terraform {
 # S3 Conditional Writing configuration (locks without DynamoDB)
 required_version = "~> 1.10" # with use_lockfile
 backend "s3" {
  bucket     = "my-tf-state"
  # dynamodb_table = "my-tf-state-lock" # deprecated from 1.11
  use_lockfile  = true
  key      = "devops/us-east-1/kms.tfstate"
  region     = "us-east-1"
  encrypt    = "true"
  kms_key_id   = "arn:aws:kms:us-east-1:34567890:key/15a-6736"
 }
}

provider "aws" {
  region = "us-east-1"
}

ephemeral "random_password" "db_password" {
  length = 16
}

resource "aws_secretsmanager_secret" "db_password" {
  name = "db_password"
}

resource "aws_secretsmanager_secret_version" "db_password" {
  secret_id                = aws_secretsmanager_secret.db_password.id
  secret_string_wo         = ephemeral.random_password.db_password.result
  secret_string_wo_version = 1
}

ephemeral "aws_secretsmanager_secret_version" "db_password" {
  secret_id = aws_secretsmanager_secret.db_password.id
}

resource "aws_db_instance" "example" {
  instance_class      = "db.t4g.small"
  allocated_storage   = "20"
  engine              = "postgres"
  username            = "myuser"
  skip_final_snapshot = true

  password_wo         = ephemeral.aws_secretsmanager_secret_version.db_password.secret_string
  password_wo_version = 1
}

provider "aws" {
  tag_policy_compliance = "error"
}

When set to error, tag policy violations will trigger an error diagnostic.

When set to warning, tag policy violations will trigger a warning diagnostic. Planned changes will be able to proceed, but the diagnostic will not be silenced until the tag policy violation is resolved.

When set to disabled, the tag policy will not be enforced. This is equivalent to leaving the value unset.