[Enhancement]: aws_db_instance should surface event errors

[corymhall]

Description

When you create an aws_db_instance some configurations can fail to apply due to invalid configuration. When this happens Terraform does not surface these errors to the user. The user sees a successful apply and then a perpetual diff with the unapplied configuration.

When RDS fails to apply these configurations it does not return an error status, instead it reports these errors in the events.

With the below Terraform configuration run the following steps:

1. terraform apply

aws_iam_role.example: Creating...
aws_iam_role.example: Creation complete after 0s [id=example-role]
aws_db_instance.example: Creating...
...
aws_db_instance.example: Still creating... [7m40s elapsed]
aws_db_instance.example: Creation complete after 7m45s [id=db-XXXXXXXXXXXXXXXXXXXXXX]

Apply complete! Resources: 2 added, 0 changed, 0 destroyed.

2. terraform plan

aws_iam_role.example: Refreshing state... [id=example-role]
aws_db_instance.example: Refreshing state... [id=db-XXXXXXXXXXXXXXXXXXXXX]

Terraform used the selected providers to generate the following execution plan. Resource
actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_db_instance.example will be updated in-place
  ~ resource "aws_db_instance" "example" {
        id                                    = "db-XXXXXXXXXXXXXXXXXXXXXXX"
      ~ monitoring_interval                   = 0 -> 5
        tags                                  = {}
        # (69 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

If you look at the engine events you can see the error

3. aws rds describe-events --source-identifier $INSTANCE_ID --source-type db-instance --event-categories failure

{
    "Events": [
        {
            "SourceIdentifier": "instance-1",
            "SourceType": "db-instance",
            "Message": "Amazon RDS has been unable to configure enhanced monitoring on your instance: instance-1 and this feature has been disabled.This is likely due to the rds-monitoring-role not being present and configured correctly in your account. Please refer to the troubleshooting section in the Amazon RDS documentation for further details.",
            "EventCategories": [
                "failure"
            ],
            "Date": "2025-01-22T17:36:25.331000+00:00",
            "SourceArn": "arn:aws:rds:us-east-2:12345678912:db:instance-1"
        }
    ]
}

Affected Resource(s) and/or Data Source(s)

• aws_db_instance

Potential Terraform Configuration

resource "aws_iam_role" "example" {
  name = "example-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          Service = "monitoring.rds.amazonaws.com"
        }
        Action = "sts:AssumeRole"
      }
    ]
  })
  # uncomment this to see a successful apply
  # managed_policy_arns = [
  #   "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole"
  # ]
}

resource "aws_db_instance" "example" {
  allocated_storage           = 20
  engine                      = "postgres"
  engine_version              = "16.6"
  instance_class              = "db.m8g.large"
  username                    = "postgres"
  manage_master_user_password = true
  skip_final_snapshot         = true
  apply_immediately           = true
  monitoring_interval         = 5
  monitoring_role_arn         = aws_iam_role.example.arn
}

References

No response

Would you like to implement a fix?

None

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.