Backport of docs: improve write-only attribute example into v1.11 #36620
+58
−19
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Backport
This PR is auto-generated from #36605 to be assessed for backporting due to the inclusion of the label 1.11-backport.
🚨
The person who merged in the original PR is:
@bschaatsbergen
This person should manually cherry-pick the original PR into a new backport PR,
and close this one when the manual backport PR is merged in.
The below text is copied from the body of the original PR.
This PR makes a few improvements to the write-only arguments example configuration in the documentation. Along with fixing a couple of incorrect arguments—like the ephemeral resource name, the invalid
db.t5.micro
RDS instance type, and the use ofadmin
as a reserved master username in RDS—this update also improves the workflow to better match what end users typically expect.Without these changes, the example would not work and the password is essentially lost when it's generated and written to the database without a way to capture it for future use. The updated workflow now writes the ephemeral
random_password
to AWS Secret Manager using a write-only attribute, then retrieves it through an ephemeralaws_secretsmanager_secret_version
resource (which is deferred to the apply stage due to a computed argument) and finally it securely passes the password into the write-only attribute of theaws_db_instance
managed resource.By making these changes, we're able to both capture the random password and securely pass it to the AWS RDS.
Overview of commits
ac62910
486b967
30cce56
0ca421b
b8956d0
c12efc3
14bb2c9
a2f881f
610d5c2
72dd1c4
fae7e82
cd1381d
8e0f8bb