rds_instance module and tests (#43789)

* Add functions to retrieve the allowed and required parameters for boto3 client methods

* Add custom waiter for stopping an RDS DB instance

* Add rds_instance module

* Add rds_instance integration tests

* address requested changes from ryansb

* address requested changes from willthames

* address requested changes from dmsimard

* Fix final snapshots

Fix idempotence with already-deleting DB instances

Remove unused import from module_utils/aws/core.py

Consolidate function to get all boto3 client method parameters and the subset of required parameters

* Add some additional rds_instance integration tests

* Add some common functions to module_utils/aws/rds

* Move common code out of rds_instance

* Remove hardcoded engine choices and require the minimum boto3

* Document wait behavior

* Provide a list of valid engines in the error message if it is invalid

Add supported methods to whitelist

Remove AWSRetry around waiter

Wait for a less crazy amount of time

Remove unused variables

* Add a test for an invalid engine option

* pep8

* Missed adding a method to the whitelist

* Use retries

* Fix some little things

* Fix more things

* Improve error message

* Support creating cross-region read replicas

* Remove unused imports

* Add retry when getting RDS instance

* Soft-check required options so module fails properly when options are missing

* Fix mariadb parameter version

* Fix cross-region read_replica creation and tests

* fix modify tests

* Fix a modification test

* Fix typo

* Remove test for option_group_name that exists for this account but may not for others and added as a TODO to do properly

lib/ansible/module_utils/aws/core.py

@@ -283,3 +283,15 @@ def is_boto3_error_code(code, e=None):
     if isinstance(e, ClientError) and e.response['Error']['Code'] == code:
         return ClientError
     return type('NeverEverRaisedException', (Exception,), {})
+
+
+def get_boto3_client_method_parameters(client, method_name, required=False):
+    op = client.meta.method_to_api_mapping.get(method_name)
+    input_shape = client._service_model.operation_model(op).input_shape
+    if not input_shape:
+        parameters = []
+    elif required:
+        parameters = list(input_shape.required_members)
+    else:
+        parameters = list(input_shape.members.keys())
+    return parameters

