A DWS Cluster Whose Snapshots Outlive It, Which the Default Does Not Arrange
A DWS cluster keeping its manual snapshots when it is deleted, since the default of zero deletes the backups along with the thing they were backing up and turns a mistaken delete into a permanent one. Disks are encrypted at creation because they cannot be later, audit logging to LTS is on, and there is no public endpoint unless you ask for one.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- No applicable security policies for this provider
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-15 · how we verify
Use it from the registry
terraform · opentofumodule "dws" {
source = "www.iac-bazaar.com/iac-bazaar/huawei-dws/huaweicloud"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
huawei-dws
A managed data warehouse on Huawei Cloud Data Warehouse Service. Works with Terraform and OpenTofu
(>= 1.6), huaweicloud provider >= 1.60, < 2.0.
keep_last_manual_snapshot 0 deletes the snapshots with the cluster, which is the default and the thing that turns a mistaken delete into a permanent one. Kept here.
Disk encryption is a creation-time choice, so a warehouse built without a key stays unencrypted for its whole life.
lts_enable is off, so there is no audit trail unless you say so - the cluster runs perfectly well with no record of who queried what.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
huawei-css-cluster
A CSS cluster with security_mode true, since false means the cluster answers anyone who can reach it with no credentials while the console reports it healthy. HTTPS requires security mode and the API says so late, so the module says so first; disks are encrypted at creation, and public access without a whitelist is refused.
huawei-dcs-redis
A Distributed Cache Service Redis instance in your VPC with primary and standby across two zones (one by name), TLS required (plaintext by name), the whitelist on with your ranges, a password from a secret store never output, weekly backups kept seven days, a maintenance window, and flushall, flushdb, keys and hgetall renamed so an accident cannot type them.
huawei-database-migration
A DRS job with the lag alarm armed to an SMN topic, since without one the console shows the same green whether the job is current or hours behind. The target is held read-only, because anything writing to it produces conflicts the job cannot see or repair; multi_write and a FULL_TRANS-only snapshot both have to be chosen by name.
huawei-dds-mongodb
A Document Database Service instance with ssl true, since false accepts plaintext client connections and nothing in the console says so, a named backup window and retention, and disk encryption that cannot be added afterwards. Sharding needs mongos, shard and config flavors and the module checks the combination before the apply rather than after.
huawei-mapreduce
A MapReduce Service cluster with safe_mode true, since false turns Kerberos off and leaves a cluster where Manager answers and nothing authenticates anybody. A node credential is required rather than left to the API, MRS Manager stays off the internet unless asked, and log collection is on so a cluster that fails to build does not take the reason with it.
huawei-rds-postgresql
One availability zone is one node whose failure is downtime; ssl_enable defaults to false, so clients speak plain TCP; the data volume is encrypted only when a KMS key is given; and the backup window and retention are the platform's. Two zones (one by name), SSL on, a KMS key expected (none by name), minor versions auto-upgraded, daily backups in your window with your retention.