OVHcloudStatic-verified

OVHcloud Managed Database

Name: OVHcloud Managed Database
Brand: IaC Bazaar
SKU: ovh-managed-database
Availability: InStock

Managed PG/MySQL/Kafka with users, IP restrictions, and private network egress.

terraformAlt & Specialty Cloudsovh

Compare Managed Relational Database across clouds →

ovh-managed-databasevizier v1.2.0

Verification

Static-verified

Passed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).

Conformance

Static validation (fmt · validate · tflint)
No applicable security policies for this provider
Plan tests (mocked: validation rules · outputs)

Provenance

SHA-256 checksum
Cosign signature

Functional

Live test pending (no cloud run yet)

Last verified 2026-06-28 · how we verify

Verify this download

cosign · sha-256

Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.

# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub

# 2. This module's Sigstore bundle
curl -o ovh-managed-database-1.0.0.sigstore.json \
  https://www.iac-bazaar.com/api/artifacts/ovh-managed-database/signature

# 3. Verify the tarball you downloaded
cosign verify-blob \
  --key cosign.pub \
  --bundle ovh-managed-database-1.0.0.sigstore.json \
  ovh-managed-database-1.0.0.tar.gz
# → Verified OK

# 4. (optional) confirm the checksum too
echo "51e7e6fbea6d8482cb4f6cba382b1ca386515e71b847d0eaa4602eecbb64f208  ovh-managed-database-1.0.0.tar.gz" | sha256sum -c

Signature bundle Public key Machine-readable receipt How we verify

Use it from the registry

terraform · opentofu

module "managed_database" {
  source  = "www.iac-bazaar.com/iac-bazaar/ovh-managed-database/ovh"
  version = "1.0.0"
}

Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.

Cite it in your README

badge · attribution

Paste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads static-verified because the record says so, and the link lands on this page.

README.md, GitLab, Gitea

[![IaC Bazaar: static-verified](https://www.iac-bazaar.com/api/artifacts/ovh-managed-database/badge)](https://www.iac-bazaar.com/catalog/ovh-managed-database?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)

Terraform module 1.0.0, static-verified on IaC Bazaar: [OVHcloud Managed Database](https://www.iac-bazaar.com/catalog/ovh-managed-database?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)

```hcl
module "managed_database" {
  source  = "www.iac-bazaar.com/iac-bazaar/ovh-managed-database/ovh"
  version = "1.0.0"
}
```

Preview:

Inputs & outputs

Create a free account to read this module's contract

The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.

A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.

Create a free account →Sign in

Documentation

ovh-managed-database

An OVHcloud Managed Database cluster — PostgreSQL, MySQL, Kafka, MongoDB, Redis/Valkey, OpenSearch, Cassandra, M3DB or Grafana — with a deny-by-default IP trust list, optional generic users, and private-network (vRack) node placement.

Status: static-validated, live-test pending. Validated with tofu validate + tflint + checkov against the ovh/ovh provider. Not yet applied against a live OVHcloud project, so it ships under live-test quarantine (no cloud sandbox account yet).

Design & secure defaults

Deny-by-default ingress. The cluster authorizes no inbound source until you populate ip_restrictions with explicit CIDR blocks. Each entry is CIDR-validated. (This uses the standalone ovh_cloud_project_database_ip_restriction resource, keyed for clean diffs.)
Deletion protection on. deletion_protection = true guards against accidental teardown; set false to allow destroy.
Private networking ready. Each node block accepts a network_id (vRack/openstackId) + subnet_id; a validation enforces that all nodes share the same region and network so you cannot mix public and private nodes.
Generic users handled safely. users creates accounts via the generic user resource, which OVH supports only for mysql, cassandra, kafka, and grafana. A precondition rejects users on other engines (postgresql, mongodb, redis use dedicated user resources) rather than silently failing. Generated passwords are exposed only through the sensitive output.
No hardcoded secrets. Credentials come from the provider block / environment.

The engine matrix is wide; OVH constrains valid version/flavor/plan combinations per engine. Test one engine per run.

Provider

ovh/ovh >= 2.0, < 3.0. Requires Terraform/OpenTofu >= 1.6.

License

Commercial — LicenseRef-IaCBazaar-Commercial. See the IaC Bazaar terms.

Usage code & full reference need an account

The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.

Usage
Key inputs
Outputs

Create a free account Sign in

Related modules

Static validatedLive test pending

civo-database

firewall_id is optional and a database without one answers to every address that can reach its endpoint; nodes = 1 is one node whose failure is downtime; and backups are the platform's, not configurable here. Firewall and network required, two nodes (one by name), the password as a sensitive output, and an output that says no backup schedule can be set.

View module

Static validatedLive test pending

vultr-database

A managed database gets a public hostname and trusted_ips is optional: left empty, any address on the internet may try the password; the backup hour is picked for you; and a plan with no replicas is one node whose failure is downtime. Trusted ranges required (a /0 refused unless accepted), a VPC attachment, one standby by default, both windows set, and the password as a sensitive output.

View module

Static validatedLive test pending

azure-sql-managed-instance

The public data endpoint turns a private database into one listening on the internet on port 3342; SQL logins put an administrator password in state when Entra-only authentication would remove them entirely; and zone redundancy is off by default. Private, Entra-only with SQL authentication accepted by name, Business Critical across zones, TLS 1.2, and geo-zone-redundant backups.

View module

Static validatedLive test pending

oci-postgresql

password_type PLAIN_TEXT writes the admin password into the Terraform state and every plan that shows it; storage that is not regionally durable dies with its availability domain; and a DB system created without a management policy takes no backups. Vault secret reference, regionally durable storage, daily backups optionally copied to another region, a read replica, and an NSG on port 5432.

View module

Live-tested

gcp-alloydb

AlloyDB cluster with primary + read-pool instances, PSC connectivity, automated backups and columnar/vector engine flags.

View module

Live-tested

aws-aurora

Aurora PostgreSQL/MySQL cluster with instances, parameter groups, Serverless v2 scaling, and enhanced monitoring.

View module