I am trying to create an encrypted version of my currently existing unencrypted aws_rds_cluster by updating my resource, I added:

kms_key_id                  = "mykmskey"
storage_encrypted           = true

This is how my resource should look like:

resource "aws_rds_cluster" "my_rds_cluster" {
  cluster_identifier          = "${var.service_name}-rds-cluster"
  database_name               = var.db_name
  master_username             = var.db_username
  master_password             = random_password.db_password.result
  engine                      = var.db_engine
  engine_version              = var.db_engine_version
  kms_key_id                  = "mykmskey"
  storage_encrypted           = true
  db_subnet_group_name        = aws_db_subnet_group.fleet_service_db_subnet_group.name
  vpc_security_group_ids      = [aws_security_group.fleet_service_service_db_security_group.id]
  skip_final_snapshot         = true
  backup_retention_period     = var.environment != "prod" ? null : 7
  # snapshot_identifier         = "my-rds-instance-snapshot"
  tags = { Name = "${var.service_name}-rds-cluster" }
}

The problem is that the original resource had delete_protection = true defined, which I also removed but, even though I removed it the original cluster cannot be deleted by any means in order for the new one to be created, neither through changes in Terraform, nor manually in AWS console, it just throws an error like: error creating RDS cluster: DBClusterAlreadyExistsFault: DB Cluster already exists Any ideas what to do in such cases?

CodePudding user response：

To do that purely through Terraform, you would have to:

1. Remove deletion protection from the original Terraform resource
2. Run terraform apply, which will remove deletion protection from the actual resource in AWS
3. Make the modifications to the Terraform resource that will result in a delete or replace of the current resource
4. Run terraform apply again, during which time Terraform will now delete and/or replace the resource.

The key thing here being that you can't remove deleting protection at the same time you are actually deleting a resource, because Terraform isn't going to update an existing resource to modify an attribute before attempting to delete the resource.