lib/ansible/module_utils/aws/rds.py

@@ -0,0 +1,229 @@
+# Copyright: (c) 2018, Ansible Project
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from ansible.module_utils._text import to_text
+from ansible.module_utils.aws.waiters import get_waiter
+from ansible.module_utils.common.dict_transformations import snake_dict_to_camel_dict
+from ansible.module_utils.ec2 import compare_aws_tags, AWSRetry, ansible_dict_to_boto3_tag_list, boto3_tag_list_to_ansible_dict
+
+try:
+    from botocore.exceptions import BotoCoreError, ClientError, WaiterError
+except ImportError:
+    pass
+
+from collections import namedtuple
+from time import sleep
+
+
+Boto3ClientMethod = namedtuple('Boto3ClientMethod', ['name', 'waiter', 'operation_description', 'cluster', 'instance'])
+# Whitelist boto3 client methods for cluster and instance resources
+cluster_method_names = [
+    'create_db_cluster', 'restore_db_cluster_from_db_snapshot', 'restore_db_cluster_from_s3',
+    'restore_db_cluster_to_point_in_time', 'modify_db_cluster', 'delete_db_cluster', 'add_tags_to_resource',
+    'remove_tags_from_resource', 'list_tags_for_resource', 'promote_read_replica_db_cluster'
+]
+instance_method_names = [
+    'create_db_instance', 'restore_db_instance_to_point_in_time', 'restore_db_instance_from_s3',
+    'restore_db_instance_from_db_snapshot', 'create_db_instance_read_replica', 'modify_db_instance',
+    'delete_db_instance', 'add_tags_to_resource', 'remove_tags_from_resource', 'list_tags_for_resource',
+    'promote_read_replica', 'stop_db_instance', 'start_db_instance', 'reboot_db_instance'
+]
+
+
+def get_rds_method_attribute(method_name, module):
+    readable_op = method_name.replace('_', ' ').replace('db', 'DB')
+    if method_name in cluster_method_names and 'new_db_cluster_identifier' in module.params:
+        cluster = True
+        instance = False
+        if method_name == 'delete_db_cluster':
+            waiter = 'cluster_deleted'
+        else:
+            waiter = 'cluster_available'
+    elif method_name in instance_method_names and 'new_db_instance_identifier' in module.params:
+        cluster = False
+        instance = True
+        if method_name == 'delete_db_instance':
+            waiter = 'db_instance_deleted'
+        elif method_name == 'stop_db_instance':
+            waiter = 'db_instance_stopped'
+        else:
+            waiter = 'db_instance_available'
+    else:
+        raise NotImplementedError("method {0} hasn't been added to the list of accepted methods to use a waiter in module_utils/aws/rds.py".format(method_name))
+
+    return Boto3ClientMethod(name=method_name, waiter=waiter, operation_description=readable_op, cluster=cluster, instance=instance)
+
+
+def get_final_identifier(method_name, module):
+    apply_immediately = module.params['apply_immediately']
+    if get_rds_method_attribute(method_name, module).cluster:
+        identifier = module.params['db_cluster_identifier']
+        updated_identifier = module.params['new_db_cluster_identifier']
+    elif get_rds_method_attribute(method_name, module).instance:
+        identifier = module.params['db_instance_identifier']
+        updated_identifier = module.params['new_db_instance_identifier']
+    else:
+        raise NotImplementedError("method {0} hasn't been added to the list of accepted methods in module_utils/aws/rds.py".format(method_name))
+    if not module.check_mode and updated_identifier and apply_immediately:
+        identifier = updated_identifier
+    return identifier
+
+
+def handle_errors(module, exception, method_name, parameters):
+
+    if not isinstance(exception, ClientError):
+        module.fail_json_aws(exception, msg="Unexpected failure for method {0} with parameters {1}".format(method_name, parameters))
+
+    changed = True
+    error_code = exception.response['Error']['Code']
+    if method_name == 'modify_db_instance' and error_code == 'InvalidParameterCombination':
+        if 'No modifications were requested' in to_text(exception):
+            changed = False
+        elif 'ModifyDbCluster API' in to_text(exception):
+            module.fail_json_aws(exception, msg='It appears you are trying to modify attributes that are managed at the cluster level. Please see rds_cluster')
+        else:
+            module.fail_json_aws(exception, msg='Unable to {0}'.format(get_rds_method_attribute(method_name, module).operation_description))
+    elif method_name == 'promote_read_replica' and error_code == 'InvalidDBInstanceState':
+        if 'DB Instance is not a read replica' in to_text(exception):
+            changed = False
+        else:
+            module.fail_json_aws(exception, msg='Unable to {0}'.format(get_rds_method_attribute(method_name, module).operation_description))
+    elif method_name == 'create_db_instance' and exception.response['Error']['Code'] == 'InvalidParameterValue':
+        accepted_engines = [
+            'aurora', 'aurora-mysql', 'aurora-postgresql', 'mariadb', 'mysql', 'oracle-ee', 'oracle-se',
+            'oracle-se1', 'oracle-se2', 'postgres', 'sqlserver-ee', 'sqlserver-ex', 'sqlserver-se', 'sqlserver-web'
+        ]
+        if parameters.get('Engine') not in accepted_engines:
+            module.fail_json_aws(exception, msg='DB engine {0} should be one of {1}'.format(parameters.get('Engine'), accepted_engines))
+        else:
+            module.fail_json_aws(exception, msg='Unable to {0}'.format(get_rds_method_attribute(method_name, module).operation_description))
+    else:
+        module.fail_json_aws(exception, msg='Unable to {0}'.format(get_rds_method_attribute(method_name, module).operation_description))
+
+    return changed
+
+
+def call_method(client, module, method_name, parameters):
+    result = {}
+    changed = True
+    if not module.check_mode:
+        wait = module.params['wait']
+        # TODO: stabilize by adding get_rds_method_attribute(method_name).extra_retry_codes
+        method = getattr(client, method_name)
+        try:
+            if method_name == 'modify_db_instance':
+                # check if instance is in an available state first, if possible
+                if wait:
+                    wait_for_status(client, module, module.params['db_instance_identifier'], method_name)
+                result = AWSRetry.jittered_backoff(catch_extra_error_codes=['InvalidDBInstanceState'])(method)(**parameters)
+            else:
+                result = AWSRetry.jittered_backoff()(method)(**parameters)
+        except (BotoCoreError, ClientError) as e:
+            changed = handle_errors(module, e, method_name, parameters)
+
+        if wait and changed:
+            identifier = get_final_identifier(method_name, module)
+            wait_for_status(client, module, identifier, method_name)
+    return result, changed
+
+
+def wait_for_instance_status(client, module, db_instance_id, waiter_name):
+    def wait(client, db_instance_id, waiter_name, extra_retry_codes):
+        retry = AWSRetry.jittered_backoff(catch_extra_error_codes=extra_retry_codes)
+        try:
+            waiter = client.get_waiter(waiter_name)
+        except ValueError:
+            # using a waiter in ansible.module_utils.aws.waiters
+            waiter = get_waiter(client, waiter_name)
+        waiter.wait(WaiterConfig={'Delay': 60, 'MaxAttempts': 60}, DBInstanceIdentifier=db_instance_id)
+
+    waiter_expected_status = {
+        'db_instance_deleted': 'deleted',
+        'db_instance_stopped': 'stopped',
+    }
+    expected_status = waiter_expected_status.get(waiter_name, 'available')
+    if expected_status == 'available':
+        extra_retry_codes = ['DBInstanceNotFound']
+    else:
+        extra_retry_codes = []
+    for attempt_to_wait in range(0, 10):
+        try:
+            wait(client, db_instance_id, waiter_name, extra_retry_codes)
+            break
+        except WaiterError as e:
+            # Instance may be renamed and AWSRetry doesn't handle WaiterError
+            if e.last_response.get('Error', {}).get('Code') == 'DBInstanceNotFound':
+                sleep(10)
+                continue
+            module.fail_json_aws(e, msg='Error while waiting for DB instance {0} to be {1}'.format(db_instance_id, expected_status))
+        except (BotoCoreError, ClientError) as e:
+            module.fail_json_aws(e, msg='Unexpected error while waiting for DB instance {0} to be {1}'.format(
+                db_instance_id, expected_status)
+            )
+
+
+def wait_for_cluster_status(client, module, db_cluster_id, waiter_name):
+    try:
+        waiter = get_waiter(client, waiter_name).wait(DBClusterIdentifier=db_cluster_id)
+    except WaiterError as e:
+        if waiter_name == 'cluster_deleted':
+            msg = "Failed to wait for DB cluster {0} to be deleted".format(db_cluster_id)
+        else:
+            msg = "Failed to wait for DB cluster {0} to be available".format(db_cluster_id)
+        module.fail_json_aws(e, msg=msg)
+    except (BotoCoreError, ClientError) as e:
+        module.fail_json_aws(e, msg="Failed with an unexpected error while waiting for the DB cluster {0}".format(db_cluster_id))
+
+
+def wait_for_status(client, module, identifier, method_name):
+    waiter_name = get_rds_method_attribute(method_name, module).waiter
+    if get_rds_method_attribute(method_name, module).cluster:
+        wait_for_cluster_status(client, module, identifier, waiter_name)
+    elif get_rds_method_attribute(method_name, module).instance:
+        wait_for_instance_status(client, module, identifier, waiter_name)
+    else:
+        raise NotImplementedError("method {0} hasn't been added to the whitelist of handled methods".format(method_name))
+
+
+def get_tags(client, module, cluster_arn):
+    try:
+        return boto3_tag_list_to_ansible_dict(
+            client.list_tags_for_resource(ResourceName=cluster_arn)['TagList']
+        )
+    except (BotoCoreError, ClientError) as e:
+        module.fail_json_aws(e, msg="Unable to describe tags")
+
+
+def arg_spec_to_rds_params(options_dict):
+    tags = options_dict.pop('tags')
+    has_processor_features = False
+    if 'processor_features' in options_dict:
+        has_processor_features = True
+        processor_features = options_dict.pop('processor_features')
+    camel_options = snake_dict_to_camel_dict(options_dict, capitalize_first=True)
+    for key in list(camel_options.keys()):
+        for old, new in (('Db', 'DB'), ('Iam', 'IAM'), ('Az', 'AZ')):
+            if old in key:
+                camel_options[key.replace(old, new)] = camel_options.pop(key)
+    camel_options['Tags'] = tags
+    if has_processor_features:
+        camel_options['ProcessorFeatures'] = processor_features
+    return camel_options
+
+
+def ensure_tags(client, module, resource_arn, existing_tags, tags, purge_tags):
+    if tags is None:
+        return False
+    tags_to_add, tags_to_remove = compare_aws_tags(existing_tags, tags, purge_tags)
+    changed = bool(tags_to_add or tags_to_remove)
+    if tags_to_add:
+        call_method(
+            client, module, method_name='add_tags_to_resource',
+            parameters={'ResourceName': resource_arn, 'Tags': ansible_dict_to_boto3_tag_list(tags_to_add)}
+        )
+    if tags_to_remove:
+        call_method(
+            client, module, method_name='remove_tags_from_resource',
+            parameters={'ResourceName': resource_arn, 'TagKeys': tags_to_remove}
+        )
+    return changed

