feat: Replace master_password with write only argument equivalent master_password_wo

Author: bryantbiggs

README.md

@@ -253,7 +253,7 @@ No modules.
 | <a name="input_database_name"></a> [database\_name](#input\_database\_name) | The name of the first database to be created when the cluster is created. If you do not provide a name, Amazon Redshift will create a default database called `dev` | `string` | `null` | no |
 | <a name="input_default_iam_role_arn"></a> [default\_iam\_role\_arn](#input\_default\_iam\_role\_arn) | The Amazon Resource Name (ARN) for the IAM role that was set as default for the cluster when the cluster was created | `string` | `null` | no |
 | <a name="input_elastic_ip"></a> [elastic\_ip](#input\_elastic\_ip) | The Elastic IP (EIP) address for the cluster | `string` | `null` | no |
-| <a name="input_encrypted"></a> [encrypted](#input\_encrypted) | If `true`, the data in the cluster is encrypted at rest | `bool` | `true` | no |
+| <a name="input_encrypted"></a> [encrypted](#input\_encrypted) | If `true`, the data in the cluster is encrypted at rest | `bool` | `null` | no |
 | <a name="input_endpoint_access"></a> [endpoint\_access](#input\_endpoint\_access) | Map of endpoint access (managed VPC endpoint) definitions to create | <pre>map(object({<br/>    name                   = optional(string) # Will fall back to key if not set<br/>    resource_owner         = optional(string)<br/>    subnet_group_name      = string<br/>    vpc_security_group_ids = optional(list(string))<br/>  }))</pre> | `{}` | no |
 | <a name="input_enhanced_vpc_routing"></a> [enhanced\_vpc\_routing](#input\_enhanced\_vpc\_routing) | If `true`, enhanced VPC routing is enabled | `bool` | `null` | no |
 | <a name="input_final_snapshot_identifier"></a> [final\_snapshot\_identifier](#input\_final\_snapshot\_identifier) | The identifier of the final snapshot that is to be created immediately before deleting the cluster. If this parameter is provided, `skip_final_snapshot` must be `false` | `string` | `null` | no |
@@ -270,13 +270,14 @@ No modules.
 | <a name="input_manage_master_password"></a> [manage\_master\_password](#input\_manage\_master\_password) | Whether to use AWS SecretsManager to manage the cluster admin credentials. Conflicts with `master_password`. One of `master_password` or `manage_master_password` is required unless `snapshot_identifier` is provided | `bool` | `false` | no |
 | <a name="input_manage_master_password_rotation"></a> [manage\_master\_password\_rotation](#input\_manage\_master\_password\_rotation) | Whether to manage the master user password rotation. Setting this value to false after previously having been set to true will disable automatic rotation | `bool` | `false` | no |
 | <a name="input_manual_snapshot_retention_period"></a> [manual\_snapshot\_retention\_period](#input\_manual\_snapshot\_retention\_period) | The default number of days to retain a manual snapshot. If the value is -1, the snapshot is retained indefinitely. This setting doesn't change the retention period of existing snapshots. Valid values are between `-1` and `3653`. Default value is `-1` | `number` | `null` | no |
-| <a name="input_master_password"></a> [master\_password](#input\_master\_password) | Password for the master DB user. (Required unless a `snapshot_identifier` is provided). Must contain at least 8 chars, one uppercase letter, one lowercase letter, and one number | `string` | `null` | no |
 | <a name="input_master_password_rotate_immediately"></a> [master\_password\_rotate\_immediately](#input\_master\_password\_rotate\_immediately) | Specifies whether to rotate the secret immediately or wait until the next scheduled rotation window | `bool` | `null` | no |
 | <a name="input_master_password_rotation_automatically_after_days"></a> [master\_password\_rotation\_automatically\_after\_days](#input\_master\_password\_rotation\_automatically\_after\_days) | Specifies the number of days between automatic scheduled rotations of the secret. Either `master_user_password_rotation_automatically_after_days` or `master_user_password_rotation_schedule_expression` must be specified | `number` | `null` | no |
