Is there a way to only have an encrypted version of my RDS password in my Terraform code and for AWS to decrypt it for RDS so you use the decrypted password to login to the RDS?

So set my rds password variable value to the encrypted password and when terraform builds the RDS I login in with is the unencrypted password?

1 Answer 1


If I am understanding your question correctly, what you are describing sounds like a perfect use case for SSM. You can store your RDS password as a secure string parameter encrypted by KMS, then reference it in you terraform file as a data source with decryption. With this method, you only have to reference your decrypted password, and never directly store the encrypted or plain text in your tf file.

data "aws_ssm_parameter" "foo" {
  name = "foo"
  with_decryption = true
  • Would that be stored in the tfstate file as the unencrypted password?
    – doug
    Commented Sep 25, 2019 at 14:11
  • No it shouldn't, unless you do something to purposefully output it.
    – Preston Martin
    Commented Sep 25, 2019 at 14:57
  • @doug If this answers your question, accept it as the answer.
    – Aliminator
    Commented Oct 4, 2019 at 12:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.