lib/ansible/module_utils/aws/waiters.py

@@ -204,6 +204,26 @@ eks_data = {
 }
 
 
+rds_data = {
+    "version": 2,
+    "waiters": {
+        "DBInstanceStopped": {
+            "delay": 20,
+            "maxAttempts": 60,
+            "operation": "DescribeDBInstances",
+            "acceptors": [
+                {
+                    "state": "success",
+                    "matcher": "pathAll",
+                    "argument": "DBInstances[].DBInstanceStatus",
+                    "expected": "stopped"
+                },
+            ]
+        }
+    }
+}
+
+
 def ec2_model(name):
     ec2_models = core_waiter.WaiterModel(waiter_config=ec2_data)
     return ec2_models.get_waiter(name)
@@ -219,6 +239,11 @@ def eks_model(name):
     return eks_models.get_waiter(name)
 
 
+def rds_model(name):
+    rds_models = core_waiter.WaiterModel(waiter_config=rds_data)
+    return rds_models.get_waiter(name)
+
+
 waiters_by_name = {
     ('EC2', 'route_table_exists'): lambda ec2: core_waiter.Waiter(
         'route_table_exists',
@@ -286,6 +311,12 @@ waiters_by_name = {
         core_waiter.NormalizedOperationMethod(
             eks.describe_cluster
         )),
+    ('RDS', 'db_instance_stopped'): lambda rds: core_waiter.Waiter(
+        'db_instance_stopped',
+        rds_model('DBInstanceStopped'),
+        core_waiter.NormalizedOperationMethod(
+            rds.describe_db_instances
+        )),
 }
 
 

test/integration/targets/rds_instance/aliases

@@ -0,0 +1,2 @@
+cloud/aws
+unsupported

test/integration/targets/rds_instance/defaults/main.yml

@@ -0,0 +1,23 @@
+---
+instance_id: "{{ resource_prefix }}"
+modified_instance_id: "{{ resource_prefix }}-updated"
+username: test
+password: test12345678
+db_instance_class: db.t2.micro
+storage_encrypted_db_instance_class: db.t2.small
+modified_db_instance_class: db.t2.medium
+allocated_storage: 20
+modified_allocated_storage: 30
+
+# For aurora tests
+cluster_id: "{{ resource_prefix }}-cluster"
+aurora_db_instance_class: db.t2.medium
+
+# For oracle tests
+oracle_ee_db_instance_class: db.r3.xlarge
+processor_features:
+  coreCount: 1
+  threadsPerCore: 1
+modified_processor_features:
+  coreCount: 2
+  threadsPerCore: 2

test/integration/targets/rds_instance/tasks/credential_tests.yml

@@ -0,0 +1,36 @@
+---
+- name: test without credentials
+  rds_instance:
+    db_instance_identifier: test-rds-instance
+  register: result
+  ignore_errors: yes
+
+- assert:
+    that:
+      - result.failed
+      - 'result.msg == "The rds_instance module requires a region and none was found in configuration, environment variables or module parameters"'
+
+- name: test without credentials
+  rds_instance:
+    db_instance_identifier: test-rds-instance
+    region: us-east-1
+  register: result
+  ignore_errors: yes
+
+- assert:
+    that:
+      - result.failed
+      - '"Unable to locate credentials" in result.msg'
+
+- name: test with invalid credentials
+  rds_instance:
+    db_instance_identifier: test-rds-instance
+    region: us-east-1
+    profile: doesnotexist
+  register: result
+  ignore_errors: yes
+
+- assert:
+    that:
+      - result.failed
+      - 'result.msg == "The config profile (doesnotexist) could not be found"'

test/integration/targets/rds_instance/tasks/main.yml

@@ -0,0 +1,16 @@
+---
+- block:
+
+    - include: ./credential_tests.yml
+    - include: ./test_states.yml
+    - include: ./test_tags.yml
+    - include: ./test_modification.yml  # TODO: test availability_zone and multi_az
+    - include: ./test_bad_options.yml
+    - include: ./test_processor_features.yml
+    - include: ./test_encryption.yml
+    - include: ./test_final_snapshot.yml
+    - include: ./test_read_replica.yml
+    - include: ./test_vpc_security_groups.yml
+    #- include: ./test_restore_instance.yml  # TODO: point-in-time, snapshot, s3
+    # TODO: uncomment after adding rds_cluster module
+    #- include: ./test_aurora.yml

