DMS

# Database Migration Service requires the below IAM Roles to be created before
# replication instances can be created. See the DMS Documentation for
# additional information: https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Security.html#CHAP_Security.APIRole
#  * dms-vpc-role
#  * dms-cloudwatch-logs-role
#  * dms-access-for-endpoint

data "aws_iam_policy_document" "dms_assume_role" {
 statement {
   actions = ["sts:AssumeRole"]

   principals {
     identifiers = ["dms.amazonaws.com"]
     type        = "Service"
   }
 }
}

resource "aws_iam_role" "dms-access-for-endpoint" {
 assume_role_policy = data.aws_iam_policy_document.dms_assume_role.json
 name               = "dms-access-for-endpoint"
}

resource "aws_iam_role_policy_attachment" "dms-access-for-endpoint-AmazonDMSRedshiftS3Role" {
 policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonDMSRedshiftS3Role"
 role       = aws_iam_role.dms-access-for-endpoint.name
}

resource "aws_iam_role" "dms-cloudwatch-logs-role" {
 assume_role_policy = data.aws_iam_policy_document.dms_assume_role.json
 name               = "dms-cloudwatch-logs-role"
}

resource "aws_iam_role_policy_attachment" "dms-cloudwatch-logs-role-AmazonDMSCloudWatchLogsRole" {
 policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonDMSCloudWatchLogsRole"
 role       = aws_iam_role.dms-cloudwatch-logs-role.name
}

resource "aws_iam_role" "dms-vpc-role" {
 assume_role_policy = data.aws_iam_policy_document.dms_assume_role.json
 name               = "dms-vpc-role"
}

resource "aws_iam_role_policy_attachment" "dms-vpc-role-AmazonDMSVPCManagementRole" {
 policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonDMSVPCManagementRole"
 role       = aws_iam_role.dms-vpc-role.name
}

# Create a new replication instance
resource "aws_dms_replication_instance" "test" {
 allocated_storage            = 20
 apply_immediately            = true
 auto_minor_version_upgrade   = true
 availability_zone            = "us-west-2c"
 engine_version               = "3.1.4"
 kms_key_arn                  = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
 multi_az                     = false
 preferred_maintenance_window = "sun:10:30-sun:14:30"
 publicly_accessible          = true
 replication_instance_class   = "dms.t2.micro"
 replication_instance_id      = "test-dms-replication-instance-tf"
 replication_subnet_group_id  = aws_dms_replication_subnet_group.test-dms-replication-subnet-group-tf.id

 tags = {
   Name = "test"
 }

 vpc_security_group_ids = [
   "sg-12345678",
 ]

 depends_on = [
   aws_iam_role_policy_attachment.dms-access-for-endpoint-AmazonDMSRedshiftS3Role,
   aws_iam_role_policy_attachment.dms-cloudwatch-logs-role-AmazonDMSCloudWatchLogsRole,
   aws_iam_role_policy_attachment.dms-vpc-role-AmazonDMSVPCManagementRole
 ]
}

create-replication-instance
--replication-instance-identifier <value>
[--allocated-storage <value>]
--replication-instance-class <value>
[--vpc-security-group-ids <value>]
[--availability-zone <value>]
[--replication-subnet-group-identifier <value>]
[--preferred-maintenance-window <value>]
[--multi-az | --no-multi-az]
[--engine-version <value>]
[--auto-minor-version-upgrade | --no-auto-minor-version-upgrade]
[--tags <value>]
[--kms-key-id <value>]
[--publicly-accessible | --no-publicly-accessible]
[--dns-name-servers <value>]
[--resource-identifier <value>]
[--network-type <value>]
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]
[--debug]
[--endpoint-url <value>]
[--no-verify-ssl]
[--no-paginate]
[--output <value>]
[--query <value>]
[--profile <value>]
[--region <value>]
[--version <value>]
[--color <value>]
[--no-sign-request]
[--ca-bundle <value>]
[--cli-read-timeout <value>]
[--cli-connect-timeout <value>]
[--cli-binary-format <value>]
[--no-cli-pager]
[--cli-auto-prompt]
[--no-cli-auto-prompt]

aws dms create-replication-instance \
   --replication-instance-identifier my-repl-instance \
   --replication-instance-class dms.t2.micro \
   --allocated-storage 5