'Terraform error - RDS Cluster FinalSnapshotIdentifier is required when a final snapshot is required

I am new to Terraform. I am using Terraform to write AWS scripts. I am getting an error while performing Terraform Destroy. Terraform script is

resource "aws_rds_cluster" "aurora-cluster-ci" {
  cluster_identifier        = "aurora-cluster-ci"
  engine                    = "aurora-mysql"
  availability_zones        = ["us-east-1a", "us-east-1b", "us-east-1c"]
  database_name             = "${var.rds_dbname}"
  master_username           = "${var.rds_username}"
  master_password           = "${var.rds_password}"
  backup_retention_period   = 5
  engine_version            = "5.7.16"
  preferred_backup_window   = "07:00-09:00"
  apply_immediately         = true
  final_snapshot_identifier = "ci-aurora-cluster-backup"
  skip_final_snapshot       = true
}

Terraform Destroy throws an error "aws_rds_cluster.aurora-cluster-ci: RDS Cluster FinalSnapshotIdentifier is required when a final snapshot is required"

I have "final_snapshot_identifier" key in my script.

terraform terraform-provider-aws

Solution 1:^[1]

Solution:

I Encountered the same problem while trying to perform a destroy on an RDS instance (not under AWS Aurora) but the principles are the same.

Below are a few steps I took in order to solve this issue:

Change skip_final_snapshot to true and remove final_snapshot_identifier if exists
(see comments #1 and #2 below) .
Remove backup_window (Under AWS Aurora its probably called preferred_backup_window).
Change backup_retention_period to 0.
Make sure that apply_immediately is set to true (see comment #3 below).
Run terraform apply and check the changes to affect (see a tip as comment #4 below).
Now you can run terraform destroy and no errors should appear (in my case I add deletion_protection set to true and add to remove it).

Comment #1 - Understanding the the purpose of the relevant fields

From Terraform docs:

skip_final_snapshot - (Optional) Determines whether a final DB snapshot is created before the DB instance is deleted. If true is specified, no DBSnapshot is created. If false is specified, a DB snapshot is created before the DB instance is deleted, using the value from final_snapshot_identifier. Default is false.

final_snapshot_identifier - (Optional) The name of your final DB snapshot when this DB instance is deleted. Must be provided if skip_final_snapshot is set to false.

In the code specified in the question skip_final_snapshot was true and final_snapshot_identifier was still specified.

(*) Don't be confused with the snapshot_identifier field.

Comment #2 - What is causing this error?

For those who want to understand a little bit what is happening here, in the mentioned open issue there is a nice thread where a contributor named @caiges gave a nice explanation there:

For starters, skip_final_snapshot defaults to False which should also require final_snapshot_identifier to be set but it's not so what happens is the create/update is applied, state updated where skip_final_snapshot is False but final_snapshot_identifier is null.
This causes the destroy operation to fail it's verification stage.

This can be fixed but I don't really have a great story for those who already have prexisting state.
One possibility would be that a delete operation ignores skip_final_shopshot if the identifier is null.
Another might be to default final_snapshot_identifier to something random if skip_final_snapshot is set to or defaulted to False.
I think for data safety reasons, ignoring skip_final_snapshot if final_snapshot_identifier is null is a bad idea and it'd be better to just randomize an identifier.

Comment #3 - Making sure our changes take immediate effect:

A note about apply_immediately from Terraform's docs:

Note: using apply_immediately can result in a brief downtime as the server reboots. See the AWS Docs on RDS Maintenance for more information.

Comment #4 (Bonus) - Saving ourselves some time:

When you run terraform plan make sure that the ~ (update in-place sign) appears in the relevant fields under Terraform's execution plan - In the example below you can see that 2 changes will be applied:

~ resource "aws_db_instance" "postgresql" {
        address                               = ...
        allocated_storage                     = 100
        allow_major_version_upgrade           = false
        .
        .
      ~ apply_immediately                     = false -> true
        .
        .
      ~ backup_retention_period               = 7 -> 0
        .
        .
        tags                                  = ...
        username                              = ...
        vpc_security_group_ids  =  ...
    }

This might sound trivial, but in cases like this error, it can save a lot of debugging time when you try to understand why certain updates haven't took place.

Solution 2:^[2]

This is a known bug that is still open as of the current version of the Terraform provider for AWS:

https://github.com/terraform-providers/terraform-provider-aws/issues/2588

In a nutshell, it's ignoring the skip_final_snapshot parameter.

Solution 3:^[3]

In my case I had to manually edit the .tfstate file and set "skip_final_snapshot" to true. Then it worked.

Solution 4:^[4]

If you're a Pulumi user seeing this error as Pulumi uses the Terraform provider:

pulumi stack export > export.json

Then change all instances of skipFinalSnapshot to true.

And import the changed file:

pulumi stack import --file export.json

Solution 5:^[5]

To delete RDS DB from terraform destroy:-

first add skip_final_snapshot = "true" to your aws_provider
do terraform-apply

Then you are able to destroy it.

terraform destroy

Solution 6:^[6]

Ran into the same issue, being a starter with RDS terraform resource you may miss skip_final_snapshot=true/false flag. By default this will be in false state and when you go for a terraform destroy it expects a snapshot name of the db causing the error.

*Name can be given with final_snapshot_identifier flag, if you want to create a final snap.

But now when you have created the RDS instance without knowing which obviously you wont.

just remove the state of that RDS instance

in my case: 1.) terraform state rm module.rds.aws_rds_instance_default 2.) Manually delete the RDS instance from the AWS console. 3.) reapply with terraform apply with skip_final_snapshot=true in aws_rds_instance resource.

or in case you want to create instance snap when you destroy it.

set skip_final_snapshot=false, final_snapshot_identifier=name-of-snapshot.

Hope this helps !!Thanks

Solution 7:^[7]

I had the same issue but now I can destroy it after I changed the skipFinalSnapshot to true and backup_retention_period to 0 then I did terraform apply. Once these changes are applied and run the terraform destroy command. It will work.

Solution 8:^[8]

I was not able to delete an rds instance that I created through terraform scripts. Then I realized - It is not only enough to keep the skip_final_snapshot to true but also to do a terraform apply so that the changed value is taken into consideration. After that a terraform destroy does a proper deletion of the resources without the error 'Error: DB Instance FinalSnapshotIdentifier is required when a final snapshot is required'

Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution	Source
Solution 1
Solution 2	KJH
Solution 3	Andmat7
Solution 4	chipz
Solution 5	Zach
Solution 6	RVndra Singh
Solution 7	p K
Solution 8	Dipesh Majumdar

'Terraform error - RDS Cluster FinalSnapshotIdentifier is required when a final snapshot is required

Solution 1:[1]

Solution:

Comment #1 - Understanding the the purpose of the relevant fields

Comment #2 - What is causing this error?

Comment #3 - Making sure our changes take immediate effect:

Comment #4 (Bonus) - Saving ourselves some time:

Solution 2:[2]

Solution 3:[3]

Solution 4:[4]

If you're a Pulumi user seeing this error as Pulumi uses the Terraform provider:

Solution 5:[5]

Solution 6:[6]

Solution 7:[7]

Solution 8:[8]