test/integration/targets/rds_instance/tasks/test_aurora.yml

@@ -0,0 +1,144 @@
+---
+  - block:
+      - name: set up aws connection info
+        set_fact:
+          aws_connection_info: &aws_connection_info
+            aws_access_key: "{{ aws_access_key }}"
+            aws_secret_key: "{{ aws_secret_key }}"
+            security_token: "{{ security_token }}"
+            region: "{{ aws_region }}"
+        no_log: yes
+
+      - name: Ensure the resource doesn't exist
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: absent
+          skip_final_snapshot: True
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - not result.changed
+        ignore_errors: yes
+
+      - name: Create minimal aurora cluster in default VPC and default subnet group
+        rds_cluster:
+          state: present
+          engine: aurora
+          cluster_id: "{{ cluster_id }}"
+          username: "{{ username }}"
+          password: "{{ password }}"
+          <<: *aws_connection_info
+
+      - name: Create an Aurora instance
+        rds_instance:
+          id: "{{ instance_id }}"
+          cluster_id: "{{ cluster_id }}"
+          engine: aurora
+          state: present
+          db_instance_class: "{{ aurora_db_instance_class }}"
+          tags:
+            CreatedBy: rds_instance integration tests
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - result.changed
+            - "result.db_instance_identifier == '{{ instance_id }}'"
+            - "result.tags | length == 1"
+
+      - name: Modify tags
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: present
+          tags:
+            Test: rds_instance
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - result.changed
+            - result.tags | length == 1
+            - "result.tags.Test == 'rds_instance'"
+
+      - name: Test idempotence
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: present
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - not result.changed
+
+      - name: Attempt to modify password (a cluster-managed attribute)
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: present
+          password:  "{{ password }}"
+          force_update_password: True
+          apply_immediately: True
+          <<: *aws_connection_info
+        register: result
+        ignore_errors: yes
+
+      - assert:
+          that:
+            - result.failed
+            - "'Modify master user password for the DB Cluster using the ModifyDbCluster API' in result.msg"
+            - "'Please see rds_cluster' in result.msg"
+
+      - name: Modify aurora instance port (a cluster-managed attribute)
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: present
+          port: 1150
+          <<: *aws_connection_info
+        register: result
+        ignore_errors: yes
+
+      - assert:
+          that:
+            - not result.changed
+            - "'Modify database endpoint port number for the DB Cluster using the ModifyDbCluster API' in result.msg"
+            - "'Please see rds_cluster' in result.msg"
+
+      - name: Modify Aurora instance identifier
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: present
+          purge_tags: False
+          new_id: "{{ modified_instance_id }}"
+          apply_immediately: True
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - result.changed
+            - "result.db_instance_identifier == '{{ modified_instance_id }}'"
+
+    always:
+
+      - name: Delete the instance
+        rds_instance:
+          id: "{{ item }}"
+          state: absent
+          skip_final_snapshot: True
+          <<: *aws_connection_info
+        loop:
+          - "{{ instance_id }}"
+          - "{{ modified_instance_id }}"
+        ignore_errors: yes
+
+      - name: Delete the cluster
+        rds_cluster:
+          cluster_id: "{{ cluster_id }}"
+          state: absent
+          skip_final_snapshot: True
+          <<: *aws_connection_info
+        ignore_errors: yes

test/integration/targets/rds_instance/tasks/test_bad_options.yml

@@ -0,0 +1,41 @@
+---
+  - block:
+      - name: set up aws connection info
+        set_fact:
+          aws_connection_info: &aws_connection_info
+            aws_access_key: "{{ aws_access_key }}"
+            aws_secret_key: "{{ aws_secret_key }}"
+            security_token: "{{ security_token }}"
+            region: "{{ aws_region }}"
+        no_log: yes
+
+      - name: Ensure the resource doesn't exist
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: absent
+          skip_final_snapshot: True
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - not result.changed
+        ignore_errors: yes
+
+      - name: Create a DB instance with an invalid engine
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: present
+          engine: thisisnotavalidengine
+          username: "{{ username }}"
+          password: "{{ password }}"
+          db_instance_class: "{{ db_instance_class }}"
+          allocated_storage: "{{ allocated_storage }}"
+          <<: *aws_connection_info
+        register: result
+        ignore_errors: True
+
+      - assert:
+          that:
+            - result.failed
+            - '"DB engine thisisnotavalidengine should be one of" in result.msg'

test/integration/targets/rds_instance/tasks/test_encryption.yml

@@ -0,0 +1,53 @@
+---
+  - block:
+      - name: set up aws connection info
+        set_fact:
+          aws_connection_info: &aws_connection_info
+            aws_access_key: "{{ aws_access_key }}"
+            aws_secret_key: "{{ aws_secret_key }}"
+            security_token: "{{ security_token }}"
+            region: "{{ aws_region }}"
+        no_log: yes
+
+      - name: Ensure the resource doesn't exist
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: absent
+          skip_final_snapshot: True
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - not result.changed
+        ignore_errors: yes
+
+      - name: Create a mariadb instance
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: present
+          engine: mariadb
+          username: "{{ username }}"
+          password: "{{ password }}"
+          db_instance_class: "{{ storage_encrypted_db_instance_class }}"
+          allocated_storage: "{{ allocated_storage }}"
+          storage_encrypted: True
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - result.changed
+            - "result.db_instance_identifier == '{{ instance_id }}'"
+            - result.kms_key_id
+            - result.storage_encrypted == true
+
+    always:
+
+      - name: Delete DB instance
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: absent
+          skip_final_snapshot: True
+          <<: *aws_connection_info
+        register: result

