'Terraform to enable RDS Performance Insights
I enabled performance insights from the console manually, which created the KMS key. Later when I ran terraform, it gives me this error, which is understandable -- it cannot replace the existing KMS key
InvalidParameterCombination: You can't change your Performance Insights KMS key. status code: 400
However, after I disabled performance insights from the RDS console, and re-run the terraform, the error persists. My expectation was that it will now create a new KMS key, thus there shouldn't be any need to "change" the KMS key. Why does the error persist?
PS: I tried terraform import as well, but it didn't work either.
Edit: This is the TF code:
resource "aws_db_instance" "db" {
# This has been in the config before
kms_key_id = module.kms.kms_key_arn
...
# These are new code to enable performance insights from terraform
performance_insights_enabled = var.performance_insights_enabled
performance_insights_kms_key_id = var.performance_insights_enabled ? module.kms.kms_key_arn : ""
...
}
PS: the KMS key, as the comment says above, has been there under "Customer Managed Keys" with the rds instance before this change. As I enabled performance insights from the console, AWS created a new KMS key under "AWS Managed Keys". After I disabled performance insights, the key is still there and I am concerned about how to deal with it (recommendation is to not delete the key but I believe it's no longer being used now).
My expectation is that after disabling performance insights, the terraform, with the new code, can link the existing customer-managed KMS key to performance insights.
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