 | <a name="input_master_password_rotation_duration"></a> [master\_password\_rotation\_duration](#input\_master\_password\_rotation\_duration) | The length of the rotation window in hours. For example, 3h for a three hour window | `string` | `null` | no |
 | <a name="input_master_password_rotation_schedule_expression"></a> [master\_password\_rotation\_schedule\_expression](#input\_master\_password\_rotation\_schedule\_expression) | A cron() or rate() expression that defines the schedule for rotating your secret. Either `master_user_password_rotation_automatically_after_days` or `master_user_password_rotation_schedule_expression` must be specified | `string` | `null` | no |
 | <a name="input_master_password_secret_kms_key_id"></a> [master\_password\_secret\_kms\_key\_id](#input\_master\_password\_secret\_kms\_key\_id) | ID of the KMS key used to encrypt the cluster admin credentials secret | `string` | `null` | no |
-| <a name="input_master_username"></a> [master\_username](#input\_master\_username) | Username for the master DB user (Required unless a `snapshot_identifier` is provided). Defaults to `awsuser` | `string` | `"awsuser"` | no |
+| <a name="input_master_password_wo"></a> [master\_password\_wo](#input\_master\_password\_wo) | Password for the master DB user. Must contain at least 8 chars, one uppercase letter, one lowercase letter, and one number | `string` | `null` | no |
+| <a name="input_master_password_wo_version"></a> [master\_password\_wo\_version](#input\_master\_password\_wo\_version) | Used together with `master_password_wo` to trigger an update. Increment this value when an update to the `master_password_wo` is required | `string` | `null` | no |
+| <a name="input_master_username"></a> [master\_username](#input\_master\_username) | Username for the master DB user. Defaults to `awsuser` | `string` | `"awsuser"` | no |
 | <a name="input_multi_az"></a> [multi\_az](#input\_multi\_az) | Specifies if the Redshift cluster is multi-AZ | `bool` | `null` | no |
 | <a name="input_node_type"></a> [node\_type](#input\_node\_type) | The node type to be provisioned for the cluster | `string` | `""` | no |
 | <a name="input_number_of_nodes"></a> [number\_of\_nodes](#input\_number\_of\_nodes) | Number of nodes in the cluster. Defaults to 1. Note: values greater than 1 will trigger `cluster_type` to switch to `multi-node` | `number` | `1` | no |
@@ -288,7 +289,7 @@ No modules.
 | <a name="input_parameter_group_tags"></a> [parameter\_group\_tags](#input\_parameter\_group\_tags) | Additional tags to add to the parameter group | `map(string)` | `{}` | no |
 | <a name="input_port"></a> [port](#input\_port) | The port number on which the cluster accepts incoming connections. Default port is `5439` | `number` | `5439` | no |
 | <a name="input_preferred_maintenance_window"></a> [preferred\_maintenance\_window](#input\_preferred\_maintenance\_window) | The weekly time range (in UTC) during which automated cluster maintenance can occur. Format: `ddd:hh24:mi-ddd:hh24:mi` | `string` | `"sat:10:00-sat:10:30"` | no |
-| <a name="input_publicly_accessible"></a> [publicly\_accessible](#input\_publicly\_accessible) | If true, the cluster can be accessed from a public network | `bool` | `false` | no |
+| <a name="input_publicly_accessible"></a> [publicly\_accessible](#input\_publicly\_accessible) | If true, the cluster can be accessed from a public network | `bool` | `null` | no |
 | <a name="input_region"></a> [region](#input\_region) | Region where the resource(s) will be managed. Defaults to the Region set in the provider configuration | `string` | `null` | no |
