Database
The Database blueprint (database v1) deploys one managed database in
your account. You choose the engine at deploy time; the hardening
posture is the same either way: encrypted at rest, backups on, no public
access.
Engines
Section titled “Engines”RDS PostgreSQL (about $13/month while running):
- A
db.t4g.microinstance with 20 GB gp3 storage, named inside thestacktakt-*namespace. - Storage encryption on: data, automated backups, and snapshots.
- Automated backups with a 7-day retention window (point-in-time restore).
- Not publicly accessible, in a dedicated security group with no ingress rules: nothing reaches the instance until you grant access deliberately.
DynamoDB (usage-based, near zero when idle):
- An on-demand table, server-side encryption enabled.
- Point-in-time recovery on: restore to any second in the preceding 35 days.
- No network listener and no anonymous path: every operation requires an explicitly granted AWS IAM identity.
Inputs
Section titled “Inputs”| Input | Required | Description |
|---|---|---|
| Engine | Yes | PostgreSQL (RDS) or DynamoDB. |
| Name | Yes | Identifier label; resources are named stacktakt-<name>. |
| Target VPC | Postgres only | Hosts the instance’s subnet group and security group. |
Region and tags are platform-supplied.
Control mapping
Section titled “Control mapping”The mapping below carries one entry per engine for each citation; the snapshot taken at apply time keeps only the variant matching the engine you deployed.
Generated from backend/templates/database/v1/controls.yaml (framework: hipaa-security-rule). Run npm run generate:blueprints to refresh.
| HIPAA citation | Requirement | Engine | Status | Implemented by |
|---|---|---|---|---|
| §164.312(a)(1) | Access control | postgres | Implemented | aws_db_instance.postgres, aws_security_group.database |
| §164.312(a)(1) | Access control | dynamodb | Implemented | aws_dynamodb_table.database |
| §164.312(a)(2)(iv) | Encryption and decryption | postgres | Implemented | aws_db_instance.postgres |
| §164.312(a)(2)(iv) | Encryption and decryption | dynamodb | Implemented | aws_dynamodb_table.database |
| §164.312(c)(1) | Integrity | postgres | Implemented | aws_db_instance.postgres |
| §164.312(c)(1) | Integrity | dynamodb | Implemented | aws_dynamodb_table.database |
Caveats recorded in the mapping, shown verbatim:
- §164.312(a)(2)(iv) (postgres): Encryption uses the AWS-managed RDS key; a customer-managed KMS key is a later template version plus a deployment-role amendment.
- §164.312(a)(2)(iv) (dynamodb): Encryption uses an AWS-owned key; a customer-managed KMS key is a later template version plus a deployment-role amendment.
Generated documents
Section titled “Generated documents”Once applied, the Documentation Center derives an engine-aware System overview and a Control narrative for this deployment.
Works with
Section titled “Works with”A Database is the target end of a Simple ETL pipeline, which writes typed rows into it from files dropped in a source bucket.