diff --git a/.changelog/33699.txt b/.changelog/33699.txt new file mode 100644 index 000000000000..01bab98ee86b --- /dev/null +++ b/.changelog/33699.txt @@ -0,0 +1,3 @@ +```release-note:bug +resource/aws_db_instance: Creating resource from snapshot or point-in-time recovery now handles `manage_master_user_password` and `master_user_secret_kms_key_id` attributes correctly +``` diff --git a/internal/service/rds/instance.go b/internal/service/rds/instance.go index dac32567253a..daeaf793bbd2 100644 --- a/internal/service/rds/instance.go +++ b/internal/service/rds/instance.go @@ -1120,6 +1120,16 @@ func resourceInstanceCreate(ctx context.Context, d *schema.ResourceData, meta in requiresModifyDbInstance = true } + if v, ok := d.GetOk("manage_master_user_password"); ok { + modifyDbInstanceInput.ManageMasterUserPassword = aws.Bool(v.(bool)) + requiresModifyDbInstance = true + } + + if v, ok := d.GetOk("master_user_secret_kms_key_id"); ok { + modifyDbInstanceInput.MasterUserSecretKmsKeyId = aws.String(v.(string)) + requiresModifyDbInstance = true + } + if v, ok := d.GetOk("max_allocated_storage"); ok { modifyDbInstanceInput.MaxAllocatedStorage = aws.Int64(int64(v.(int))) requiresModifyDbInstance = true @@ -1328,6 +1338,16 @@ func resourceInstanceCreate(ctx context.Context, d *schema.ResourceData, meta in input.MaxAllocatedStorage = aws.Int64(int64(v.(int))) } + if v, ok := d.GetOk("manage_master_user_password"); ok { + modifyDbInstanceInput.ManageMasterUserPassword = aws.Bool(v.(bool)) + requiresModifyDbInstance = true + } + + if v, ok := d.GetOk("master_user_secret_kms_key_id"); ok { + modifyDbInstanceInput.MasterUserSecretKmsKeyId = aws.String(v.(string)) + requiresModifyDbInstance = true + } + if v, ok := d.GetOk("monitoring_interval"); ok { modifyDbInstanceInput.MonitoringInterval = aws.Int64(int64(v.(int))) requiresModifyDbInstance = true diff --git a/internal/service/rds/instance_test.go b/internal/service/rds/instance_test.go index d332d7f792bf..2555364198ce 100644 --- a/internal/service/rds/instance_test.go +++ b/internal/service/rds/instance_test.go @@ -2297,6 +2297,56 @@ func TestAccRDSInstance_SnapshotIdentifier_basic(t *testing.T) { }) } +func TestAccRDSInstance_SnapshotIdentifier_ManagedMasterPasswordKMSKey(t *testing.T) { + ctx := acctest.Context(t) + if testing.Short() { + t.Skip("skipping long-running test in short mode") + } + + var dbInstance, sourceDbInstance rds.DBInstance + var dbSnapshot rds.DBSnapshot + + rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix) + sourceDbResourceName := "aws_db_instance.source" + snapshotResourceName := "aws_db_snapshot.test" + resourceName := "aws_db_instance.test" + + resource.ParallelTest(t, resource.TestCase{ + PreCheck: func() { acctest.PreCheck(ctx, t) }, + ErrorCheck: acctest.ErrorCheck(t, rds.EndpointsID), + ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories, + CheckDestroy: testAccCheckInstanceDestroy(ctx), + Steps: []resource.TestStep{ + { + Config: testAccInstanceConfig_snapshotID_ManagedMasterPasswordKMSKey(rName), + Check: resource.ComposeAggregateTestCheckFunc( + testAccCheckInstanceExists(ctx, sourceDbResourceName, &sourceDbInstance), + testAccCheckDBSnapshotExists(ctx, snapshotResourceName, &dbSnapshot), + testAccCheckInstanceExists(ctx, resourceName, &dbInstance), + resource.TestCheckResourceAttr(resourceName, "manage_master_user_password", "true"), + resource.TestCheckResourceAttr(resourceName, "master_user_secret.