 | <a name="input_scheduled_actions"></a> [scheduled\_actions](#input\_scheduled\_actions) | Map of scheduled action definitions to create | <pre>map(object({<br/>    name        = optional(string) # Will fall back to key if not set<br/>    description = optional(string)<br/>    enable      = optional(bool)<br/>    start_time  = optional(string)<br/>    end_time    = optional(string)<br/>    schedule    = string<br/>    iam_role    = optional(string)<br/>    target_action = object({<br/>      pause_cluster = optional(bool, false)<br/>      resize_cluster = optional(object({<br/>        classic         = optional(bool)<br/>        cluster_type    = optional(string)<br/>        node_type       = optional(string)<br/>        number_of_nodes = optional(number)<br/>      }))<br/>      resume_cluster = optional(bool, false)<br/>    })<br/>  }))</pre> | `{}` | no |
 | <a name="input_security_group_description"></a> [security\_group\_description](#input\_security\_group\_description) | The description of the security group. If value is set to empty string it will contain cluster name in the description | `string` | `null` | no |
@@ -298,9 +299,10 @@ No modules.
 | <a name="input_security_group_tags"></a> [security\_group\_tags](#input\_security\_group\_tags) | Additional tags for the security group | `map(string)` | `{}` | no |
 | <a name="input_security_group_use_name_prefix"></a> [security\_group\_use\_name\_prefix](#input\_security\_group\_use\_name\_prefix) | Determines whether the security group name (`security_group_name`) is used as a prefix | `bool` | `true` | no |
 | <a name="input_skip_final_snapshot"></a> [skip\_final\_snapshot](#input\_skip\_final\_snapshot) | Determines whether a final snapshot of the cluster is created before Redshift deletes the cluster. If true, a final cluster snapshot is not created. If false , a final cluster snapshot is created before the cluster is deleted | `bool` | `true` | no |
+| <a name="input_snapshot_arn"></a> [snapshot\_arn](#input\_snapshot\_arn) | The ARN of the snapshot from which to create the new cluster. Conflicts with `snapshot_identifier` | `string` | `null` | no |
 | <a name="input_snapshot_cluster_identifier"></a> [snapshot\_cluster\_identifier](#input\_snapshot\_cluster\_identifier) | The name of the cluster the source snapshot was created from | `string` | `null` | no |
 | <a name="input_snapshot_copy"></a> [snapshot\_copy](#input\_snapshot\_copy) | Configuration of automatic copy of snapshots from one region to another | <pre>object({<br/>    destination_region               = string<br/>    manual_snapshot_retention_period = optional(number)<br/>    retention_period                 = optional(number)<br/>    grant_name                       = optional(string)<br/>  })</pre> | `null` | no |
-| <a name="input_snapshot_identifier"></a> [snapshot\_identifier](#input\_snapshot\_identifier) | The name of the snapshot from which to create the new cluster | `string` | `null` | no |
+| <a name="input_snapshot_identifier"></a> [snapshot\_identifier](#input\_snapshot\_identifier) | The name of the snapshot from which to create the new cluster. Conflicts with `snapshot_arn` | `string` | `null` | no |
 | <a name="input_snapshot_schedule"></a> [snapshot\_schedule](#input\_snapshot\_schedule) | Configuration for creating a snapshot schedule and associating it with the cluster | <pre>object({<br/>    definitions   = list(string)<br/>    description   = optional(string)<br/>    force_destroy = optional(bool)<br/>    use_prefix    = optional(bool, false)<br/>    identifier    = optional(string)<br/>    tags          = optional(map(string), {})<br/>  })</pre> | `null` | no |
 | <a name="input_subnet_group_description"></a> [subnet\_group\_description](#input\_subnet\_group\_description) | The description of the Redshift Subnet group. Defaults to `Managed by Terraform` | `string` | `null` | no |
 | <a name="input_subnet_group_name"></a> [subnet\_group\_name](#input\_subnet\_group\_name) | The name of the Redshift subnet group, existing or to be created | `string` | `null` | no |

