Add support for AuthTokenUpdateStrategy to aws_elasticache_replication_group

[karlismelderis]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Every time auth_token changes terraform is destroying Redis cluster. it should/could be possible to set new token without destroy if TF would use AuthTokenUpdateStrategy option.

New or Affected Resource(s)

• aws_elasticache_replication_group

Potential Terraform Configuration

resource "aws_elasticache_replication_group" "as_redis" {
  auth_token = "some_super_secret_new_token"
  auth_token_update_strategy = "<set|rotate>"
  engine = "redis"
  transit_encryption_enabled = true
  lifecycle {
    prevent_destroy = true
  }
}

References

• 0000

[christoph-h]

There is an open PR, that should allow to update the auth token using the rotate strategy: https://github.com/hashicorp/terraform-provider-aws/pull/16203

[hskrtich]

The code for this request was merged last year, This issue can be closed.

[Israphel]

The code for this request was merged last year, This issue can be closed.

where? I don't see the feature https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/elasticache_replication_group#auth_token

[hskrtich]

@Israphel Here is the PR for it. https://github.com/hashicorp/terraform-provider-aws/pull/16203

This was added in version 3.67.0 (November 25, 2021)

[Israphel]

so, they didn't add the update strategy, they're allowing to change auth_token outside

[hskrtich]

ah sorry, I was confused with the description of this issue. The "Every time auth_token changes terraform is destroying Redis cluster." part is fixed. The "AuthTokenUpdateStrategy option" part is not implemented.

[varkey]

Adding support for AuthTokenUpdateStrategy will also help if one wants to migrate from Redis Auth to RBAC which would require the AuthTokenUpdateStrategy to be set to DELETE

https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Clusters.RBAC.html#Migrate-From-RBAC-to-Auth

[github-actions[bot]]

This functionality has been released in v5.27.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions[bot]]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.