Database

A Database represents a managed relational database instance. It supports PostgreSQL, MySQL, and MariaDB engines. On AWS this is RDS, on GCP Cloud SQL, and on DigitalOcean a Managed Database. Hetzner does not offer managed databases.

Config

Property	Type	Required	Description
name	string	yes	Unique resource name
id	string	no	Explicit ID (auto-generated UUID if omitted)
provider	string	no	Provider label for multi-provider configs
tags	Record<string, string>	no	Arbitrary key-value metadata
engine	'postgresql' | 'mysql' | 'mariadb'	yes	Database engine
version	string	yes	Engine version (e.g. '16', '8.0')
instanceType	InstanceType	yes	Abstract size or provider-specific map
storage	number	yes	Storage size in GB
username	string	yes	Admin username
password	Secret<string>	no	Admin password (auto-generated if omitted)
iamAuth	boolean	no	Enable IAM-based authentication
vpc	Vpc | string	yes	Vpc to place the database in
securityGroups	(SecurityGroup | string)[]	no	Security groups for network access
backupRetention	number	no	Backup retention period in days

Example

import { Vpc, Database } from '@kykucloud/types'

const myVpc = new Vpc({ name: 'my-vpc', cidr: '10.0.0.0/16', region: 'eu-central' })

const db = new Database({
  name: 'my-db',
  engine: 'postgresql',
  version: '16',
  instanceType: 'medium',
  storage: 100,
  username: 'admin',
  vpc: myVpc,
  backupRetention: 7,
})

Provider Support

Provider	Supported	Backend
AWS	✅	RDS
GCP	✅	Cloud SQL
Hetzner	❌	Not available
DigitalOcean	✅	Managed Database

Notes

• AWS RDS instance types use db.* prefix (e.g. db.t3.medium). Maintained via RDS_INSTANCE_TYPE_MAP. Engine name mapping: postgresql → postgres, mariadb → mariadb. RDS requires a DB subnet group for VPC placement. Polling creation can take 10+ minutes (120 attempts × 5s timeout).
• GCP Cloud SQL uses a separate API base (sqladmin.googleapis.com). Instance types differ from Compute Engine (db-f1-micro, db-g1-small, db-custom-*). Creation takes 10–15 minutes.
• DigitalOcean Managed DB engine names differ from Kyku (postgresql → pg). Private networking requires resolving the VPC UUID.
• Password is encrypted in state (AES-256-GCM). If omitted, the provider generates one and stores it as an output.
• IAM auth (iamAuth) enables AWS IAM database authentication for PostgreSQL and MySQL RDS instances.