RDS and secrets manager terraform - deadlock issue

[Nimsgs]

I am creating secrets manager through the console and RDS using terraform. While creating RDS, it requires a username and password which needs to be retrieved from Secrets manager as below:
username = local.db_secret.username
password = local.db_secret.password

But while creating a secrets manager for storing the RDS credentials, it asks for the RDS host- This is mandatory while creating the secrets- Select which RDS database this secret will access
Now before creating the RDS how will I pass this host to secrets manager and for creating the rds, I need to access the secrets manager for username and password. This is a chicken egg problem. Is there any solution to handle this deadlock situation ?

[chrisbulgaria]

Yes , you have todo it on two steps - see here for cloud formation : https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-secretsmanager-secrettargetattachment.html

unfortunately terraform does not support such secret target attachment yet , otherwise you could do everything from terraform ( no console, starting with a random password and rotate then ) , see here:
#9183

Chris

[Nimsgs]

Thanks for the response Chris. Do you know when this capability will be enabled for Terraform ?

[chrisbulgaria]

No, the best you can do is vote on that issue #9183 such that it may get prioritised higher by Hashicorp.
Until then you could use as a workaround the terraform cloudformation stack resource to call cloud formation.

[anGie44]

Hi @Nimsgs , thank you for raising this issue. Just echoing @chrisbulgaria 's comment above to vote and follow #9183 to stay up-to-date with future terraform provider support. I'm going to close this issue to ensure we have one place to track community interest for the feature support, but thanks again!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.