Can't create secondary aurora-postgresql aws_rds_cluster inside an aws_rds_global_cluster when the source/primary cluster has storage encryption enabled

[djschnei21]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.11.13
AWS Provider v2.65.0

Affected Resource(s)

• aws_rds_cluster
• aws_rds_global_cluster (indirectly)

Terraform Configuration Files

provider "aws" {
  alias   = "primary"
  version = "~>2.0"
  region  = "us-east-1"
}

provider "aws" {
  alias   = "secondary"
  version = "~>2.0"
  region  = "us-west-2"
}

resource "aws_rds_global_cluster" "global_cluster" {
  provider                  = "aws.primary"
  storage_encrypted         = true
  engine                    = "aurora-postgresql"
  engine_version            = "${var.engine-version}"
  database_name             = "${var.database_name}"
  global_cluster_identifier = "${var.vpc_name}-${var.app_name}-global"
}

resource "random_id" "snapshot_identifier" {
  byte_length = 4
}

data "aws_kms_key" "primary_kms" {
  provider = "aws.primary"
  key_id   = "alias/aws/rds"
}

resource "aws_rds_cluster" "primary_cluster" {
  provider = "aws.primary"
  lifecycle {
    ignore_changes = ["availability_zones"]
  }
  cluster_identifier        = "${var.vpc_name}-${var.app_name}-primary-cluster"
  global_cluster_identifier = "${aws_rds_global_cluster.global_cluster.id}"
  engine                    = "aurora-postgresql"
  engine_mode               = "provisioned"
  engine_version            = "${var.engine-version}"
  vpc_security_group_ids    = ["${var.sg-east}"]
  db_subnet_group_name      = "${var.east_subnet_group_name}"
  master_username           = "${var.master-username}"
  master_password           = "${var.master-user-password}"
  backup_retention_period   = 14
  preferred_backup_window   = "01:00-02:00"
  storage_encrypted         = true
  kms_key_id                = "${data.aws_kms_key.primary_kms.arn}"
  final_snapshot_identifier = "${var.vpc_name}-${var.app_name}-primary-cluster-final-snapshot-${random_id.snapshot_identifier.hex}"
  skip_final_snapshot       = "${var.skip_final_snapshot}"
}

resource "aws_rds_cluster_instance" "primary" {
  depends_on                      = ["aws_rds_cluster.primary_cluster"]
  provider                        = "aws.primary"
  count                           = 1
  engine                          = "aurora-postgresql"
  cluster_identifier              = "${aws_rds_cluster.primary_cluster.id}"
  identifier                      = "${var.vpc_name}-${var.app_name}-primary-instance"
  promotion_tier                  = "${count.index + 1}"
  performance_insights_enabled    = true
  performance_insights_kms_key_id = "${var.east_kms_key_id}"
  copy_tags_to_snapshot           = true
  instance_class                  = "${var.instance-class}"
  auto_minor_version_upgrade      = true
  db_subnet_group_name            = "${var.east_subnet_group_name}"
}

################# Below runs if dr = true #################

data "aws_kms_key" "secondary_kms" {
  count    = "${var.dr ? 1 : 0}"
  provider = "aws.secondary"
  key_id   = "alias/aws/rds"
}

resource "aws_rds_cluster" "secondary_cluster" {
  depends_on = ["aws_rds_cluster_instance.primary"]
  count      = "${var.dr ? 1 : 0}"
  provider   = "aws.secondary"
  lifecycle {
    ignore_changes = ["availability_zones"]
  }
  cluster_identifier            = "${var.vpc_name}-${var.app_name}-secondary-cluster"
  global_cluster_identifier     = "${aws_rds_global_cluster.global_cluster.id}"
  engine                        = "aurora-postgresql"
  engine_mode                   = "provisioned"
  engine_version                = "${var.engine-version}"
  vpc_security_group_ids        = ["${var.sg-west}"]
  db_subnet_group_name          = "${var.west_subnet_group_name}"
  backup_retention_period       = 14
  preferred_backup_window       = "01:00-02:00"
  storage_encrypted             = true
  kms_key_id                    = "${data.aws_kms_key.secondary_kms.arn}"
  final_snapshot_identifier     = "${var.vpc_name}-${var.app_name}-secondary-cluster-final-snapshot-${random_id.snapshot_identifier.hex}"
  skip_final_snapshot           = "${var.skip_final_snapshot}"
  source_region                 = "us-east-1"
  replication_source_identifier = "${aws_rds_cluster.primary_cluster.arn}"
}

resource "aws_rds_cluster_instance" "secondary" {
  depends_on                      = ["aws_rds_cluster.secondary_cluster"]
  count                           = "${var.dr ? 1 : 0}"
  provider                        = "aws.secondary"
  engine                          = "aurora-postgresql"
  cluster_identifier              = "${aws_rds_cluster.secondary_cluster.id}"
  identifier                      = "${var.vpc_name}-${var.app_name}-secondary-instance"
  promotion_tier                  = "${count.index + 1}"
  performance_insights_enabled    = true
  performance_insights_kms_key_id = "${var.west_kms_key_id}"
  copy_tags_to_snapshot           = true
  instance_class                  = "${var.instance-class}"
  auto_minor_version_upgrade      = true
  db_subnet_group_name            = "${var.west_subnet_group_name}"
}

Debug Output

Debug Output gist.

Expected Behavior

Secondary aws_rds_cluster is created in a different region, associated with the parent aws_rds_global_cluster, replicating the primary aws_rds_cluster, and encrypted with the destination region's KMS key

Actual Behavior

I get an error that the source cluster "doesn't have binlogs enabled". This doesn't really make any sense since binlogs are a MySql thing AFAIK and I'm creating a postgresql cluster

Steps to Reproduce

1. terraform apply the above module

[jgreat]

I also ran into this issue. I worked through it with the aws-cli and figured out the Error: error creating RDS cluster: InvalidDBClusterStateFault: Source cluster doesn't have binlogs enabled. is because global_cluster_identifier and replication_source_identifier are supposed to be mutually exclusive options.

The provider is taking the wrong path and just submitting ReplicationSourceIdentifier and leaving out the GlobalClusterIdentifier in the POST. If both options were submitted you'd get back a different error. It would be nice if the provider checked for exclusivity on the plan.

So take out the replication_source_identifier option and that should get you past this error.

[bd-robert-suarez]

I'm running into a similar issue trying to create a global cluster with encryption. I get a presigned URL error when I specify only the global cluster ID and exclude the replication source. Can't seem to find anyone in the same position.

[bflad]

Fix submitted (#14490) to prevent the confusing error on creation, however we will document the recommendation that lifecycle configuration block ignore_changes should be used in this case with the replication_source_identifier, e.g.

resource "aws_rds_cluster" "secondary" {
  global_cluster_identifier = aws_global_cluster.example.id
  # ... other configuration ...

  lifecycle {
    ignore_changes = [replication_source_identifier]
  }
}

[bflad]

The above mentioned fix has been merged and will release with version 3.1.0 of the Terraform AWS Provider, likely later today. 👍

[ghost]

This has been released in version 3.1.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!