Is there a way to only have an encrypted version of my RDS password in my Terraform code and for AWS to decrypt it for RDS so you use the decrypted password to login to the RDS?

So set my rds password variable value to the encrypted password and when terraform builds the RDS I login in with is the unencrypted password?


If I am understanding your question correctly, what you are describing sounds like a perfect use case for SSM. You can store your RDS password as a secure string parameter encrypted by KMS, then reference it in you terraform file as a data source with decryption. With this method, you only have to reference your decrypted password, and never directly store the encrypted or plain text in your tf file.

data "aws_ssm_parameter" "foo" {
  name = "foo"
  with_decryption = true
  • Would that be stored in the tfstate file as the unencrypted password?
    – doug
    Sep 25 '19 at 14:11
  • No it shouldn't, unless you do something to purposefully output it.
    – Preston Martin
    Sep 25 '19 at 14:57
  • @doug If this answers your question, accept it as the answer.
    – Aliminator
    Oct 4 '19 at 12:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.