diff --git a/modules/cloudsql-instance/README.md b/modules/cloudsql-instance/README.md
index e0ceb2992..a0f8e20e1 100644
--- a/modules/cloudsql-instance/README.md
+++ b/modules/cloudsql-instance/README.md
@@ -408,38 +408,38 @@ module "db" {
| name | description | type | required | default |
|---|---|:---:|:---:|:---:|
-| [database_version](variables.tf#L82) | Database type and version to create. | string | ✓ | |
-| [name](variables.tf#L198) | Name of primary instance. | string | ✓ | |
-| [network_config](variables.tf#L203) | Network configuration for the instance. Only one between private_network and psc_config can be used. | object({…}) | ✓ | |
-| [project_id](variables.tf#L246) | The ID of the project where this instances will be created. | string | ✓ | |
-| [region](variables.tf#L251) | Region of the primary instance. | string | ✓ | |
-| [tier](variables.tf#L303) | The machine type to use for the instances. | string | ✓ | |
+| [database_version](variables.tf#L72) | Database type and version to create. | string | ✓ | |
+| [name](variables.tf#L188) | Name of primary instance. | string | ✓ | |
+| [network_config](variables.tf#L193) | Network configuration for the instance. Only one between private_network and psc_config can be used. | object({…}) | ✓ | |
+| [project_id](variables.tf#L236) | The ID of the project where this instances will be created. | string | ✓ | |
+| [region](variables.tf#L241) | Region of the primary instance. | string | ✓ | |
+| [tier](variables.tf#L293) | The machine type to use for the instances. | string | ✓ | |
| [activation_policy](variables.tf#L16) | This variable specifies when the instance should be active. Can be either ALWAYS, NEVER or ON_DEMAND. Default is ALWAYS. | string | | "ALWAYS" |
| [availability_type](variables.tf#L27) | Availability type for the primary replica. Either `ZONAL` or `REGIONAL`. | string | | "ZONAL" |
-| [backup_configuration](variables.tf#L33) | Backup settings for primary instance. Will be automatically enabled if using MySQL with one or more replicas. | object({…}) | | {…} |
-| [collation](variables.tf#L63) | The name of server instance collation. | string | | null |
-| [connector_enforcement](variables.tf#L69) | Specifies if connections must use Cloud SQL connectors. | string | | null |
-| [data_cache](variables.tf#L75) | Enable data cache. Only used for Enterprise MYSQL and PostgreSQL. | bool | | false |
-| [databases](variables.tf#L87) | Databases to create once the primary instance is created. | list(string) | | null |
-| [disk_autoresize_limit](variables.tf#L93) | The maximum size to which storage capacity can be automatically increased. The default value is 0, which specifies that there is no limit. | number | | 0 |
-| [disk_size](variables.tf#L99) | Disk size in GB. Set to null to enable autoresize. | number | | null |
-| [disk_type](variables.tf#L105) | The type of data disk: `PD_SSD` or `PD_HDD`. | string | | "PD_SSD" |
-| [edition](variables.tf#L111) | The edition of the instance, can be ENTERPRISE or ENTERPRISE_PLUS. | string | | "ENTERPRISE" |
-| [encryption_key_name](variables.tf#L117) | The full path to the encryption key used for the CMEK disk encryption of the primary instance. | string | | null |
-| [flags](variables.tf#L123) | Map FLAG_NAME=>VALUE for database-specific tuning. | map(string) | | null |
-| [gcp_deletion_protection](variables.tf#L129) | Set Google's deletion protection attribute which applies across all surfaces (UI, API, & Terraform). | bool | | true |
-| [insights_config](variables.tf#L136) | Query Insights configuration. Defaults to null which disables Query Insights. | object({…}) | | null |
-| [labels](variables.tf#L147) | Labels to be attached to all instances. | map(string) | | null |
-| [maintenance_config](variables.tf#L153) | Set maintenance window configuration and maintenance deny period (up to 90 days). Date format: 'yyyy-mm-dd'. | object({…}) | | {} |
-| [managed_connection_pooling_config](variables.tf#L188) | Configuration for Managed Connection Pooling. NOTE: This feature is only available for PostgreSQL on Enterprise Plus edition instances. | object({…}) | | {} |
-| [password_validation_policy](variables.tf#L222) | Password validation policy configuration for instances. | object({…}) | | null |
-| [prefix](variables.tf#L236) | Optional prefix used to generate instance names. | string | | null |
-| [replicas](variables.tf#L256) | Map of NAME=> {REGION, KMS_KEY, AVAILABILITY_TYPE} for additional read replicas. Set to null to disable replica creation. | map(object({…})) | | {} |
-| [root_password](variables.tf#L267) | Root password of the Cloud SQL instance, or flag to create a random password. Required for MS SQL Server. | object({…}) | | {} |
-| [ssl](variables.tf#L281) | Setting to enable SSL, set config and certificates. | object({…}) | | {} |
-| [terraform_deletion_protection](variables.tf#L296) | Prevent terraform from deleting instances. | bool | | true |
-| [time_zone](variables.tf#L308) | The time_zone to be used by the database engine (supported only for SQL Server), in SQL Server timezone format. | string | | null |
