Terraform创建单Aurora集群 配置工作时段启停调度排查

• 需求：为非生产环境搭建单实例Aurora集群，配置非工作时段自动关机、工作时段自动启动的调度策略
• 故障现象：配置的调度器无法成功关联连接目标RDS集群
• 现有Terraform配置代码如下：

provider "aws" {
  region = local.region

}

locals {
  name   = "example-aurora"
  region = "us-east-1"
  tags   = {
    Owner       = "user"
    Environment = "dev"
  }
}

################################################################################
# Supporting Resources
################################################################################

resource "random_password" "master" {
  length = 10
}

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 3.0"

  name = "aurora_vpc"
  cidr = "10.99.0.0/18"

  enable_dns_support   = true
  enable_dns_hostnames = true

  azs              = ["${local.region}a", "${local.region}b", "${local.region}c"]
  public_subnets   = ["10.99.0.0/24", "10.99.1.0/24", "10.99.2.0/24"]
  private_subnets  = ["10.99.3.0/24", "10.99.4.0/24", "10.99.5.0/24"]
  database_subnets = ["10.99.7.0/24", "10.99.8.0/24", "10.99.9.0/24"]

  tags = local.tags
}

resource "aws_db_parameter_group" "muffy-pg" {
  family = "postgres13"
  name   = "peter-rds-param-group"
  parameter {
    apply_method = "immediate"
    name         = "autovacuum_naptime"
    value        = "30"
  }
  parameter {
    apply_method = "pending-reboot"
    name         = "autovacuum_max_workers"
    value        = "15"
  }
}

resource "aws_docdb_cluster_parameter_group" "muffy-cluster-pg" {
  name   = "peter-rds-param-group"
  family = "postgres13"
}

module "cluster" {
  source = "terraform-aws-modules/rds-aurora/aws"



  name           = "test-aurora-db-postgres96"
  engine         = "aurora-postgresql"
  engine_version = "13.7"
  instance_class = "db.t3.small"
  instances      = {
    one = {}
    two = {}
  }

  vpc_id  = module.vpc.vpc_id
  subnets = [module.vpc.database_subnets[0], module.vpc.database_subnets[1], module.vpc.database_subnets[2]]

  #  allowed_security_groups = ["sg-12345678"]
  allowed_cidr_blocks = ["10.99.0.0/18"]

  storage_encrypted   = true
  apply_immediately   = true
  monitoring_interval = 10


  db_parameter_group_name         = aws_db_parameter_group.muffy-pg.name
  db_cluster_parameter_group_name = aws_docdb_cluster_parameter_group.muffy-cluster-pg.name

  enabled_cloudwatch_logs_exports = ["postgresql"]

  tags = {
    Environment = "dev"
    Terraform   = "true"
  }
}

variable "environment" {
  default = "dev"
}

module "rds_schedule" {
  depends_on = [module.cluster]
  source     = "github.com/barryw/terraform-aws-rds-scheduler"
  # version = "~> 2.0.0"

  /* Don't stop RDS in production! */
  skip_execution = var.environment == "prod"
  identifier     = "peter-scheduler"

  /* Start the RDS cluster at 6:50am EDT Monday - Friday */
  up_schedule   = "cron(50 10 ? * MON-FRI *)"
  /* Stop the RDS cluster at 9pm EDT every night */
  down_schedule = "cron(0 1 * * ? *)"

  rds_identifier = module.cluster.identifier
  is_cluster     = true
}

• 参数组资源类型错误：配置中使用aws_docdb_cluster_parameter_group（DocumentDB服务专用参数组）关联Aurora PostgreSQL集群，且实例参数组的family配置为普通RDS的postgres13，与Aurora引擎不匹配，会导致集群创建状态异常，调度器无法识别可用的集群目标。
• 集群实例配置不符合需求：需求为单实例集群，但当前instances块定义了2个数据库实例，多实例状态会干扰调度器的启停逻辑。
• 调度模块配置缺陷：调度模块未固定版本，直接拉取Github分支代码可能出现参数不兼容；仅传入集群标识符未传入集群ARN，也未显式配置调度执行角色的RDS操作权限，导致Lambda执行启停操作时无权限访问目标集群。
• 冗余依赖配置：使用depends_on强制建立依赖会跳过参数校验，当集群输出属性异常时，调度模块会传入无效的集群标识符。

