feat: support for random password

README.md

@@ -169,10 +169,13 @@ Users have the ability to:
 |------|---------|
 | terraform | >= 0.12.26 |
 | aws | >= 2.49 |
+| random | >= 3.1 |
 
 ## Providers
 
-No provider.
+| Name | Version |
+|------|---------|
+| random | >= 3.1 |
 
 ## Modules
 
@@ -185,7 +188,9 @@ No provider.
 
 ## Resources
 
-No resources.
+| Name |
+|------|
+| [random_password](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) |
 
 ## Inputs
 
@@ -206,6 +211,7 @@ No resources.
 | create\_db\_parameter\_group | Whether to create a database parameter group | `bool` | `true` | no |
 | create\_db\_subnet\_group | Whether to create a database subnet group | `bool` | `true` | no |
 | create\_monitoring\_role | Create IAM role with a defined name that permits RDS to send enhanced monitoring metrics to CloudWatch Logs. | `bool` | `false` | no |
+| create\_random\_password | Whether to create random password for RDS primary cluster | `bool` | `true` | no |
 | db\_subnet\_group\_name | Name of DB subnet group. DB instance will be created in the VPC associated with the DB subnet group. If unspecified, will be created in the default VPC | `string` | `""` | no |
 | delete\_automated\_backups | Specifies whether to remove automated backups immediately after the DB instance is deleted | `bool` | `true` | no |
 | deletion\_protection | The database can't be deleted when this value is set to true. | `bool` | `false` | no |
@@ -279,6 +285,7 @@ No resources.
 | this\_db\_instance\_resource\_id | The RDS Resource ID of this instance |
 | this\_db\_instance\_status | The RDS instance status |
 | this\_db\_instance\_username | The master username for the database |
+| this\_db\_master\_password | The master password |
 | this\_db\_option\_group\_arn | The ARN of the db option group |
 | this\_db\_option\_group\_id | The db option group id |
 | this\_db\_parameter\_group\_arn | The ARN of the db parameter group |

main.tf

@@ -1,4 +1,5 @@
 locals {
+  master_password        = var.create_db_instance && var.create_random_password ? random_password.master_password[0].result : var.password
   create_db_subnet_group = var.db_subnet_group_name == "" ? var.create_db_subnet_group : false
   db_subnet_group_name   = coalesce(var.db_subnet_group_name, module.db_subnet_group.this_db_subnet_group_id)
 
@@ -8,6 +9,14 @@ locals {
   option_group           = var.engine != "postgres" ? coalesce(module.db_option_group.this_db_option_group_id, var.option_group_name) : null
 }
 
+# Random string to use as master password
+resource "random_password" "master_password" {
+  count = var.create_db_instance && var.create_random_password ? 1 : 0
+
+  length  = 10
+  special = false
+}
+
 module "db_subnet_group" {
   source = "./modules/db_subnet_group"
 
@@ -68,7 +77,7 @@ module "db_instance" {
 
   name                                = var.name
   username                            = var.username
-  password                            = var.password
+  password                            = local.master_password
   port                                = var.port
   domain                              = var.domain
   domain_iam_role_name                = var.domain_iam_role_name

modules/db_instance/README.md

@@ -101,6 +101,7 @@ No Modules.
 | this\_db\_instance\_endpoint | The connection endpoint |
 | this\_db\_instance\_hosted\_zone\_id | The canonical hosted zone ID of the DB instance (to be used in a Route 53 Alias record) |
 | this\_db\_instance\_id | The RDS instance ID |
+| this\_db\_instance\_master\_password | The master password |
 | this\_db\_instance\_name | The database name |
 | this\_db\_instance\_port | The database port |
 | this\_db\_instance\_resource\_id | The RDS Resource ID of this instance |

modules/db_instance/outputs.tf

@@ -15,6 +15,7 @@ locals {
   this_db_instance_ca_cert_identifier   = element(concat(aws_db_instance.this_mssql.*.ca_cert_identifier, aws_db_instance.this.*.ca_cert_identifier, [""]), 0)
   this_db_instance_domain               = element(concat(aws_db_instance.this_mssql.*.domain, [""]), 0)
   this_db_instance_domain_iam_role_name = element(concat(aws_db_instance.this_mssql.*.domain_iam_role_name, [""]), 0)
+  this_db_instance_master_password      = element(concat(aws_db_instance.this_mssql.*.password, aws_db_instance.this.*.password, [""]), 0)
 }
 
 output "enhanced_monitoring_iam_role_name" {
@@ -96,3 +97,9 @@ output "this_db_instance_domain_iam_role_name" {
   description = "The name of the IAM role to be used when making API calls to the Directory Service. "
   value       = local.this_db_instance_domain_iam_role_name
 }
+
+output "this_db_instance_master_password" {
+  description = "The master password"
+  value       = local.this_db_instance_master_password
+  sensitive   = true
+}

outputs.tf

@@ -60,7 +60,7 @@ output "this_db_instance_username" {
 
 output "this_db_instance_password" {
   description = "The database password (this password may be old, because Terraform doesn't track it after initial creation)"
-  value       = var.password
+  value       = local.master_password
   sensitive   = true
 }
 
@@ -114,3 +114,9 @@ output "this_db_option_group_arn" {
   description = "The ARN of the db option group"
   value       = module.db_option_group.this_db_option_group_arn
 }
+
+output "this_db_master_password" {
+  description = "The master password"
+  value       = module.db_instance.this_db_instance_master_password
+  sensitive   = true
+}

variables.tf

@@ -392,3 +392,9 @@ variable "delete_automated_backups" {
   type        = bool
   default     = true
 }
+
+variable "create_random_password" {
+  description = "Whether to create random password for RDS primary cluster"
+  type        = bool
+  default     = true
+}

versions.tf

@@ -6,5 +6,9 @@ terraform {
       source  = "hashicorp/aws"
       version = ">= 2.49"
     }
+    random = {
+      source  = "hashicorp/random"
+      version = ">= 3.1"
+    }
   }
 }