New resource: aws_db_instance_automated_backups_replication

[bschaatsbergen]

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for pull request followers and do not help prioritize the request

Closes #23673.
Closes #16708.
Similar #20448.

Output from acceptance testing:

$ make testacc TESTS=TestAccRDSInstanceAutomatedBackupReplication_ PKG=rds                                                                             (base) 
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/rds/... -v -count 1 -parallel 20 -run='TestAccRDSInstanceAutomatedBackupReplication_'  -timeout 180m
=== RUN   TestAccRDSInstanceAutomatedBackupReplication_basic
=== PAUSE TestAccRDSInstanceAutomatedBackupReplication_basic
=== RUN   TestAccRDSInstanceAutomatedBackupReplication_retentionPeriod
=== PAUSE TestAccRDSInstanceAutomatedBackupReplication_retentionPeriod
=== RUN   TestAccRDSInstanceAutomatedBackupReplication_kmsEncrypted
=== PAUSE TestAccRDSInstanceAutomatedBackupReplication_kmsEncrypted
=== CONT  TestAccRDSInstanceAutomatedBackupReplication_basic
=== CONT  TestAccRDSInstanceAutomatedBackupReplication_kmsEncrypted
=== CONT  TestAccRDSInstanceAutomatedBackupReplication_retentionPeriod
--- PASS: TestAccRDSInstanceAutomatedBackupReplication_retentionPeriod (1112.49s)
--- PASS: TestAccRDSInstanceAutomatedBackupReplication_basic (1143.40s)
--- PASS: TestAccRDSInstanceAutomatedBackupReplication_kmsEncrypted (1166.08s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/rds        1166.316s

[bschaatsbergen]

@ewbankkit wanted to get some of your input here, the API is a bit poorly designed in my opinion. It's expected that this call is done from within the destination region (if you want to replicate backups from us-east-1 to us-west-2, I would have to declare the resource in us-west-2, pointing to a source_db_instance_arn in us-east-1).

This conflicts a little bit with having to wait for the instance becoming 'available' after modifying..

At the moment I have this, which works fine but I still don't find it pretty that it has to be declared in the destination region.

resource "aws_db_instance_backup_replication" "default" {
  source_db_instance_arn = "arn:aws:rds:us-east-1:832224938332:db:database-1"
  kms_key_id             = "arn:aws:kms:us-west-2:832224938332:key/example-key-id"
}

provider "aws" {
  region = "us-west-2"
}

[YakDriver]

@bschaatsbergen We've run into this sort of thing in a few places. A recent one that I worked on is here:

terraform-provider-aws/internal/service/rds/global_cluster.go

Lines 580 to 588 in 928c293

	useConn := conn // clusters may not all be in the same region
	if clusterRegion != meta.(*conns.AWSClient).Region {
	useConn = rds.New(meta.(*conns.AWSClient).Session, aws.NewConfig().WithRegion(clusterRegion))
	}
	if err := waitForClusterUpdate(useConn, dbi, timeout); err != nil {
	return fmt.Errorf("failed to update engine_version, waiting for RDS Global Cluster (%s) to update: %s", dbi, err)
	}

If it needs to wait on something in another region, my opinion is that it should wait the same, as though it were in the same region.

[bschaatsbergen]

@bschaatsbergen We've run into this sort of thing in a few places. A recent one that I worked on is here:

terraform-provider-aws/internal/service/rds/global_cluster.go

Lines 580 to 588 in 928c293

	useConn := conn // clusters may not all be in the same region
	if clusterRegion != meta.(*conns.AWSClient).Region {
	useConn = rds.New(meta.(*conns.AWSClient).Session, aws.NewConfig().WithRegion(clusterRegion))
	}
	if err := waitForClusterUpdate(useConn, dbi, timeout); err != nil {
	return fmt.Errorf("failed to update engine_version, waiting for RDS Global Cluster (%s) to update: %s", dbi, err)
	}

If it needs to wait on something in another region, my opinion is that it should wait the same, as though it were in the same region.

Thank you Yak! :)

[bschaatsbergen]

Had a rough weekend, looks like I missed a few things yesterday. Thanks for the extra pair of eyes @ewbankkit .

[ewbankkit]

@bschaatsbergen In general everything was great.
The only significant change was to the wait after the call to StopDBInstanceAutomatedBackupsReplication. The long list of DB Instance statuses seemed quite brittle so I went with the approach of polling the DB Instance's list of DBInstanceAutomatedBackupsReplications until the required backup ARN is no longer present.

