# Terraform Update RDS Proxy without Deleting Existing Secrets

**URL:** <https://discuss.hashicorp.com/t/terraform-update-rds-proxy-without-deleting-existing-secrets/52152>\
**Category:** AWS\
**Created:** [March 31, 2023, 12:17pm UTC](https://discuss.hashicorp.com/t/terraform-update-rds-proxy-without-deleting-existing-secrets/52152 "2023-03-31T12:17:08Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![venh.123](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/venh.123/32/19256_2.png) [@venh.123](https://discuss.hashicorp.com/u/venh.123)\
**Post date:** [March 31, 2023, 12:17pm UTC](https://discuss.hashicorp.com/t/terraform-update-rds-proxy-without-deleting-existing-secrets/52152/1 "2023-03-31T12:17:08Z")

</div>

Terraform v1.1.4. I am using it to provision Aurora Postgres SQL. I am also provisioning an RDS Proxy using Terraform. As part of RDS Proxy, I am also creating a secret. After this, another application also creates some secrets and associates with this proxy. Recently, I had to update a setting in the Proxy. When I ran a TF apply, it reapplied all the settings and the secrets created by the other application got wiped out. Is it possible to update RDS proxy using TF without touching secrets? Rather, is it possible to TF apply without touching authentication information like secrets?

---

<div class="post-metadata">

**Author:** ![macmiranda](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/macmiranda/32/34065_2.png) [@macmiranda](https://discuss.hashicorp.com/u/macmiranda)\
**Post date:** [March 31, 2023, 12:26pm UTC](https://discuss.hashicorp.com/t/terraform-update-rds-proxy-without-deleting-existing-secrets/52152/2 "2023-03-31T12:26:24Z")

</div>

Terraform will only touch resources that are managed by it. If you are managing the secret within your TF code, then it will attempt to reconcile it.

Can you provide the relevant parts of your code?

---

<div class="post-metadata">

**Author:** ![venh.123](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/venh.123/32/19256_2.png) [@venh.123](https://discuss.hashicorp.com/u/venh.123)\
**Post date:** [March 31, 2023, 2:16pm UTC](https://discuss.hashicorp.com/t/terraform-update-rds-proxy-without-deleting-existing-secrets/52152/3 "2023-03-31T14:16:46Z")

</div>

```auto
resource "aws_secretsmanager_secret" "superuser" {
  name = var.secret_name 
  description = "Secret for DB Cluster credentials"
  kms_key_id = data.aws_kms_key.kms_key_id_alias.id

  tags = var.tags
}

resource "aws_secretsmanager_secret_version" "superuser" {
  secret_id = aws_secretsmanager_secret.superuser.id
  secret_string = jsonencode(var.secret_string)
}

```

Does this help? This is the piece of code inside the RDS Proxy TF file.

---

<div class="post-metadata">

**Author:** ![macmiranda](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/macmiranda/32/34065_2.png) [@macmiranda](https://discuss.hashicorp.com/u/macmiranda)\
**Post date:** [March 31, 2023, 2:48pm UTC](https://discuss.hashicorp.com/t/terraform-update-rds-proxy-without-deleting-existing-secrets/52152/4 "2023-03-31T14:48:38Z")

</div>

> [@venh.123](#):
>
> After this, another application also creates some secrets and associates with this proxy

Are those different secrets or different versions of the same secret?

If Terraform didn’t know about the existence of the other secrets, it also wouldn’t know how to wipe them out.

Perhaps you can illustrate what happened by using examples like:

- Terraform created secret A
- App X created secret B
- Terraform erased secret A and B
- B is referenced in Terraform code here and here…

Do you have the output of the Terraform plan that shows secrets being destroyed?

Maybe also add the bit that contains the proxy resource.