test/integration/targets/rds_instance/tasks/test_final_snapshot.yml

@@ -0,0 +1,85 @@
+---
+  - block:
+      - name: set up aws connection info
+        set_fact:
+          aws_connection_info: &aws_connection_info
+            aws_access_key: "{{ aws_access_key }}"
+            aws_secret_key: "{{ aws_secret_key }}"
+            security_token: "{{ security_token }}"
+            region: "{{ aws_region }}"
+        no_log: yes
+
+      - name: Ensure the resource doesn't exist
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: absent
+          skip_final_snapshot: True
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - not result.changed
+        ignore_errors: yes
+
+      - name: Create a mariadb instance
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: present
+          engine: mariadb
+          username: "{{ username }}"
+          password: "{{ password }}"
+          db_instance_class: "{{ db_instance_class }}"
+          allocated_storage: "{{ allocated_storage }}"
+          <<: *aws_connection_info
+        register: result
+
+      - name: Delete the DB instance
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: absent
+          final_snapshot_identifier: "{{ instance_id }}"
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - result.changed
+            - "result.final_snapshot.db_instance_identifier == '{{ instance_id }}'"
+
+      - name: Check that snapshot exists
+        rds_snapshot_facts:
+          db_snapshot_identifier: "{{ instance_id }}"
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - "result.snapshots | length == 1"
+            - "result.snapshots.0.engine == 'mariadb'"
+
+    always:
+
+      - name: Use AWS CLI to delete the snapshot
+        command: "aws rds delete-db-snapshot --db-snapshot-identifier '{{ instance_id }}'"
+        environment:
+          AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
+          AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
+          AWS_SESSION_TOKEN: "{{ security_token }}"
+          AWS_DEFAULT_REGION: "{{ aws_region }}"
+
+      # TODO: Uncomment once rds_snapshot module exists
+      #- name: Remove the snapshot
+      #  rds_snapshot:
+      #    db_snapshot_identifier: "{{ instance_id }}"
+      #    state: absent
+      #    <<: *aws_connection_info
+      #  ignore_errors: yes
+
+      - name: Remove the DB instance
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: absent
+          skip_final_snapshot: True
+          <<: *aws_connection_info
+        ignore_errors: yes         

test/integration/targets/rds_instance/tasks/test_modification.yml

@@ -0,0 +1,199 @@
+---
+  - block:
+      - name: set up aws connection info
+        set_fact:
+          aws_connection_info: &aws_connection_info
+            aws_access_key: "{{ aws_access_key }}"
+            aws_secret_key: "{{ aws_secret_key }}"
+            security_token: "{{ security_token }}"
+            region: "{{ aws_region }}"
+        no_log: yes
+
+      - name: Ensure the resource doesn't exist
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: absent
+          skip_final_snapshot: True
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - not result.changed
+        ignore_errors: yes
+
+      - name: Create a mariadb instance
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: present
+          engine: mariadb
+          username: "{{ username }}"
+          password: "{{ password }}"
+          db_instance_class: "{{ db_instance_class }}"
+          allocated_storage: "{{ allocated_storage }}"
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - result.changed
+            - "result.db_instance_identifier == '{{ instance_id }}'"
+
+      - name: Modify the instance name without immediate application
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: present
+          new_id: "{{ modified_instance_id }}"
+          apply_immediately: False
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - result.changed
+            - 'result.db_instance_identifier == "{{ instance_id }}"'
+
+      - name: Immediately apply the pending update
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: present
+          new_id: "{{ modified_instance_id }}"
+          apply_immediately: True
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - result.changed
+            - 'result.db_instance_identifier == "{{ modified_instance_id }}"'
+
+      - name: Modify the instance immediately
+        rds_instance:
+          id: '{{ modified_instance_id }}'
+          state: present
+          new_id: '{{ instance_id }}'
+          apply_immediately: True
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - result.changed
+            - 'result.db_instance_identifier == "{{ instance_id }}"'
+
+      - name: Check mode - modify the password
+        rds_instance:
+          id: '{{ instance_id }}'
+          state: present
+          password: '{{ password }}'
+          force_update_password: True
+          apply_immediately: True
+          <<: *aws_connection_info
+        register: result
+        check_mode: True
+
+      - assert:
+          that:
+            - result.changed
+
+      - name: Modify the password
+        rds_instance:
+          id: '{{ instance_id }}'
+          state: present
+          password: '{{ password }}'
+          force_update_password: True
+          apply_immediately: True
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - result.changed
+
+      # TODO: test modifying db_subnet_group_name, db_security_groups, db_parameter_group_name, option_group_name,
+      # monitoring_role_arn, monitoring_interval, domain, domain_iam_role_name, cloudwatch_logs_export_configuration
+
+      - name: Modify several attributes
+        rds_instance:
+          id: '{{ instance_id }}'
+          state: present
+          allocated_storage: 30
+          db_instance_class: "{{ modified_db_instance_class }}"
+          backup_retention_period: 2
+          preferred_backup_window: "05:00-06:00"
+          preferred_maintenance_window: "mon:06:20-mon:06:50"
+          engine_version: "10.1.26"
+          allow_major_version_upgrade: true
+          auto_minor_version_upgrade: false
+          port: 1150
+          apply_immediately: True
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - result.changed
+            - result.pending_modified_values.allocated_storage == 30
+            - result.pending_modified_values.port == 1150
+            - 'result.pending_modified_values.db_instance_class == "db.t2.medium"'
+            - 'result.pending_modified_values.engine_version == "10.1.26"'
+
+      - name: Idempotence modifying several pending attributes
+        rds_instance:
+          id: '{{ instance_id }}'
+          state: present
+          allocated_storage: 30
+          db_instance_class: "{{ modified_db_instance_class }}"
+          backup_retention_period: 2
+          preferred_backup_window: "05:00-06:00"
+          preferred_maintenance_window: "mon:06:20-mon:06:50"
+          engine_version: "10.1.26"
+          allow_major_version_upgrade: true
+          auto_minor_version_upgrade: false
+          port: 1150
+          <<: *aws_connection_info
+        register: result
+        retries: 30
+        delay: 10
+        until: result is not failed
+
+      - assert:
+          that:
+            - not result.changed
+            - '"allocated_storage" in result.pending_modified_values or result.allocated_storage == 30'
+            - '"port" in result.pending_modified_values or result.endpoint.port == 1150'
+            - '"db_instance_class" in result.pending_modified_values or result.db_instance_class == "db.t2.medium"'
+            - '"engine_version" in result.pending_modified_values or result.engine_version == "10.1.26"'
+
+      - name: Reboot the instance to update the modified values and add tags
+        rds_instance:
+          id: '{{ instance_id }}'
+          state: rebooted
+          tags:
+            Created_by: Ansible rds_instance tests
+          <<: *aws_connection_info
+        register: result
+
+      - name: Delete the instance
+        rds_instance:
+          id: '{{ instance_id }}'
+          state: absent
+          skip_final_snapshot: True
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - result.changed
+            - '"pending_modified_values" not in result'
+
+    always:
+
+      - name: Delete the instance
+        rds_instance:
+          id: '{{ item }}'
+          state: absent
+          skip_final_snapshot: True
+          <<: *aws_connection_info
+        loop: ['{{ instance_id }}', '{{ modified_instance_id }}']
+        ignore_errors: yes