Do you know anything about the PreSignedUrl parameter? The User Guide says

If you encrypt the backups, you must also include a presigned URL.

but the TestAccRDSInstanceAutomatedBackupReplication_kmsEncrypted test case is currently passing without it.

I see no harm in adding pre_signed_url as an optional argument (I'll do that).

[ewbankkit]

LGTM 🚀.

% make testacc TESTS=TestAccRDSInstanceAutomatedBackupReplication_ PKG=rds ACCTEST_PARALLELISM=2
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/rds/... -v -count 1 -parallel 2 -run='TestAccRDSInstanceAutomatedBackupReplication_'  -timeout 180m
=== RUN   TestAccRDSInstanceAutomatedBackupReplication_basic
=== PAUSE TestAccRDSInstanceAutomatedBackupReplication_basic
=== RUN   TestAccRDSInstanceAutomatedBackupReplication_retentionPeriod
=== PAUSE TestAccRDSInstanceAutomatedBackupReplication_retentionPeriod
=== RUN   TestAccRDSInstanceAutomatedBackupReplication_kmsEncrypted
=== PAUSE TestAccRDSInstanceAutomatedBackupReplication_kmsEncrypted
=== CONT  TestAccRDSInstanceAutomatedBackupReplication_basic
=== CONT  TestAccRDSInstanceAutomatedBackupReplication_kmsEncrypted
--- PASS: TestAccRDSInstanceAutomatedBackupReplication_basic (1439.87s)
=== CONT  TestAccRDSInstanceAutomatedBackupReplication_retentionPeriod
--- PASS: TestAccRDSInstanceAutomatedBackupReplication_kmsEncrypted (1479.54s)
--- PASS: TestAccRDSInstanceAutomatedBackupReplication_retentionPeriod (1405.06s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/rds	2854.272s

[bschaatsbergen]

@ewbankkit Clear, regarding the PreSignedUrl parameter, I read the following when digging through the SDK

PreSignedUrl
// Specifying SourceRegion autogenerates a pre-signed URL that
// is a valid request for the operation that can be executed in the source
// Amazon Web Services Region.

/ SourceRegion is the source region where the resource exists. This is not
// sent over the wire and is only used for presigning. This value should always
// have the same region as the source ARN.
SourceRegion *string type:"string" ignore:"true"

At first I was under the impression that this was handled internally if not specified. After taking a look at Event History in CloudTrail I didn't see any PreSignedUrl (explicitly setting it through the CLI it does show in the event) going over the wire even if the automated backup was encrypted.

If we want to avoid adding PreSignedUrl to the scheme, we can maybe set the SourceRegion in the StartDBInstanceAutomatedBackupsReplicationInput, otherwise lets add it 👍

[ewbankkit]

OK, another change 😄. Renamed the resource to aws_db_instance_automated_backups_replication to match the underlying AWS API.

Significant changes since review

[ewbankkit]

LGTM 🚀.

% make testacc TESTS=TestAccRDSInstanceAutomatedBackupsReplication_ PKG=rds ACCTEST_PARALLELISM=2
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/rds/... -v -count 1 -parallel 2 -run='TestAccRDSInstanceAutomatedBackupsReplication_'  -timeout 180m
=== RUN   TestAccRDSInstanceAutomatedBackupsReplication_basic
=== PAUSE TestAccRDSInstanceAutomatedBackupsReplication_basic
=== RUN   TestAccRDSInstanceAutomatedBackupsReplication_retentionPeriod
=== PAUSE TestAccRDSInstanceAutomatedBackupsReplication_retentionPeriod
=== RUN   TestAccRDSInstanceAutomatedBackupsReplication_kmsEncrypted
=== PAUSE TestAccRDSInstanceAutomatedBackupsReplication_kmsEncrypted
=== CONT  TestAccRDSInstanceAutomatedBackupsReplication_basic
=== CONT  TestAccRDSInstanceAutomatedBackupsReplication_kmsEncrypted
--- PASS: TestAccRDSInstanceAutomatedBackupsReplication_basic (1188.64s)
=== CONT  TestAccRDSInstanceAutomatedBackupsReplication_retentionPeriod
--- PASS: TestAccRDSInstanceAutomatedBackupsReplication_kmsEncrypted (1249.54s)
--- PASS: TestAccRDSInstanceAutomatedBackupsReplication_retentionPeriod (1047.58s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/rds	2240.134s

[github-actions]

This functionality has been released in v4.9.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.