<p>If I am understanding your question correctly, what you are describing sounds like a perfect use case for SSM. You can store your RDS password as a <a href="https://docs.aws.amazon.com/kms/latest/developerguide/services-parameter-store.html" rel="nofollow noreferrer">secure string parameter encrypted by KMS</a>, then reference it in you terraform file as a <a href="https://www.terraform.io/docs/providers/aws/d/ssm_parameter.html" rel="nofollow noreferrer">data source</a> with decryption. With this method, you only have to reference your decrypted password, and never directly store the encrypted or plain text in your tf file. </p>

<pre><code>data "aws_ssm_parameter" "foo" {
  name = "foo"
  with_decryption = true
}
</code></pre>

CC BY-SA 4.0
2019-09-25T14:11:46.263Z
Would that be stored in the tfstate file as the unencrypted password?
doug
CC BY-SA 4.0
2019-09-25T14:57:24.317Z
No it shouldn't, unless you do something to purposefully output it.
Preston Martin
CC BY-SA 4.0
2019-10-04T12:52:52.777Z
@doug If this answers your question, accept it as the answer.
Aliminator
CC BY-SA 4.0
2019-09-25T13:40:58.670Z
2019-09-25T13:49:33.533Z
2019-09-25T13:49:33.533Z
Preston Martin
<p>Is there a way to only have an encrypted version of my RDS password in my Terraform code and for AWS to decrypt it for RDS so you use the decrypted password to login to the RDS?</p>

<p>So set my rds password variable value to the encrypted password and when terraform builds the RDS I login in with is the unencrypted password?</p>

<amazon-web-services><terraform><encryption><amazon-rds>
How do I use only an encrypted version of my AWS RDS password in my terraform code?
doug
# How do I use only an encrypted version of my AWS RDS password in my terraform code?

(Asked by: username_0 on 2019-09-25)

Is there a way to only have an encrypted version of my RDS password in my Terraform code and for AWS to decrypt it for RDS so you use the decrypted password to login to the RDS?

So set my rds password variable value to the encrypted password and when terraform builds the RDS I login in with is the unencrypted password?

**Tags:** amazon-web-services, terraform, encryption, amazon-rds


---

## 1 answers

### Answer by username_1 on 2019-09-25. Score: 3 | Accepted answer

If I am understanding your question correctly, what you are describing sounds like a perfect use case for SSM. You can store your RDS password as a secure string parameter encrypted by KMS, then reference it in you terraform file as a data source with decryption. With this method, you only have to reference your decrypted password, and never directly store the encrypted or plain text in your tf file. 
data "aws_ssm_parameter" "foo" {
  name = "foo"
  with_decryption = true
}

> **Comments:**
> **username_0**: Would that be stored in the tfstate file as the unencrypted password?  
> **username_1**: No it shouldn't, unless you do something to purposefully output it.  
> **username_2**: @username_0 If this answers your question, accept it as the answer.  

---