-| [users](variables.tf#L314) | Map of users to create in the primary instance (and replicated to other replicas). For MySQL, anything after the first `@` (if present) will be used as the user's host. Set PASSWORD to null if you want to get an autogenerated password. The user types available are: 'BUILT_IN', 'CLOUD_IAM_USER' or 'CLOUD_IAM_SERVICE_ACCOUNT'. | map(object({…})) | | {} |
+| [backup_configuration](variables.tf#L33) | Backup settings for primary instance. Set to null to leave existing GCP backup settings unmanaged. When set, all fields are managed by Terraform including disabling backups when enabled=false. | object({…}) | | null |
+| [collation](variables.tf#L53) | The name of server instance collation. | string | | null |
+| [connector_enforcement](variables.tf#L59) | Specifies if connections must use Cloud SQL connectors. | string | | null |
+| [data_cache](variables.tf#L65) | Enable data cache. Only used for Enterprise MYSQL and PostgreSQL. | bool | | false |
+| [databases](variables.tf#L77) | Databases to create once the primary instance is created. | list(string) | | null |
+| [disk_autoresize_limit](variables.tf#L83) | The maximum size to which storage capacity can be automatically increased. The default value is 0, which specifies that there is no limit. | number | | 0 |
+| [disk_size](variables.tf#L89) | Disk size in GB. Set to null to enable autoresize. | number | | null |
+| [disk_type](variables.tf#L95) | The type of data disk: `PD_SSD` or `PD_HDD`. | string | | "PD_SSD" |
+| [edition](variables.tf#L101) | The edition of the instance, can be ENTERPRISE or ENTERPRISE_PLUS. | string | | "ENTERPRISE" |
+| [encryption_key_name](variables.tf#L107) | The full path to the encryption key used for the CMEK disk encryption of the primary instance. | string | | null |
+| [flags](variables.tf#L113) | Map FLAG_NAME=>VALUE for database-specific tuning. | map(string) | | null |
+| [gcp_deletion_protection](variables.tf#L119) | Set Google's deletion protection attribute which applies across all surfaces (UI, API, & Terraform). | bool | | true |
+| [insights_config](variables.tf#L126) | Query Insights configuration. Defaults to null which disables Query Insights. | object({…}) | | null |
+| [labels](variables.tf#L137) | Labels to be attached to all instances. | map(string) | | null |
+| [maintenance_config](variables.tf#L143) | Set maintenance window configuration and maintenance deny period (up to 90 days). Date format: 'yyyy-mm-dd'. | object({…}) | | {} |
+| [managed_connection_pooling_config](variables.tf#L178) | Configuration for Managed Connection Pooling. NOTE: This feature is only available for PostgreSQL on Enterprise Plus edition instances. | object({…}) | | {} |
+| [password_validation_policy](variables.tf#L212) | Password validation policy configuration for instances. | object({…}) | | null |
+| [prefix](variables.tf#L226) | Optional prefix used to generate instance names. | string | | null |
+| [replicas](variables.tf#L246) | Map of NAME=> {REGION, KMS_KEY, AVAILABILITY_TYPE} for additional read replicas. Set to null to disable replica creation. | map(object({…})) | | {} |
+| [root_password](variables.tf#L257) | Root password of the Cloud SQL instance, or flag to create a random password. Required for MS SQL Server. | object({…}) | | {} |
+| [ssl](variables.tf#L271) | Setting to enable SSL, set config and certificates. | object({…}) | | {} |
+| [terraform_deletion_protection](variables.tf#L286) | Prevent terraform from deleting instances. | bool | | true |
+| [time_zone](variables.tf#L298) | The time_zone to be used by the database engine (supported only for SQL Server), in SQL Server timezone format. | string | | null |
+| [users](variables.tf#L304) | Map of users to create in the primary instance (and replicated to other replicas). For MySQL, anything after the first `@` (if present) will be used as the user's host. Set PASSWORD to null if you want to get an autogenerated password. The user types available are: 'BUILT_IN', 'CLOUD_IAM_USER' or 'CLOUD_IAM_SERVICE_ACCOUNT'. | map(object({…})) | | {} |
## Outputs
diff --git a/modules/cloudsql-instance/main.tf b/modules/cloudsql-instance/main.tf
index fafff4074..4cd4e0676 100644
--- a/modules/cloudsql-instance/main.tf
+++ b/modules/cloudsql-instance/main.tf
@@ -20,6 +20,7 @@ locals {
is_postgres = can(regex("^POSTGRES", var.database_version))
has_replicas = length(var.replicas) > 0
is_regional = var.availability_type == "REGIONAL" ? true : false
+
users = {
for k, v in var.users : k =>
local.is_mysql
@@ -61,7 +62,7 @@ resource "google_sql_database_instance" "primary" {
collation = var.collation
connector_enforcement = var.connector_enforcement
time_zone = var.time_zone
- retain_backups_on_delete = var.backup_configuration.retain_backups_on_delete
+ retain_backups_on_delete = try(var.backup_configuration.retain_backups_on_delete, null)
ip_configuration {
ipv4_enabled = var.network_config.connectivity.public_ipv4
@@ -102,34 +103,44 @@ resource "google_sql_database_instance" "primary" {
}
}
+ # backup_configuration is Optional+Computed in the provider schema, meaning an absent block
+ # is treated as "don't manage" rather than "set to disabled". Setting var.backup_configuration
+ # to null preserves existing GCP settings; passing an object (even with enabled=false) causes
+ # Terraform to actively manage and apply the desired state.
