amazon-web-servicesamazon-rdsaws-cli

MasterUserSecret field missing in describe-db-instances API

I have created the database with ManageMasterUserPassword=True. But I couldn't get the Secret Arn from the describe-db-instances command.

aws rds describe-db-instances --db-instance-identifier database-1 --query DBInstances[*].[MasterUsername,MasterUserSecret]
[
    [
        "postgres",
        null
    ]
]

I have created the database even from console, enter image description here

Still I am facing the same error. But I can clearly see the database ARN in SecretsManager and Secrets ARN in database. enter image description here enter image description here

Solution

  • Make sure you have more recent awscli, the support for this feature was added in 2.9.10:

    https://raw.githubusercontent.com/aws/aws-cli/v2/CHANGELOG.rst

    2.9.10
...
* api-change:``rds``: Add support for managing master user password in AWS Secrets Manager for the DBInstance and DBCluster.
...

    With this, the output (only when the feature is enabled on the db instance) will contain:

    $ aws rds describe-db-instances --db-instance-identifier database-1 --region=us-east-1

...
"MasterUserSecret": {
                "SecretArn": "arn:aws:secretsmanager:us-east-1:776665554444:secret:rds!db-88888888-82e1-4a59-8c35-888888888888-SyXcpL",
                "SecretStatus": "active",
                "KmsKeyId": "arn:aws:kms:us-east-1:888888888888:key/88888888-c6c4-43da-a4a4-888888888888"
            },

    You can get the actual values with (for example):

    $ secret_arn=$(aws rds describe-db-instances --db-instance-identifier database-1 --region=us-east-1 --query DBInstances[*].[MasterUserSecret.SecretArn] --output text)
$ aws secretsmanager get-secret-value --secret-id ${secret_arn} --region us-east-1 --query SecretString --output text
{"username":"admin","password":"SVxxxxxxxxxxxxxxxxxxxxxxxY7gwkD"}