Answers: <p>If I am understanding your question correctly, what you are describing sounds like a perfect use case for SSM. You can store your RDS password as a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/services-parameter-store.html" rel="nofollow noreferrer">secure string parameter encrypted by KMS</a>, then reference it in you terraform file as a <a href="https://www.terraform.io/docs/providers/aws/d/ssm_parameter.html" rel="nofollow noreferrer">data source</a> with decryption. With this method, you only have to reference your decrypted password, and never directly store the encrypted or plain text in your tf file. </p>
  
  <pre><code>data "aws_ssm_parameter" "foo" {
    name = "foo"
    with_decryption = true
  }
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2019-09-25T14:11:46.263Z
Answers: Would that be stored in the tfstate file as the unencrypted password?
Answers: doug
Answers: CC BY-SA 4.0
Answers: 2019-09-25T14:57:24.317Z
Answers: No it shouldn't, unless you do something to purposefully output it.
Answers: Preston Martin
Answers: CC BY-SA 4.0
Answers: 2019-10-04T12:52:52.777Z
Answers: @doug If this answers your question, accept it as the answer.
Answers: Aliminator
Answers: CC BY-SA 4.0
Answers: 2019-09-25T13:40:58.670Z
Answers: 2019-09-25T13:49:33.533Z
Answers: 2019-09-25T13:49:33.533Z
Answers: Preston Martin
Body: <p>Is there a way to only have an encrypted version of my RDS password in my Terraform code and for AWS to decrypt it for RDS so you use the decrypted password to login to the RDS?</p>
  
  <p>So set my rds password variable value to the encrypted password and when terraform builds the RDS I login in with is the unencrypted password?</p>
  
Tags: <amazon-web-services><terraform><encryption><amazon-rds>
Title: How do I use only an encrypted version of my AWS RDS password in my terraform code?
UserDisplayName: doug
ThreadText: # How do I use only an encrypted version of my AWS RDS password in my terraform code?
  
  (Asked by: username_0 on 2019-09-25)
  
  Is there a way to only have an encrypted version of my RDS password in my Terraform code and for AWS to decrypt it for RDS so you use the decrypted password to login to the RDS?
  
  So set my rds password variable value to the encrypted password and when terraform builds the RDS I login in with is the unencrypted password?
  
  **Tags:** amazon-web-services, terraform, encryption, amazon-rds
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2019-09-25. Score: 3 | Accepted answer
  
  If I am understanding your question correctly, what you are describing sounds like a perfect use case for SSM. You can store your RDS password as a [secure string parameter encrypted by KMS](https://docs.aws.amazon.com/kms/latest/developerguide/services-parameter-store.html), then reference it in you terraform file as a [data source](https://www.terraform.io/docs/providers/aws/d/ssm_parameter.html) with decryption. With this method, you only have to reference your decrypted password, and never directly store the encrypted or plain text in your tf file.
  
  ```
  data "aws_ssm_parameter" "foo" {
    name = "foo"
    with_decryption = true
  }
  
  ```
  
  > **Comments:**
  > **username_0**: Would that be stored in the tfstate file as the unencrypted password?  
  > **username_1**: No it shouldn't, unless you do something to purposefully output it.  
  > **username_2**: @username_0 If this answers your question, accept it as the answer.  
  
  ---
  
  