docs/UPGRADE-7.0.md

@@ -7,6 +7,7 @@ Please consult the `examples` directory for reference example configurations. If
 - Terraform `v1.11` is now minimum supported version to support write-only (`wo_*`) attributes.
 - AWS provider `v6.18` is now minimum supported version
 - The ability for the module to create a random password has been removed in order to ensure passwords are not stored in plain text within the state file. Users must now provide their own password via the `master_password_wo` variable.
+  - `master_password` is no longer supported and only the write-only equivalent is supported (`master_password_wo` and `master_password_wo_version`)
 
 ## Additional changes
 
@@ -47,7 +48,7 @@ Please consult the `examples` directory for reference example configurations. If
 
 2. Renamed variables:
 
-    -
+    - `master_password` -> `master_password_wo`
 
 3. Added variables:
 
@@ -59,6 +60,7 @@ Please consult the `examples` directory for reference example configurations. If
     - `vpc_id`
     - `security_group_ingress_rules`
     - `security_group_egress_rules`
+    - `master_password_wo_version`
 
 4. Removed outputs:
 

main.tf

@@ -28,37 +28,34 @@ resource "aws_redshift_cluster" "this" {
   enhanced_vpc_routing                 = var.enhanced_vpc_routing
   final_snapshot_identifier            = var.skip_final_snapshot ? null : var.final_snapshot_identifier
   kms_key_id                           = var.kms_key_arn
-
-  # iam_roles and default_iam_roles are managed in the aws_redshift_cluster_iam_roles resource below
-
-  maintenance_track_name            = var.maintenance_track_name
-  manual_snapshot_retention_period  = var.manual_snapshot_retention_period
-  manage_master_password            = var.manage_master_password ? var.manage_master_password : null
-  master_password                   = var.snapshot_identifier == null && !var.manage_master_password ? var.master_password : null
-  master_password_secret_kms_key_id = var.master_password_secret_kms_key_id
-  master_username                   = var.master_username
-  multi_az                          = var.multi_az
-  node_type                         = var.node_type
-  number_of_nodes                   = var.number_of_nodes
-  owner_account                     = var.owner_account
-  port                              = var.port
-  preferred_maintenance_window      = var.preferred_maintenance_window
-  publicly_accessible               = var.publicly_accessible
-  skip_final_snapshot               = var.skip_final_snapshot
-  snapshot_cluster_identifier       = var.snapshot_cluster_identifier
-
-  snapshot_identifier    = var.snapshot_identifier
-  vpc_security_group_ids = compact(concat(aws_security_group.this[*].id, var.vpc_security_group_ids))
-
-  tags = var.tags
+  maintenance_track_name               = var.maintenance_track_name
+  manage_master_password               = var.manage_master_password ? var.manage_master_password : null
+  manual_snapshot_retention_period     = var.manual_snapshot_retention_period
+  master_password_wo                   = var.snapshot_identifier == null && !var.manage_master_password ? var.master_password_wo : null
+  master_password_wo_version           = var.snapshot_identifier == null && !var.manage_master_password ? var.master_password_wo_version : null
+  master_password_secret_kms_key_id    = var.master_password_secret_kms_key_id
+  master_username                      = var.master_username
+  multi_az                             = var.multi_az
+  node_type                            = var.node_type
+  number_of_nodes                      = var.number_of_nodes
+  owner_account                        = var.owner_account
+  port                                 = var.port
+  preferred_maintenance_window         = var.preferred_maintenance_window
+  publicly_accessible                  = var.publicly_accessible
+  skip_final_snapshot                  = var.skip_final_snapshot
+  snapshot_arn                         = var.snapshot_arn
+  snapshot_cluster_identifier          = var.snapshot_cluster_identifier
+  snapshot_identifier                  = var.snapshot_identifier
+  tags                                 = var.tags
+  vpc_security_group_ids               = compact(concat(aws_security_group.this[*].id, var.vpc_security_group_ids))
 
   dynamic "timeouts" {
-    for_each = var.cluster_timeouts != null ? [1] : []
+    for_each = var.cluster_timeouts != null ? [var.cluster_timeouts] : []
 
     content {
-      create = var.cluster_timeouts.create
-      update = var.cluster_timeouts.update
-      delete = var.cluster_timeouts.delete
+      create = each.value.create
+      update = each.value.update
+      delete = each.value.delete
     }
   }