---

<div class="post-metadata">

**Author:** ![venh.123](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/venh.123/32/19256_2.png) [@venh.123](https://discuss.hashicorp.com/u/venh.123)\
**Post date:** [March 31, 2023, 6:36pm UTC](https://discuss.hashicorp.com/t/terraform-update-rds-proxy-without-deleting-existing-secrets/52152/5 "2023-03-31T18:36:31Z")

</div>

> [@macmiranda](#):
>
> t know about the existe

First of all, thanks a lot for the prompt response. Let me explain.  
Terraform created secret A  
AppX created secret B  
Terraform erased secret A & B  
B is **not** there anywhere in Terraform code

When I ran a TF plan, it showed that it will destroy A & B. I will check with customer and share more code accordingly. Please apologize.

---

<div class="post-metadata">

**Author:** ![venh.123](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/venh.123/32/19256_2.png) [@venh.123](https://discuss.hashicorp.com/u/venh.123)\
**Post date:** [April 3, 2023, 12:04pm UTC](https://discuss.hashicorp.com/t/terraform-update-rds-proxy-without-deleting-existing-secrets/52152/6 "2023-04-03T12:04:16Z")

</div>

```auto
 - auth {
          - auth_scheme = "SECRETS" -> null
          - client_password_auth_type = "POSTGRES_SCRAM_SHA_256" -> null
          - iam_auth = "REQUIRED" -> null
          - secret_arn = "arn:aws:secretsmanager:us-east-1:<my-acct-id>:secret:dev-lab/rds/postgres/01/myApp_rds_rw_user-nv41Tv" -> null
        }
      - auth {
          - auth_scheme = "SECRETS" -> null
          - client_password_auth_type = "POSTGRES_SCRAM_SHA_256" -> null
          - iam_auth = "REQUIRED" -> null
          - secret_arn = "arn:aws:secretsmanager:us-east-1:<my-acct-id>:secret:dev-lab/rds/postgres/01/myApp_rds_ro_user-nayvhn" -> null
        }
     
        # (1 unchanged block hidden)
    }

```

The above is the output from TF plan. As you can see, it is trying to delete the secrets which are created by the App. Does this help?

---

<div class="post-metadata">

**Author:** ![macmiranda](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/macmiranda/32/34065_2.png) [@macmiranda](https://discuss.hashicorp.com/u/macmiranda)\
**Post date:** [April 3, 2023, 12:11pm UTC](https://discuss.hashicorp.com/t/terraform-update-rds-proxy-without-deleting-existing-secrets/52152/7 "2023-04-03T12:11:19Z")

</div>

That doesn’t look like a secret resource.  
That looks like an auth block of a different resource that references the secret. If those blocks are changed outside Terraform, it will definitely try to correct the drift.

---

<div class="post-metadata">

**Author:** ![venh.123](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/venh.123/32/19256_2.png) [@venh.123](https://discuss.hashicorp.com/u/venh.123)\
**Post date:** [April 3, 2023, 12:28pm UTC](https://discuss.hashicorp.com/t/terraform-update-rds-proxy-without-deleting-existing-secrets/52152/8 "2023-04-03T12:28:45Z")

</div>

Sorry for the confusion. Yes, it is listed under Auth block. But it is referenced inside the same proxy and TF says it will delete it. Is there a way to avoid it?

---

<div class="post-metadata">

**Author:** ![venh.123](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/venh.123/32/19256_2.png) [@venh.123](https://discuss.hashicorp.com/u/venh.123)\
**Post date:** [April 3, 2023, 12:49pm UTC](https://discuss.hashicorp.com/t/terraform-update-rds-proxy-without-deleting-existing-secrets/52152/9 "2023-04-03T12:49:53Z")

</div>

Is it possible to exclude modifying Auth block? Please advise.

---

<div class="post-metadata">

**Author:** ![macmiranda](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/macmiranda/32/34065_2.png) [@macmiranda](https://discuss.hashicorp.com/u/macmiranda)\
**Post date:** [April 3, 2023, 12:56pm UTC](https://discuss.hashicorp.com/t/terraform-update-rds-proxy-without-deleting-existing-secrets/52152/10 "2023-04-03T12:56:54Z")

</div>

You’d need something similar to [ignore\_changes](https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle#ignore_changes) for blocks instead of attributes but I don’t think that exists.

