Terraform: AWS DB Instance with managed master user password

main.tf

# Creates a Postgres DB instance in AWS with an automatically generated master password
# stored in Secrets Manager, returing username and password in the output.

resource "aws_db_instance" "postgres_db" {
  engine                      = "postgres"
  db_name                     = var.db_name
  username                    = var.db_username
  manage_master_user_password = true
}


data "aws_secretsmanager_secret" "db_master_password" {
  name = one(aws_db_instance.postgres_db.master_user_secret).secret_arn
}

data "aws_secretsmanager_secret_version" "db_master_password" {
  secret_id = data.aws_secretsmanager_secret.db_master_password.id
}

output "db_user" {
  value = aws_db_instance.postgres_db.username
}

output "db_password" {
  value     = jsondecode(data.aws_secretsmanager_secret_version.db_master_password.secret_string)["password"]
  sensitive = true
}