r/Terraform • u/gignosko • 6d ago

AWS Changing an RDS KMS while using TF

Hi all!

So, I've inherited this project...

I know I can't use TF to actually change the KMS, I need to do this: https://repost.aws/knowledge-center/update-encryption-key-rds

My question is what will TF do the next time I run it after I've manually changed the KMS? The RDS instance is under TF control, when I finish the steps to change the KMS will the new arn be the same as the old one? I just want to make sure that TF won't reverse what I'm doing manually.

Thanks!

3 Upvotes

100% Upvoted

3 comments sorted by

3

u/razzledazzled 6d ago

I mean, TF will do nothing because the article you linked means you will have the original instance/cluster A on KMS A that is managed by TF. Then you will also have the manually created instance/cluster B that is restored from A's snapshot.

If you want TF to manage the newly restored instance/cluster you will have to do some state manipulation using some combination of tf CLI state manipulation commands https://developer.hashicorp.com/terraform/cli/state/move

or using meta blocks https://developer.hashicorp.com/terraform/language/modules/develop/refactoring#move-a-resource-or-module

Also keep in mind if there is data-in-flight that has to be accounted for, this migration becomes more complicated because you have to account for replication from the original to the newly restored db.

1

u/uberduck 6d ago

This is the correct answer.

To add to that, OP is probably better off snapshotting and recreating a new kms encrypted rds from the snapshot, then switch the apps over.

Bonus point if there is a R53 record for faster switch over.

1

u/burlyginger 6d ago

I've done this to our 20ish DBs this year.

You'll have to update the KMS config in the RDS instance/cluster after you make the change.

You can ignore changes on the KMS attribute and terraform won't do anything.

My process was basically:

  • safety snapshot
  • delete cluster with final snapshot
  • restore cluster from snapshot with new KMS key, all other options the same.
  • update tf config and merge (ensure no chsnges)

Aurora cluster IDs are the cluster name so you don't need to import/export or anything as long as you use the same name.

If RDS instances have an immutable ID that will change on delete/restore than you would also need to remove the instance from state and then import it with the new ID.