1. 替换错误的参数组资源，使用Aurora专用的RDS集群参数组，修正参数组family配置为aurora-postgresql13
2. 调整集群实例数量为1，符合单实例需求
3. 固定调度模块版本，传入正确的集群ARN，显式配置调度执行角色的RDS操作权限
4. 移除冗余的depends_on配置，通过属性引用自动建立资源依赖
5. 保留适配EDT时区的cron表达式（EventBridge默认使用UTC时区，当前表达式已对应EDT 6:50启动、21:00关机）

修正后的核心配置片段：

# 修正实例参数组配置
resource "aws_db_parameter_group" "muffy-pg" {
  family = "aurora-postgresql13"
  name   = "peter-rds-param-group"
  parameter {
    apply_method = "immediate"
    name         = "autovacuum_naptime"
    value        = "30"
  }
  parameter {
    apply_method = "pending-reboot"
    name         = "autovacuum_max_workers"
    value        = "15"
  }
}

# 替换为Aurora专用集群参数组
resource "aws_rds_cluster_parameter_group" "muffy-cluster-pg" {
  name   = "peter-aurora-cluster-param-group"
  family = "aurora-postgresql13"
}

module "cluster" {
  source = "terraform-aws-modules/rds-aurora/aws"

  name           = "test-aurora-db-postgres"
  engine         = "aurora-postgresql"
  engine_version = "13.7"
  instance_class = "db.t3.small"
  # 调整为单实例
  instances      = {
    one = {}
  }

  vpc_id  = module.vpc.vpc_id
  subnets = [module.vpc.database_subnets[0], module.vpc.database_subnets[1], module.vpc.database_subnets[2]]

  allowed_cidr_blocks = ["10.99.0.0/18"]

  storage_encrypted   = true
  apply_immediately   = true
  monitoring_interval = 10

  db_parameter_group_name         = aws_db_parameter_group.muffy-pg.name
  db_cluster_parameter_group_name = aws_rds_cluster_parameter_group.muffy-cluster-pg.name

  enabled_cloudwatch_logs_exports = ["postgresql"]

  tags = {
    Environment = "dev"
    Terraform   = "true"
  }
}

module "rds_schedule" {
  source  = "github.com/barryw/terraform-aws-rds-scheduler"
  version = "~> 2.0.0"

  skip_execution = var.environment == "prod"
  identifier     = "peter-scheduler"

  up_schedule   = "cron(50 10 ? * MON-FRI *)"
  down_schedule = "cron(0 1 * * ? *)"

  # 传入集群正确的标识和ARN
  rds_identifier = module.cluster.cluster_identifier
  rds_arn        = module.cluster.cluster_arn
  is_cluster     = true

  # 显式给调度角色授权RDS启停权限
  additional_policy_permissions = [
    {
      Effect = "Allow"
      Action = [
        "rds:StartDBCluster",
        "rds:StopDBCluster",
        "rds:DescribeDBClusters"
      ]
      Resource = module.cluster.cluster_arn
    }
  ]
}

• 执行terraform init初始化，拉取固定版本的模块，确认无版本冲突报错
• 执行terraform plan预览变更，确认参数组、集群、调度资源的关联属性无错误
• 部署完成后，进入AWS EventBridge控制台手动触发一次停机规则，等待5-10分钟验证集群是否正常进入停止状态，再触发起机规则验证启动逻辑
• 若仍关联失败，检查调度模块生成的Lambda执行角色的信任策略、权限策略，确认允许Lambda服务代入角色，且拥有目标集群的启停操作权限

内容的提问来源于stack exchange，提问作者peter cooke