The removal of support for master password generation was maybe too hasty. about terraform-aws-rds-aurora HOT 5 CLOSED

Provide the feature as it was before

You really should look for ways to avoid having the password in plaintext in your statefile. We do not have any plans to re-enable that functionality because its a really poor practice

That said, there is nothing from stopping you from using the random password resource yourself to generate a password and pass it into this module - we want to push users towards the recommended approach (for their own benefit)

from terraform-aws-rds-aurora.

Of course one should avoid that. I thought I made it clear I agree with the intent. The only issue is with the stated removal being:

With RDS now supporting the integration with SecretsManager to manage the master user password, the ability to generate a random password has been removed from this module

But RDS doesn't support that in all cases. In those cases, what is your recommendation? I cannot enable IAM authentication without setting a master password. So, without encrypted state support, I'm not clear on the recommended approach here.

from terraform-aws-rds-aurora.

If you don't want to go the managed password route, just supply a password as input to your module via master_password. You can even use the random resource like this module previously did if you'd like

  # ...
  manage_master_user_password = false
  master_password = <something>
  # ...

from terraform-aws-rds-aurora.

I appreciate you taking the time. Just to clarify, that is precisely what I am doing. I mention that as the alternatives in the opening remarks. I guess my question is, if this is a poor practice, what is the alternative? I do want to go the managed password route; it just isn't supported.

One improvement would be to ignore changes to the master password, so it can be changed outside the state, but that still requires the initial inclusion.

from terraform-aws-rds-aurora.

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

from terraform-aws-rds-aurora.