Store aws_db_instance.password in tfstate, change to AttrTypeCreate

[alekstorm]

Not storing the password in tfstate makes it impossible to tell when it's changed in the resource file, so terraform plan would incorrectly report that everything was up-to-date (the RDS API won't tell us what the current password is). IMO, this was a misfeature; the password should be interpolated from a variable, and I imagine the most common user scenario to be an organization-readable resource file, and a locked-down set of variable and state files (state files likely contain other sensitive information anyway, like private IP addresses).

That said, perhaps Terraform could use some mechanism of storing sensitive data in state files - in this case, since we only need to check for changes, we could get away with just hashing the password (or encrypting it). Alternatively, password wouldn't be an attribute at all, but an input prompted for whenever the DB instance is (re-)created. This would depend on a way to force recreation of a resource, though.

[mitchellh]

LGTM. I agree with everything you said.