test/integration/targets/rds_instance/tasks/test_processor_features.yml

@@ -0,0 +1,126 @@
+---
+  - block:
+      - name: set up aws connection info
+        set_fact:
+          aws_connection_info: &aws_connection_info
+            aws_access_key: "{{ aws_access_key }}"
+            aws_secret_key: "{{ aws_secret_key }}"
+            security_token: "{{ security_token }}"
+            region: "{{ aws_region }}"
+        no_log: yes
+
+      - name: Ensure the resource doesn't exist
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: absent
+          skip_final_snapshot: True
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - not result.changed
+        ignore_errors: yes
+
+      - name: Create an oracle-ee DB instance
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: present
+          engine: oracle-ee
+          username: "{{ username }}"
+          password: "{{ password }}"
+          db_instance_class: "{{ oracle_ee_db_instance_class }}"
+          allocated_storage: "{{ allocated_storage }}"
+          storage_encrypted: True
+          processor_features: "{{ processor_features }}"
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - result.changed
+            - 'result.processor_features.coreCount == "{{ processor_features.coreCount }}"'
+            - 'result.processor_features.threadsPerCore == "{{ processor_features.threadsPerCore }}"'
+
+      - name: Check mode - modify the processor features
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: present
+          engine: oracle-ee
+          username: "{{ username }}"
+          password: "{{ password }}"
+          db_instance_class: "{{ oracle_ee_db_instance_class }}"
+          allocated_storage: "{{ allocated_storage }}"
+          storage_encrypted: True
+          processor_features: "{{ modified_processor_features }}"
+          apply_immediately: true
+          <<: *aws_connection_info
+        register: result
+        check_mode: True
+
+      - assert:
+          that:
+            - result.changed
+
+      - name: Modify the processor features
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: present
+          engine: oracle-ee
+          username: "{{ username }}"
+          password: "{{ password }}"
+          db_instance_class: "{{ oracle_ee_db_instance_class }}"
+          allocated_storage: "{{ allocated_storage }}"
+          storage_encrypted: True
+          processor_features: "{{ modified_processor_features }}"
+          apply_immediately: true
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - result.changed
+            - 'result.pending_modified_values.processor_features.coreCount == "{{ modified_processor_features.coreCount }}"'
+            - 'result.pending_modified_values.processor_features.threadsPerCore == "{{ modified_processor_features.threadsPerCore }}"'
+
+      - name: Check mode - use the default processor features
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: present
+          processor_features: {}
+          apply_immediately: True
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - result.changed
+
+      - name: Use the default processor features
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: present
+          processor_features: {}
+          apply_immediately: True
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - result.changed
+            - 'result.pending_modified_values.processor_features.coreCount == "DEFAULT"'
+            - 'result.pending_modified_values.processor_features.threadsPerCore == "DEFAULT"'
+
+    always:
+
+      - name: Delete the DB instance
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: absent
+          skip_final_snapshot: True
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - result.changed

test/integration/targets/rds_instance/tasks/test_read_replica.yml

@@ -0,0 +1,140 @@
+---
+  - block:
+
+      - name: set the two regions for the source DB and the replica
+        set_fact:
+          region_src: "{{ aws_region }}"
+          region_dest: "us-east-2"
+
+      - name: set up aws connection info
+        set_fact:
+          aws_connection_info: &aws_connection_info
+            aws_access_key: "{{ aws_access_key }}"
+            aws_secret_key: "{{ aws_secret_key }}"
+            security_token: "{{ security_token }}"
+        no_log: yes
+
+      - name: Ensure the resource doesn't exist
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: absent
+          skip_final_snapshot: True
+          region: "{{ region_src }}"
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - not result.changed
+        ignore_errors: yes
+
+      - name: Create a source DB instance
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: present
+          engine: mysql
+          backup_retention_period: 1
+          username: "{{ username }}"
+          password: "{{ password }}"
+          db_instance_class: "{{ db_instance_class }}"
+          allocated_storage: "{{ allocated_storage }}"
+          region: "{{ region_src }}"
+          <<: *aws_connection_info
+        register: source_db
+
+      - assert:
+          that:
+            - source_db.changed
+            - "source_db.db_instance_identifier == '{{ instance_id }}'"
+
+      - name: Create a read replica in a different region
+        rds_instance:
+          id: "{{ instance_id }}-replica"
+          state: present
+          source_db_instance_identifier: "{{ source_db.db_instance_arn }}"
+          engine: mysql
+          username: "{{ username }}"
+          password: "{{ password }}"
+          read_replica: True
+          db_instance_class: "{{ db_instance_class }}"
+          allocated_storage: "{{ allocated_storage }}"
+          region: "{{ region_dest }}"
+          <<: *aws_connection_info
+        register: result
+
+      - name: Test idempotence with a read replica
+        rds_instance:
+          id: "{{ instance_id }}-replica"
+          state: present
+          source_db_instance_identifier: "{{ source_db.db_instance_arn }}"
+          engine: mysql
+          username: "{{ username }}"
+          password: "{{ password }}"
+          db_instance_class: "{{ db_instance_class }}"
+          allocated_storage: "{{ allocated_storage }}"
+          region: "{{ region_dest }}"
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - not result.changed
+
+      - name: Test idempotence with read_replica=True
+        rds_instance:
+          id: "{{ instance_id }}-replica"
+          state: present
+          read_replica: True
+          source_db_instance_identifier: "{{ source_db.db_instance_arn }}"
+          engine: mysql
+          username: "{{ username }}"
+          password: "{{ password }}"
+          db_instance_class: "{{ db_instance_class }}"
+          allocated_storage: "{{ allocated_storage }}"
+          region: "{{ region_dest }}"
+          <<: *aws_connection_info
+        register: result
+
+      - name: Promote the read replica
+        rds_instance:
+          id: "{{ instance_id }}-replica"
+          state: present
+          read_replica: False
+          region: "{{ region_dest }}"
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - result.changed
+
+      - name: Test idempotence
+        rds_instance:
+          id: "{{ instance_id }}-replica"
+          state: present
+          read_replica: False
+          region: "{{ region_dest }}"
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - not result.changed
+
+    always:
+
+      - name: Remove the DB instance
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: absent
+          skip_final_snapshot: True
+          region: "{{ region_src }}"
+          <<: *aws_connection_info
+
+      - name: Remove the DB replica
+        rds_instance:
+          id: "{{ instance_id }}-replica"
+          state: absent
+          skip_final_snapshot: True
+          region: "{{ region_dest }}"
+          <<: *aws_connection_info

