resource/aws_db_instance: Redact MasterUserPassword when displaying InvalidParameterValue error with CreateDBInstance

aws/resource_aws_db_instance.go

@@ -1185,6 +1185,7 @@ func resourceAwsDbInstanceCreate(d *schema.ResourceData, meta interface{}) error
 		})
 		if err != nil {
 			if isAWSErr(err, "InvalidParameterValue", "") {
+				opts.MasterUserPassword = aws.String("********")
 				return fmt.Errorf("Error creating DB Instance: %s, %+v", err, opts)
 			}
 			return fmt.Errorf("Error creating DB Instance: %s", err)

aws/resource_aws_db_instance_test.go

@@ -463,6 +463,44 @@ func TestAccAWSDBInstance_MaxAllocatedStorage(t *testing.T) {
 	})
 }
 
+func TestAccAWSDBInstance_Password(t *testing.T) {
+	var dbInstance rds.DBInstance
+
+	rName := acctest.RandomWithPrefix("tf-acc-test")
+	resourceName := "aws_db_instance.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSDBInstanceDestroy,
+		Steps: []resource.TestStep{
+			// Password should not be shown in error message
+			{
+				Config:      testAccAWSDBInstanceConfig_Password(rName, "invalid"),
+				ExpectError: regexp.MustCompile(`MasterUserPassword: "\*{8}",`),
+			},
+			{
+				Config: testAccAWSDBInstanceConfig_Password(rName, "valid-password"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSDBInstanceExists(resourceName, &dbInstance),
+					resource.TestCheckResourceAttr(resourceName, "password", "valid-password"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"apply_immediately",
+					"final_snapshot_identifier",
+					"password",
+					"skip_final_snapshot",
+				},
+			},
+		},
+	})
+}
+
 func TestAccAWSDBInstance_ReplicateSourceDb(t *testing.T) {
 	var dbInstance, sourceDbInstance rds.DBInstance
 
@@ -3971,6 +4009,20 @@ resource "aws_db_instance" "test" {
 `, rName, maxAllocatedStorage)
 }
 
+func testAccAWSDBInstanceConfig_Password(rName, password string) string {
+	return fmt.Sprintf(`
+resource "aws_db_instance" "test" {
+  allocated_storage   = 5
+  engine              = "mysql"
+  identifier          = %[1]q
+  instance_class      = "db.t2.micro"
+  password            = %[2]q
+  username            = "tfacctest"
+  skip_final_snapshot = true
+}
+`, rName, password)
+}
+
 func testAccAWSDBInstanceConfig_ReplicateSourceDb(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_db_instance" "source" {