---

<div class="post-metadata">

**Author:** ![stuart-c](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/stuart-c/32/10789_2.png) [@stuart-c](https://discuss.hashicorp.com/u/stuart-c)\
**Post date:** [April 3, 2023, 1:14pm UTC](https://discuss.hashicorp.com/t/terraform-update-rds-proxy-without-deleting-existing-secrets/52152/11 "2023-04-03T13:14:06Z")

</div>

The problem is that you are trying to manage a resource that Terraform controls from elsewhere, so Terraform will try to change that.

The two options are, either to stop managing that from Terraform - some providers allow for multiple different ways to manage a resource to reduce the scope of what is or isn’t managed, but I don’t know if that is possible in this case (or could be requested as a new feature of the provider).

Alternatively you could manage those passwords from within Terraform instead of the other process you are using.

---

<div class="post-metadata">

**Author:** ![venh.123](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/venh.123/32/19256_2.png) [@venh.123](https://discuss.hashicorp.com/u/venh.123)\
**Post date:** [April 3, 2023, 2:44pm UTC](https://discuss.hashicorp.com/t/terraform-update-rds-proxy-without-deleting-existing-secrets/52152/12 "2023-04-03T14:44:21Z")

</div>

Thank you @macmiranda and @stuart-c. Let me also check with my customer.

---

<div class="post-metadata">

**Author:** ![venh.123](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/venh.123/32/19256_2.png) [@venh.123](https://discuss.hashicorp.com/u/venh.123)\
**Post date:** [April 3, 2023, 4:53pm UTC](https://discuss.hashicorp.com/t/terraform-update-rds-proxy-without-deleting-existing-secrets/52152/13 "2023-04-03T16:53:21Z")

</div>

Didn’t get you. ignore\_changes won’t work in my case? Can you please explain a little more?

---

<div class="post-metadata">

**Author:** ![macmiranda](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/macmiranda/32/34065_2.png) [@macmiranda](https://discuss.hashicorp.com/u/macmiranda)\
**Post date:** [April 3, 2023, 4:54pm UTC](https://discuss.hashicorp.com/t/terraform-update-rds-proxy-without-deleting-existing-secrets/52152/14 "2023-04-03T16:54:54Z")

</div>

No, it won’t because the thing that you want to ignore isn’t an attribute. It’s a block.

---

<div class="post-metadata">

**Author:** ![venh.123](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/venh.123/32/19256_2.png) [@venh.123](https://discuss.hashicorp.com/u/venh.123)\
**Post date:** [April 4, 2023, 11:14am UTC](https://discuss.hashicorp.com/t/terraform-update-rds-proxy-without-deleting-existing-secrets/52152/15 "2023-04-04T11:14:09Z")

</div>

I tried with the following block inside my aws\_db\_proxy resource. Looks like it is working. However, I am testing once again.

```auto
lifecycle {
       ignore_changes = [
         auth,
      ]
     }

```

---

<div class="post-metadata">

**Author:** ![macmiranda](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/macmiranda/32/34065_2.png) [@macmiranda](https://discuss.hashicorp.com/u/macmiranda)\
**Post date:** [April 4, 2023, 12:37pm UTC](https://discuss.hashicorp.com/t/terraform-update-rds-proxy-without-deleting-existing-secrets/52152/16 "2023-04-04T12:37:53Z")

</div>

Didn’t expect that to be true solely relying on what the documentation says.

---

<div class="post-metadata">

**Author:** ![venh.123](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/venh.123/32/19256_2.png) [@venh.123](https://discuss.hashicorp.com/u/venh.123)\
**Post date:** [April 6, 2023, 7:55am UTC](https://discuss.hashicorp.com/t/terraform-update-rds-proxy-without-deleting-existing-secrets/52152/17 "2023-04-06T07:55:28Z")

</div>

Yes @macmiranda. It seems to be working fine. Thanks a lot for your help.