[Enhancement]: Improvements to aws_rds_cluster_actiivty_stream

[jbbeal]

Description

Currently trying to set up RDS Cluster activity streams in Terraform for tracking database changes.

At a minimum, the aws_rds_cluster_activity_stream should export the ARN for the underlying kinesis data stream. (Using a firehose delivery stream to dump logs into S3 seems like a common use case for this data, and firehose requires a correctly formatted ARN for the kinesis stream.)

It should also be possible to set tags on the activity stream so we can allocate costs of the Kinesis stream.

Affected Resource(s) and/or Data Source(s)

• aws_rds_cluster_activity_stream

Potential Terraform Configuration

resource "aws_rds_cluster_activity_stream" "this" {
  ...

  tags = {}
}

resource "aws_firehose_delivery_stream" {
  kinesis_source_configuration {
    aws_rds_cluster_actitivity_stream.this.arn
  }
}

References

No response

Would you like to implement a fix?

None

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[justinretzolk]

Hey @jbbeal 👋 Thank you for taking the time to raise this! The upstream API action used doesn't return the Kinesis stream ARN, so that's not something we'd be able to add to this resources without upstream changes.

On the other hand, the aws_rds_cluster_activity_stream resource exports a kinesis_stream_name attribute, which can be used with the aws_kinesis_stream data source in order to get the ARN you're looking for.

Can you verify whether that would work in your scenario?

[jbbeal]

The data source is exactly how I worked around the limitation in the resource, but it does not allow me to apply tagging to the kinesis stream. Are terraform providers constrained to be no better than the underlying AWS API? That would be unfortunate.

[justinretzolk]

Glad to hear the data source helped work around the limitation for you! As far as being constrained to the underlying API -- outside of a few edge cases, the provider maps as closely to 1:1 with the underlying API as possible. This aligns with the provider design principles that we recommend all providers follow.

If you'd like to manage the Kinesis stream that gets created, you could import it, but it would need to be two separate applies (I'd actually recommend to separate the configurations so that you don't wind up overly reliant on targeted applies). There are a few open issues in the main Terraform repository that are tracking requests like yours, as ultimately, this is something that will require a change in Terraform Core before it can be supported:

• Support use of computed values in import blocks IDs terraform#34152
• Unknown values should not block successful planning terraform#30937

I'd be remiss if I didn't at least mention Terraform Stacks as well, which should eventually help with this type of multi-apply situation.

Since there's no further action for the AWS Provider team at this point in time, I'm going to close this issue. If you run into any other unexpected behavior, please do let us know!

[github-actions]

Warning

This issue has been closed, meaning that any additional comments are hard for our team to see. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.