From 1946cb676869ac2b3cb6c212827ca1c12007105d Mon Sep 17 00:00:00 2001 From: Melissa Greenbaum <69476188+magreenbaum@users.noreply.github.com> Date: Thu, 19 Dec 2024 10:55:04 -0500 Subject: [PATCH] docs: Clarify the `manage_master_user_password_rotation` functionality (#580) * attempting to clarify the disable rotation functionality since its not actually supported by the provider currently * update description --- README.md | 2 +- modules/db_instance/README.md | 2 +- modules/db_instance/main.tf | 5 +++++ modules/db_instance/variables.tf | 2 +- variables.tf | 2 +- 5 files changed, 9 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 45047f34..39338162 100644 --- a/README.md +++ b/README.md @@ -291,7 +291,7 @@ No resources. | [maintenance\_window](#input\_maintenance\_window) | The window to perform maintenance in. Syntax: 'ddd:hh24:mi-ddd:hh24:mi'. Eg: 'Mon:00:00-Mon:03:00' | `string` | `null` | no | | [major\_engine\_version](#input\_major\_engine\_version) | Specifies the major version of the engine that this option group should be associated with | `string` | `null` | no | | [manage\_master\_user\_password](#input\_manage\_master\_user\_password) | Set to true to allow RDS to manage the master user password in Secrets Manager | `bool` | `true` | no | -| [manage\_master\_user\_password\_rotation](#input\_manage\_master\_user\_password\_rotation) | Whether to manage the master user password rotation. By default, false on creation, rotation is managed by RDS. Setting this value to false after previously having been set to true will disable automatic rotation. | `bool` | `false` | no | +| [manage\_master\_user\_password\_rotation](#input\_manage\_master\_user\_password\_rotation) | Whether to manage the master user password rotation. By default, false on creation, rotation is managed by RDS. There is not currently a way to disable this on initial creation even when set to false. Setting this value to false after previously having been set to true will disable automatic rotation. | `bool` | `false` | no | | [master\_user\_password\_rotate\_immediately](#input\_master\_user\_password\_rotate\_immediately) | Specifies whether to rotate the secret immediately or wait until the next scheduled rotation window. | `bool` | `null` | no | | [master\_user\_password\_rotation\_automatically\_after\_days](#input\_master\_user\_password\_rotation\_automatically\_after\_days) | Specifies the number of days between automatic scheduled rotations of the secret. Either automatically\_after\_days or schedule\_expression must be specified. | `number` | `null` | no | | [master\_user\_password\_rotation\_duration](#input\_master\_user\_password\_rotation\_duration) | The length of the rotation window in hours. For example, 3h for a three hour window. | `string` | `null` | no | diff --git a/modules/db_instance/README.md b/modules/db_instance/README.md index b48683d3..3746718e 100644 --- a/modules/db_instance/README.md +++ b/modules/db_instance/README.md @@ -82,7 +82,7 @@ No modules. | [license\_model](#input\_license\_model) | License model information for this DB instance. Optional, but required for some DB engines, i.e. Oracle SE1 | `string` | `null` | no | | [maintenance\_window](#input\_maintenance\_window) | The window to perform maintenance in. Syntax: 'ddd:hh24:mi-ddd:hh24:mi'. Eg: 'Mon:00:00-Mon:03:00' | `string` | `null` | no | | [manage\_master\_user\_password](#input\_manage\_master\_user\_password) | Set to true to allow RDS to manage the master user password in Secrets Manager. Cannot be set if password is provided | `bool` | `true` | no | -| [manage\_master\_user\_password\_rotation](#input\_manage\_master\_user\_password\_rotation) | Whether to manage the master user password rotation. By default, false on creation, rotation is managed by RDS. Setting this value to false after previously having been set to true will disable automatic rotation. | `bool` | `false` | no | +| [manage\_master\_user\_password\_rotation](#input\_manage\_master\_user\_password\_rotation) | Whether to manage the master user password rotation. By default, false on creation, rotation is managed by RDS. There is not currently a way to disable this on initial creation even when set to false. Setting this value to false after previously having been set to true will disable automatic rotation. | `bool` | `false` | no | | [master\_user\_password\_rotate\_immediately](#input\_master\_user\_password\_rotate\_immediately) | Specifies whether to rotate the secret immediately or wait until the next scheduled rotation window. | `bool` | `null` | no | | [master\_user\_password\_rotation\_automatically\_after\_days](#input\_master\_user\_password\_rotation\_automatically\_after\_days) | Specifies the number of days between automatic scheduled rotations of the secret. Either automatically\_after\_days or schedule\_expression must be specified. | `number` | `null` | no | | [master\_user\_password\_rotation\_duration](#input\_master\_user\_password\_rotation\_duration) | The length of the rotation window in hours. For example, 3h for a three hour window. | `string` | `null` | no | diff --git a/modules/db_instance/main.tf b/modules/db_instance/main.tf index 2fbe7138..ce9b4c43 100644 --- a/modules/db_instance/main.tf +++ b/modules/db_instance/main.tf @@ -211,6 +211,11 @@ resource "aws_iam_role_policy_attachment" "enhanced_monitoring" { # Managed Secret Rotation ################################################################################ +# There is not currently a way to disable secret rotation on an initial apply. +# In order to use master password secrets management without a rotation, the following workaround can be used: +# `manage_master_user_password_rotation` must be set to true first and applied followed by setting it to false and another apply. +# Note: when setting `manage_master_user_password_rotation` to true, a schedule must also be set using `master_user_password_rotation_schedule_expression` or `master_user_password_rotation_automatically_after_days`. +# See: https://github.com/hashicorp/terraform-provider-aws/issues/37779 resource "aws_secretsmanager_secret_rotation" "this" { count = var.create && var.manage_master_user_password && var.manage_master_user_password_rotation ? 1 : 0 diff --git a/modules/db_instance/variables.tf b/modules/db_instance/variables.tf index 4c854c1c..acb17305 100644 --- a/modules/db_instance/variables.tf +++ b/modules/db_instance/variables.tf @@ -489,7 +489,7 @@ variable "cloudwatch_log_group_tags" { ################################################################################ variable "manage_master_user_password_rotation" { - description = "Whether to manage the master user password rotation. By default, false on creation, rotation is managed by RDS. Setting this value to false after previously having been set to true will disable automatic rotation." + description = "Whether to manage the master user password rotation. By default, false on creation, rotation is managed by RDS. There is not currently a way to disable this on initial creation even when set to false. Setting this value to false after previously having been set to true will disable automatic rotation." type = bool default = false } diff --git a/variables.tf b/variables.tf index 4f202732..cf3e5008 100644 --- a/variables.tf +++ b/variables.tf @@ -632,7 +632,7 @@ variable "db_instance_role_associations" { ################################################################################ variable "manage_master_user_password_rotation" { - description = "Whether to manage the master user password rotation. By default, false on creation, rotation is managed by RDS. Setting this value to false after previously having been set to true will disable automatic rotation." + description = "Whether to manage the master user password rotation. By default, false on creation, rotation is managed by RDS. There is not currently a way to disable this on initial creation even when set to false. Setting this value to false after previously having been set to true will disable automatic rotation." type = bool default = false }