resource "aws_db_instance" "amp-assets-rds-prod-01" {
  #checkov:skip=CKV_AWS_226: Ensure DB instance gets all minor upgrades automatically. Migrated existing instance as-is; upgrades managed manually.
  #checkov:skip=CKV_AWS_157: Ensure that RDS instances have Multi-AZ enabled. Migrated existing instance as-is.
  #checkov:skip=CKV_AWS_161: Ensure RDS database has IAM authentication enabled. Migrated existing instance as-is; uses Secrets Manager.
  #checkov:skip=CKV2_AWS_30: Ensure Postgres RDS as aws_db_instance has Query Logging enabled. Migrated existing instance as-is.
  allocated_storage          = 400
  auto_minor_version_upgrade = false
  #    availability_zone          = "eu-central-1b"
  backup_retention_period   = 7
  backup_window             = "07:00-07:30"
  ca_cert_identifier        = "rds-ca-rsa2048-g1"
  copy_tags_to_snapshot     = true
  customer_owned_ip_enabled = false
  db_name                   = "assets"
  db_subnet_group_name      = "amp-aas-p2-subnet-group"
  delete_automated_backups  = true
  deletion_protection       = true
  enabled_cloudwatch_logs_exports = [
    "postgresql", "upgrade"
  ]
  engine                              = "postgres"
  engine_version                      = "16.13"
  iam_database_authentication_enabled = false
  identifier                          = "amp-assets-rds-prod-01"
  iops                                = 12000
  instance_class                      = "db.m6g.large"
  kms_key_id                          = "arn:aws:kms:eu-central-1:554998489284:key/3792ec44-4fc8-4d6b-a37e-6a2720f7af2e"
  license_model                       = "postgresql-license"
  maintenance_window                  = "sun:08:00-sun:08:30"
  max_allocated_storage               = 550
  monitoring_interval                 = 60
  monitoring_role_arn                 = "arn:aws:iam::554998489284:role/rds-monitoring-role"
  multi_az                            = false
  network_type                        = "IPV4"
  parameter_group_name                = "amp-assets-rds-prod-pg16"
  #    performance_insights_enabled          = true
  #    performance_insights_kms_key_id       = "arn:aws:kms:eu-central-1:554998489284:key/3792ec44-4fc8-4d6b-a37e-6a2720f7af2e"
  #    performance_insights_retention_period = 7
  port                        = 5432
  publicly_accessible         = false
  skip_final_snapshot         = true
  storage_encrypted           = true
  storage_throughput          = 500
  storage_type                = "gp3"
  apply_immediately           = true
  allow_major_version_upgrade = true
  vpc_security_group_ids      = ["sg-0e363d4bb65259f9e"]
  lifecycle {
    ignore_changes = [snapshot_identifier]
  }
  depends_on = [
    aws_db_subnet_group.amp-aas-p2-subnet-group
  ]
}