From e3d73ee5f7b778f4c8d66faee9df1d8c0346ea34 Mon Sep 17 00:00:00 2001 From: vyrwu Date: Thu, 23 Apr 2026 13:05:14 +0200 Subject: [PATCH] feat: Allow overriding Performance Insights KMS key MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add performance_insights_kms_key_arn variable to allow specifying a custom KMS key ARN for Performance Insights encryption. When null (default), falls back to the component's RDS CMK. This is needed when a cluster was initially created with PI disabled (or with a different KMS key), and PI is later enabled via Terraform. In that scenario, the cluster already has a PI KMS key assigned by AWS (typically the default aws/rds managed key), and the component unconditionally tries to set the RDS CMK — which AWS rejects because PI KMS keys cannot be changed after cluster creation. The new variable allows users to pass the ARN of the key already in use, preventing the InvalidParameterCombination error: "You can't change your Performance Insights KMS key." Co-Authored-By: Claude Opus 4.6 (1M context) --- src/cluster-regional.tf | 2 +- src/variables.tf | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/src/cluster-regional.tf b/src/cluster-regional.tf index d24a335..f73fc2a 100644 --- a/src/cluster-regional.tf +++ b/src/cluster-regional.tf @@ -34,7 +34,7 @@ module "aurora_postgres_cluster" { storage_encrypted = var.storage_encrypted storage_type = var.storage_type kms_key_arn = var.storage_encrypted ? module.kms_key_rds.key_arn : null - performance_insights_kms_key_id = var.performance_insights_enabled ? module.kms_key_rds.key_arn : null + performance_insights_kms_key_id = var.performance_insights_enabled ? coalesce(var.performance_insights_kms_key_arn, module.kms_key_rds.key_arn) : null maintenance_window = var.maintenance_window enabled_cloudwatch_logs_exports = var.enabled_cloudwatch_logs_exports enhanced_monitoring_role_enabled = var.enhanced_monitoring_role_enabled diff --git a/src/variables.tf b/src/variables.tf index 92d9f4b..c8649f4 100644 --- a/src/variables.tf +++ b/src/variables.tf @@ -200,6 +200,12 @@ variable "performance_insights_enabled" { description = "Whether to enable Performance Insights" } +variable "performance_insights_kms_key_arn" { + type = string + default = null + description = "ARN of the KMS key for Performance Insights encryption. If null, defaults to the RDS CMK." +} + variable "database_insights_mode" { type = string description = "The database insights mode for the RDS cluster. Valid values are `standard`, `advanced`. See https://registry.terraform.io/providers/hashicorp/aws/6.16.0/docs/resources/rds_cluster#database_insights_mode-1"