feat: Ephemeral password support

[artem-hatchenko]

Description

This update adds support for ephemeral master passwords (master_password_wo) in RDS/Aurora clusters.
With this option, the master password is write-only and never stored in the Terraform state.

Motivation

Since "manage_master_user_password" has annoying behavior with enabled rotation by default, and "master_password" stores the value in state, this solution provides an alternative.

How Has This Been Tested?

Tested with a few options:

Option 1

manage_master_user_password = false
master_password = false
master_password_wo = true

Result: Deploy successful and connection with "wo" password works

Option 2

manage_master_user_password = false
master_password = true
master_password_wo = true

Result: Conflicting configuration arguments (expected)

Option 3

manage_master_user_password = true
master_password = false
master_password_wo = true

Result: Conflicting configuration arguments (expected)

Usage

Generate a password via ephemeral, put result into Secret Manager, and retrieve version of the secret.

ephemeral "random_password" "db_password" {
  length           = 16
  override_special = "!#$%&*()-_=+[]{}<>:?"
}

resource "aws_secretsmanager_secret" "db_password" {
  name = "db_password"
}

resource "aws_secretsmanager_secret_version" "db_password" {
  secret_id                = aws_secretsmanager_secret.db_password.id
  secret_string_wo         = ephemeral.random_password.db_password.result
  secret_string_wo_version = 1
}

ephemeral "aws_secretsmanager_secret_version" "db_password" {
  secret_id = aws_secretsmanager_secret_version.db_password.secret_id
}

Pass necessary variables into module:

manage_master_user_password = false
master_password_wo          = ephemeral.aws_secretsmanager_secret_version.db_password.secret_string
master_password_wo_version  = aws_secretsmanager_secret_version.db_password.secret_string_wo_version

[bryantbiggs]

see #509 (comment)