test/integration/targets/rds_instance/tasks/test_states.yml

@@ -0,0 +1,198 @@
+---
+  - block:
+      - name: set up aws connection info
+        set_fact:
+          aws_connection_info: &aws_connection_info
+            aws_access_key: "{{ aws_access_key }}"
+            aws_secret_key: "{{ aws_secret_key }}"
+            security_token: "{{ security_token }}"
+            region: "{{ aws_region }}"
+        no_log: yes
+
+      - name: Ensure the resource doesn't exist
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: absent
+          skip_final_snapshot: True
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - not result.changed
+        ignore_errors: yes
+
+      - name: Check Mode - Create a mariadb instance
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: present
+          engine: mariadb
+          username: "{{ username }}"
+          password: "{{ password }}"
+          db_instance_class: "{{ db_instance_class }}"
+          allocated_storage: "{{ allocated_storage }}"
+          <<: *aws_connection_info
+        register: result
+        check_mode: yes
+
+      - assert:
+          that:
+            - result.changed
+
+      - name: Create a mariadb instance
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: present
+          engine: mariadb
+          username: "{{ username }}"
+          password: "{{ password }}"
+          db_instance_class: "{{ db_instance_class }}"
+          allocated_storage: "{{ allocated_storage }}"
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - result.changed
+            - "result.db_instance_identifier == '{{ instance_id }}'"
+
+      - name: Idempotence
+        rds_instance:
+          id: '{{ instance_id }}'
+          state: present
+          engine: mariadb
+          username: "{{ username }}"
+          password: "{{ password }}"
+          db_instance_class: "{{ db_instance_class }}"
+          allocated_storage: "{{ allocated_storage }}"
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - not result.changed
+            - result.db_instance_identifier
+
+      - name: Idempotence with minimal options
+        rds_instance:
+          id: '{{ instance_id }}'
+          state: present
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - not result.changed
+            - result.db_instance_identifier
+
+      - name: Check Mode - stop the instance
+        rds_instance:
+          id: '{{ instance_id }}'
+          state: stopped
+          <<: *aws_connection_info
+        register: result
+        check_mode: yes
+
+      - assert:
+          that:
+            - result.changed
+
+      - name: Stop the instance
+        rds_instance:
+          id: '{{ instance_id }}'
+          state: stopped
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - result.changed
+
+      - name: Check Mode - idempotence
+        rds_instance:
+          id: '{{ instance_id }}'
+          state: stopped
+          <<: *aws_connection_info
+        register: result
+        check_mode: yes
+
+      - assert:
+          that:
+            - not result.changed
+
+      - name: Idempotence
+        rds_instance:
+          id: '{{ instance_id }}'
+          state: stopped
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - not result.changed
+
+      - name: Check mode - reboot a stopped instance
+        rds_instance:
+          id: '{{ instance_id }}'
+          state: rebooted
+          <<: *aws_connection_info
+        register: result
+        check_mode: yes
+
+      - assert:
+          that:
+            - result.changed
+
+      - name: Reboot a stopped instance
+        rds_instance:
+          id: '{{ instance_id }}'
+          state: rebooted
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - result.changed
+
+      - name: Check Mode - start the instance
+        rds_instance:
+          id: '{{ instance_id }}'
+          state: started
+          <<: *aws_connection_info
+        register: result
+        check_mode: yes
+
+      - assert:
+          that:
+            - not result.changed
+
+      - name: Stop the instance
+        rds_instance:
+          id: '{{ instance_id }}'
+          state: stopped
+          <<: *aws_connection_info
+
+      - name: Start the instance
+        rds_instance:
+          id: '{{ instance_id }}'
+          state: started
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - result.changed
+
+    always:
+
+      - name: Remove DB instance
+        rds_instance:
+          id: '{{ instance_id }}'
+          state: absent
+          skip_final_snapshot: True
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - result.changed

test/integration/targets/rds_instance/tasks/test_tags.yml

@@ -0,0 +1,131 @@
+---
+  - block:
+      - name: set up aws connection info
+        set_fact:
+          aws_connection_info: &aws_connection_info
+            aws_access_key: "{{ aws_access_key }}"
+            aws_secret_key: "{{ aws_secret_key }}"
+            security_token: "{{ security_token }}"
+            region: "{{ aws_region }}"
+        no_log: yes
+
+      - name: Ensure the resource doesn't exist
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: absent
+          skip_final_snapshot: True
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - not result.changed
+        ignore_errors: yes
+
+      - name: Create a mariadb instance
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: present
+          engine: mariadb
+          username: "{{ username }}"
+          password: "{{ password }}"
+          db_instance_class: "{{ db_instance_class }}"
+          allocated_storage: "{{ allocated_storage }}"
+          tags:
+            Name: "{{ instance_id }}"
+            Created_by: Ansible rds_instance tests
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - result.changed
+            - "result.db_instance_identifier == '{{ instance_id }}'"
+            - "result.tags | length == 2"
+            - "result.tags.Name == '{{ instance_id }}'"
+            - "result.tags.Created_by == 'Ansible rds_instance tests'"
+
+      - name: Test idempotence omitting tags
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: present
+          engine: mariadb
+          username: "{{ username }}"
+          password: "{{ password }}"
+          db_instance_class: "{{ db_instance_class }}"
+          allocated_storage: "{{ allocated_storage }}"
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - not result.changed
+            - "result.tags | length == 2"
+
+      - name: Test tags are not purged if purge_tags is False
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: present
+          engine: mariadb
+          username: "{{ username }}"
+          password: "{{ password }}"
+          db_instance_class: "{{ db_instance_class }}"
+          allocated_storage: "{{ allocated_storage }}"
+          tags: {}
+          purge_tags: False
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - not result.changed
+            - "result.tags | length == 2"
+
+      - name: Add a tag and remove a tag
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: present
+          tags:
+            Name: "{{ instance_id }}-new"
+            Created_by: Ansible rds_instance tests
+          purge_tags: True
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - result.changed
+            - "result.tags | length == 2"
+            - "result.tags.Name == '{{ instance_id }}-new'"
+
+      - name: Remove all tags
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: present
+          engine: mariadb
+          username: "{{ username }}"
+          password: "{{ password }}"
+          db_instance_class: "{{ db_instance_class }}"
+          allocated_storage: "{{ allocated_storage }}"
+          tags: {}
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - result.changed
+            - not result.tags
+
+    always:
+
+      - name: Ensure the resource doesn't exist
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: absent
+          skip_final_snapshot: True
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - result.changed