#", "1"), + resource.TestCheckResourceAttrSet(resourceName, "master_user_secret.0.kms_key_id"), + resource.TestCheckResourceAttrSet(resourceName, "master_user_secret.0.secret_arn"), + resource.TestCheckResourceAttrSet(resourceName, "master_user_secret.0.secret_status"), + ), + }, + { + ResourceName: resourceName, + ImportState: true, + ImportStateVerify: true, + ImportStateVerifyIgnore: []string{ + "apply_immediately", + "final_snapshot_identifier", + "manage_master_user_password", + "master_user_secret_kms_key_id", + "snapshot_identifier", + "skip_final_snapshot", + }, + }, + }, + }) +} + func TestAccRDSInstance_SnapshotIdentifier_namePrefix(t *testing.T) { ctx := acctest.Context(t) if testing.Short() { @@ -4345,6 +4395,54 @@ func TestAccRDSInstance_RestoreToPointInTime_monitoring(t *testing.T) { }) } +func TestAccRDSInstance_RestoreToPointInTime_ManagedMasterPassword(t *testing.T) { + ctx := acctest.Context(t) + if testing.Short() { + t.Skip("skipping long-running test in short mode") + } + + var dbInstance, sourceDbInstance rds.DBInstance + sourceName := "aws_db_instance.test" + resourceName := "aws_db_instance.restore" + rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix) + + resource.ParallelTest(t, resource.TestCase{ + PreCheck: func() { acctest.PreCheck(ctx, t) }, + ErrorCheck: acctest.ErrorCheck(t, rds.EndpointsID), + ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories, + CheckDestroy: testAccCheckInstanceDestroy(ctx), + Steps: []resource.TestStep{ + { + Config: testAccInstanceConfig_RestoreToPointInTime_ManageMasterPassword(rName), + Check: resource.ComposeAggregateTestCheckFunc( + testAccCheckInstanceExists(ctx, sourceName, &sourceDbInstance), + testAccCheckInstanceExists(ctx, resourceName, &dbInstance), + resource.TestCheckResourceAttr(resourceName, "manage_master_user_password", "true"), + resource.TestCheckResourceAttr(resourceName, "master_user_secret.#", "1"), + resource.TestCheckResourceAttrSet(resourceName, "master_user_secret.0.kms_key_id"), + resource.TestCheckResourceAttrSet(resourceName, "master_user_secret.0.secret_arn"), + resource.TestCheckResourceAttrSet(resourceName, "master_user_secret.0.secret_status"), + ), + }, + { + ResourceName: resourceName, + ImportState: true, + ImportStateVerify: true, + ImportStateVerifyIgnore: []string{ + "apply_immediately", + "delete_automated_backups", + "final_snapshot_identifier", + "latest_restorable_time", // dynamic value of a DBInstance + "manage_master_user_password", + "password", + "restore_to_point_in_time", + "skip_final_snapshot", + }, + }, + }, + }) +} + func TestAccRDSInstance_NationalCharacterSet_oracle(t *testing.T) { ctx := acctest.Context(t) if testing.Short() { @@ -6690,6 +6788,25 @@ resource "aws_db_instance" "restore" { `, rName, monitoringInterval)) } +func testAccInstanceConfig_RestoreToPointInTime_ManageMasterPassword(rName string) string { + return acctest.ConfigCompose( + testAccInstanceConfig_baseForPITR(rName), + fmt.Sprintf(` +resource "aws_db_instance" "restore" { + identifier = "%[1]s-restore" + instance_class = aws_db_instance.test.instance_class + + restore_to_point_in_time { + source_db_instance_identifier = aws_db_instance.test.identifier + use_latest_restorable_time = true + } + + skip_final_snapshot = true + manage_master_user_password = true +} +`, rName)) +} + func testAccInstanceConfig_iopsUpdate(rName string, iops int) string { return fmt.Sprintf(` data "aws_rds_engine_version" "default" { @@ -8923,6 +9040,62 @@ resource "aws_db_instance" "test" { `, rName)) } +func testAccInstanceConfig_snapshotID_ManagedMasterPasswordKMSKey(rName string) string { + return acctest.ConfigCompose( + testAccInstanceConfig_orderableClassMariadb(), + fmt.Sprintf(` +data "aws_caller_identity" "current" {} +data "aws_partition" "current" {} + +resource "aws_kms_key" "example" { + description = "Terraform acc test %[1]s" + + policy = <