+ # See: https://github.com/hashicorp/terraform-provider-google/blob/main/google/services/sql/resource_sql_database_instance.go#L424
+ # See: https://developer.hashicorp.com/terraform/language/attr-as-blocks
dynamic "backup_configuration" {
- for_each = var.backup_configuration.enabled ? { 1 = 1 } : {}
+ for_each = var.backup_configuration != null ? [1] : []
content {
- enabled = true
- // enable binary log if the user asks for it or we have replicas (default in regional),
- // but only for MySQL
+ enabled = var.backup_configuration.enabled
+ // auto-enable binary log for MySQL when replicas or regional HA are in use;
+ // must be null (not true) when backups are disabled
binary_log_enabled = (
- local.is_mysql
+ local.is_mysql && var.backup_configuration.enabled
? var.backup_configuration.binary_log_enabled || local.has_replicas || local.is_regional
: null
)
start_time = var.backup_configuration.start_time
location = var.backup_configuration.location
+ // must be explicitly false (not null) when backups are disabled
point_in_time_recovery_enabled = (
- var.backup_configuration.point_in_time_recovery_enabled
+ var.backup_configuration.enabled
+ ? var.backup_configuration.point_in_time_recovery_enabled
+ : false
)
- transaction_log_retention_days = (
- var.backup_configuration.log_retention_days
- )
- backup_retention_settings {
- retained_backups = var.backup_configuration.retention_count
- retention_unit = "COUNT"
+ transaction_log_retention_days = var.backup_configuration.log_retention_days
+ dynamic "backup_retention_settings" {
+ for_each = var.backup_configuration.enabled ? { 1 = 1 } : {}
+ content {
+ retained_backups = var.backup_configuration.retention_count
+ retention_unit = "COUNT"
+ }
}
}
}
dynamic "final_backup_config" {
- for_each = var.backup_configuration.final_backup != null ? [var.backup_configuration.final_backup] : []
+ for_each = try(var.backup_configuration.final_backup != null ? [var.backup_configuration.final_backup] : [], [])
content {
enabled = final_backup_config.value.enabled
retention_days = final_backup_config.value.retention_days
diff --git a/modules/cloudsql-instance/variables.tf b/modules/cloudsql-instance/variables.tf
index b6c696bf3..f02edec61 100644
--- a/modules/cloudsql-instance/variables.tf
+++ b/modules/cloudsql-instance/variables.tf
@@ -31,8 +31,8 @@ variable "availability_type" {
}
variable "backup_configuration" {
- description = "Backup settings for primary instance. Will be automatically enabled if using MySQL with one or more replicas."
- nullable = false
+ description = "Backup settings for primary instance. Set to null to leave existing GCP backup settings unmanaged. When set, all fields are managed by Terraform including disabling backups when enabled=false."
+ nullable = true
type = object({
enabled = optional(bool, false)
binary_log_enabled = optional(bool, false)
@@ -47,17 +47,7 @@ variable "backup_configuration" {
retention_days = optional(number, 7)
}))
})
- default = {
- enabled = false
- binary_log_enabled = false
- start_time = "23:00"
- location = null
- log_retention_days = 7
- point_in_time_recovery_enabled = null
- retention_count = 7
- retain_backups_on_delete = null
- final_backup = null
- }
+ default = null
}
variable "collation" {