test/integration/targets/rds_instance/tasks/test_vpc_security_groups.yml

@@ -0,0 +1,166 @@
+---
+  - block:
+      - name: set up aws connection info
+        set_fact:
+          aws_connection_info: &aws_connection_info
+            aws_access_key: "{{ aws_access_key }}"
+            aws_secret_key: "{{ aws_secret_key }}"
+            security_token: "{{ security_token }}"
+            region: "{{ aws_region }}"
+        no_log: yes
+
+      - name: create a VPC
+        ec2_vpc_net:
+          name: "{{ resource_prefix }}-vpc"
+          state: present
+          cidr_block: "10.122.122.128/26"
+          tags:
+            Name: "{{ resource_prefix }}-vpc"
+            Description: "created by rds_instance integration tests"
+          <<: *aws_connection_info
+        register: vpc_result
+
+      - name: create subnets
+        ec2_vpc_subnet:
+          cidr: "{{ item.cidr }}"
+          az: "{{ item.zone }}"
+          vpc_id: "{{ vpc_result.vpc.id }}"
+          tags:
+            Name: "{{ resource_prefix }}-subnet"
+            Description: "created by rds_instance integration tests"
+          state: present
+          <<: *aws_connection_info
+        register: subnets_result
+        loop:
+          - {"cidr": "10.122.122.128/28", "zone": "{{ aws_region }}a"}
+          - {"cidr": "10.122.122.144/28", "zone": "{{ aws_region }}b"}
+          - {"cidr": "10.122.122.160/28", "zone": "{{ aws_region }}c"}
+          - {"cidr": "10.122.122.176/28", "zone": "{{ aws_region }}d"}
+
+      - name: Create security groups
+        ec2_group:
+          name: "{{ item }}"
+          description: "created by rds_instance integration tests"
+          state: present
+          <<: *aws_connection_info
+        register: sgs_result
+        loop:
+          - "{{ resource_prefix }}-sg-1"
+          - "{{ resource_prefix }}-sg-2"
+          - "{{ resource_prefix }}-sg-3"
+
+      - debug: var=sgs_result
+
+      - name: Ensure the resource doesn't exist
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: absent
+          skip_final_snapshot: True
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - not result.changed
+        ignore_errors: yes
+
+      - name: Create a DB instance in the VPC with two security groups
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: present
+          engine: mariadb
+          username: "{{ username }}"
+          password: "{{ password }}"
+          db_instance_class: "{{ db_instance_class }}"
+          allocated_storage: "{{ allocated_storage }}"
+          vpc_security_group_ids:
+            - "{{ sgs_result.results.0.group_id }}"
+            - "{{ sgs_result.results.1.group_id }}"
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - result.changed
+            - "result.db_instance_identifier == '{{ instance_id }}'"
+
+      - name: Add a new security group
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: present
+          vpc_security_group_ids:
+            - "{{ sgs_result.results.2.group_id }}"
+          <<: *aws_connection_info
+        register: result
+
+      - assert:
+          that:
+            - result.changed
+
+    always:
+
+      - name: Ensure the resource doesn't exist
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: absent
+          skip_final_snapshot: True
+          <<: *aws_connection_info
+        register: result
+        ignore_errors: yes
+
+      - name: Remove security groups
+        ec2_group:
+          name: "{{ item }}"
+          description: "created by rds_instance integration tests"
+          state: absent
+          <<: *aws_connection_info
+        register: sgs_result
+        loop:
+          - "{{ resource_prefix }}-sg-1"
+          - "{{ resource_prefix }}-sg-2"
+          - "{{ resource_prefix }}-sg-3"
+
+      - name: remove subnets
+        ec2_vpc_subnet:
+          cidr: "{{ item.cidr }}"
+          az: "{{ item.zone }}"
+          vpc_id: "{{ vpc_result.vpc.id }}"
+          tags:
+            Name: "{{ resource_prefix }}-subnet"
+            Description: "created by rds_instance integration tests"
+          state: absent
+          <<: *aws_connection_info
+        register: subnets
+        ignore_errors: yes
+        retries: 30
+        until: subnets is not failed
+        delay: 10
+        loop:
+          - {"cidr": "10.122.122.128/28", "zone": "{{ aws_region }}a"}
+          - {"cidr": "10.122.122.144/28", "zone": "{{ aws_region }}b"}
+          - {"cidr": "10.122.122.160/28", "zone": "{{ aws_region }}c"}
+          - {"cidr": "10.122.122.176/28", "zone": "{{ aws_region }}d"}
+
+      - name: create a VPC
+        ec2_vpc_net:
+          name: "{{ resource_prefix }}-vpc"
+          state: absent
+          cidr_block: "10.122.122.128/26"
+          tags:
+            Name: "{{ resource_prefix }}-vpc"
+            Description: "created by rds_instance integration tests"
+          <<: *aws_connection_info
+        register: vpc_result
+        ignore_errors: yes
+        retries: 30
+        until: vpc_result is not failed
+        delay: 10
+
+      - name: Ensure the resource doesn't exist
+        rds_instance:
+          id: "{{ instance_id }}"
+          state: absent
+          skip_final_snapshot: True
+          <<: *aws_connection_info
+        register: result
+        ignore_errors: yes