'Terraform to enable RDS Performance Insights

I enabled performance insights from the console manually, which created the KMS key. Later when I ran terraform, it gives me this error, which is understandable -- it cannot replace the existing KMS key

InvalidParameterCombination: You can't change your Performance Insights KMS key. status code: 400

However, after I disabled performance insights from the RDS console, and re-run the terraform, the error persists. My expectation was that it will now create a new KMS key, thus there shouldn't be any need to "change" the KMS key. Why does the error persist?

PS: I tried terraform import as well, but it didn't work either.

Edit: This is the TF code:

resource "aws_db_instance" "db" {
  # This has been in the config before
  kms_key_id        = module.kms.kms_key_arn
  ...
  # These are new code to enable performance insights from terraform
  performance_insights_enabled = var.performance_insights_enabled
  performance_insights_kms_key_id = var.performance_insights_enabled ? module.kms.kms_key_arn : ""
  ...
}

PS: the KMS key, as the comment says above, has been there under "Customer Managed Keys" with the rds instance before this change. As I enabled performance insights from the console, AWS created a new KMS key under "AWS Managed Keys". After I disabled performance insights, the key is still there and I am concerned about how to deal with it (recommendation is to not delete the key but I believe it's no longer being used now).

My expectation is that after disabling performance insights, the terraform, with the new code, can link the existing customer-managed KMS key to performance insights.



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source