aws_rds_cluster from snapshot doesn't set new master password

[valentinbud]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

$ terraform version
Terraform v0.12.5
+ provider.aws v2.20.0
+ provider.mysql v1.7.0

Affected Resource(s)

• aws_rds_cluster

Terraform Configuration Files

data "aws_db_cluster_snapshot" "latest" {
  db_cluster_identifier = "main-cluster"
  most_recent           = true
}

resource "aws_rds_cluster" "qa" {
  cluster_identifier              = "qa-cluster"
  engine                          = "aurora-mysql"
  engine_version                  = "5.7.12"
  skip_final_snapshot             = true
  apply_immediately               = true
  snapshot_identifier             = data.aws_db_cluster_snapshot.latest.id
  db_cluster_parameter_group_name = "main-aurora57-cluster"
  db_subnet_group_name            = "db-subnet"
  master_username                 = "root"
  master_password                 = "cbMTnFjpnVJL5DrCtk4pdqQxgyCgUQrV123"
  vpc_security_group_ids = [
    "sg-fd05b285",
    "sg-d91caba1",
    "sg-5ee68e2f"
  ]
}

resource "aws_rds_cluster_instance" "qa" {
  identifier              = "qa-cluster"
  cluster_identifier      = aws_rds_cluster.qa.id
  engine                  = "aurora-mysql"
  engine_version          = "5.7.12"
  instance_class          = "db.t3.medium"
  publicly_accessible     = true
  db_subnet_group_name    = "db-subnet"
  db_parameter_group_name = "db-aurora57"
  apply_immediately       = true
}

Debug Output

I don't think it would help in this case. terraform apply successfully creates the resources.

Panic Output

There's no panic output.

Expected Behavior

I expect the new RDS cluster to have the root password set up to cbMTnFjpnVJL5DrCtk4pdqQxgyCgUQrV123.

Actual Behavior

I have tried to connect to the cluster using root with password cbMTnFjpnVJL5DrCtk4pdqQxgyCgUQrV123 and receive the following error:

$ mysql -h rds-qa-cluster.domain.com -u root -pcbMTnFjpnVJL5DrCtk4pdqQxgyCgUQrV123
ERROR 1045 (28000): Access denied for user 'root'@'10.20.2.223' (using password: YES)

Steps to Reproduce

Create an Aurora RDS cluster from a snapshot of an existing Aurora cluster with a different master_password setup and try to connect to the cluster endpoint with the new master_password.

Important Factoids

Changing the master password of the qa-cluster using AWS CLI or AWS Console allows me to login to the cluster.

References

I have searched the open issues but couldn't find one that matches my use case exactly.
It might relate to #3220 though

Thank you for looking into this 😃.

[bflad]

Hi @valentinbud 👋 Thank you for reporting this and sorry for the unexpected behavior.

It does appear the resource is not properly handling master_password when RestoreDBClusterFromSnapshot is called during the resource Create function. The API call itself does not accept MasterUserPassword as a parameter, so we should be resetting the password via ModifyDBCluster after the database is restored when the argument is declared in Terraform.

[valentinbud]

Hi @bflad 👋,

Thank you for your prompt response. For what is worth at the moment I do it in two
terraform apply stages with master_password set through TF_VAR_master_password.
In the second stage I set the master_password I desire and use in other, subsequent, states.
Works like a charm. I'll keep an eye on this, test and modify my states when it gets fixed.

Have a wonderful day 😃.

[bflad]

The fix for this has been merged and will release later today with version 2.21.0 of the Terraform AWS Provider. 👍

[bflad]

This has been released in version 2.21.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests, documentation updates, or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[valentinbud]

Hi @bflad 👋

I have tried it today with latest release of aws provider. It works like a charm. Thank you for fixing this.

Have a wonderful day 😃

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!