rds create-db-instance --db-instance-identifier {instance_identifier} --db-cluster-identifier {cluster_identifier} --db-instance-class {instance_class} --engine {engine}
• You MUST NOT specify password-related parameters for the instance because it inherits authentication from the cluster
• You MUST include the engine parameter to ensure compatibility with the cluster
• You MUST capture the instance creation response for monitoring purposes
• You MUST provide an ARN of the managed secret used for created cluster

6. Monitor Instance Creation Status

Wait for the instance to become available.

Constraints:

• You MUST use call_aws to check instance status with: aws rds describe-db-instances --db-instance-identifier {instance_identifier}
• You MUST retry status checks using only the call_aws tool and MUST NOT use any system tools for waiting because system tools are not available in this context
• You MUST check the instance status by making repeated call_aws calls
• You MUST continue monitoring until the instance status is "available"
• You MUST abort if the instance status becomes "failed" or remains in a pending state for more than 20 minutes
• You MUST provide status updates to the user during the waiting period

7. Retrieve Connection Information

Gather the necessary connection details for the user.

Constraints:

• You MUST use call_aws to get cluster endpoint information with: aws rds describe-db-clusters --db-cluster-identifier {cluster_identifier}
• You MUST extract and display the cluster endpoint URL, port, and database name
• You MUST remind the user that the password is managed in AWS Secrets Manager under the secret name provided
• You MUST NOT attempt to retrieve or display the actual password value because passwords should never be exposed

8. Validate Final Setup

Confirm that both cluster and instance are properly configured and available.

Constraints:

• You MUST perform a final status check on both the cluster and instance
• You MUST verify that the instance is properly associated with the cluster
• You MUST confirm that managed password authentication is enabled
• You MUST provide a summary of the created resources including identifiers and endpoints

Examples

Example Input

cluster_identifier: my-aurora-cluster
instance_identifier: my-aurora-instance-1
engine: aurora-mysql
engine_version: 8.0.mysql_aurora.3.02.0
master_username: admin
instance_class: db.r6g.large
database_name: myapp
backup_retention_period: 7
preferred_backup_window: 03:00-04:00
preferred_maintenance_window: sun:04:00-sun:05:00
storage_encrypted: true
kms_key_id: arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012

Example Output

Aurora cluster 'my-aurora-cluster' created successfully
Aurora instance 'my-aurora-instance-1' created and attached to cluster
Cluster endpoint: my-aurora-cluster.cluster-xyz.us-east-1.rds.amazonaws.com:3306
Database name: myapp
Master username: admin
Password: Managed in AWS Secrets Manager (ARN: arn:aws:secretsmanager:us-east-1:123456789012:secret:rds-db-credentials/cluster-ABCDEFGHIJKLMNOP/admin-AbCdEf)

Troubleshooting

Cluster Creation Fails

If cluster creation fails, check that the engine version is supported in your region and that you have sufficient permissions for RDS and Secrets Manager operations.

Instance Creation Fails

If instance creation fails after successful cluster creation, verify that the instance class is compatible with the Aurora engine and available in your region's availability zones.

Long Creation Times

Aurora cluster and instance creation can take 10-20 minutes. The script will monitor progress and provide updates, but extended wait times are normal for Aurora resources.