Interpolated Values in URL not Updated

[feigi]

Hi again,

sorry to bother again, but I'm facing another issue that I can't explain. Let me prefix this by saying it may very well be my Terraform code but I don't see the issue.

I have the following Terraform module:

locals {
  master_secret = jsondecode(data.aws_secretsmanager_secret_version.db_master_secret.secret_string)
  master_user   = local.master_secret["username"]
  master_pass   = local.master_secret["password"]

  dev_url = "docker://postgres/15-alpine/dev"
  url     = "postgres://${local.master_user}:${urlencode(local.master_pass)}@${module.db_tunnel.host}:${module.db_tunnel.port}/${var.db_name}?sslmode=disable&search_path=public"
}

data "aws_secretsmanager_secret" "db_master_secret" {
  arn = var.db_master_secret_arn
}

// Fetches the latest version (AWSCURRENT) by default
data "aws_secretsmanager_secret_version" "db_master_secret" {
  secret_id = data.aws_secretsmanager_secret.db_master_secret.id
}

data "atlas_migration" "this" {
  dir = "${var.migrations_folder}?format=atlas"
  url = local.url

  depends_on = [data.aws_secretsmanager_secret_version.db_master_secret]
}

resource "atlas_migration" "this" {
  dir     = "${var.migrations_folder}?format=atlas"
  version = data.atlas_migration.this.latest # Use latest to run all migrations
  url     = local.url
  dev_url = local.dev_url

  depends_on = [data.aws_secretsmanager_secret_version.db_master_secret]
}

As you can see, I pull in the db user name and password via data "aws_secretsmanager_secret_version", parse it in locals and then use the values to build the url. Because I use the output of data "aws_secretsmanager_secret_version" only in locals and therefore won't have a direct dependency from atlas_migration to data "aws_secretsmanager_secret_version" I also added a depends_on in the atlas_migration resources. Unfortunately, it looks to me like when the password changes in SecretManager (it rotates every 7 days), the url being used by atlas_migration does not update, respectively it uses the old one and fails with an authentication error. Removing the state of atlas_migration via terraform state rm atlas_migration.this fixes it. Deleting the data "aws_secretsmanager_secret_version" was not needed.

[feigi]

P.S. this is probably also the reason why using random ports for the DB doesn't work. I connect via port forwarding, so I'd prefer using a random unused local port instead of a fixed one.

[feigi]

Hey! Just an fyi: so far I work around this, by removing the state for atlas_migration.this before every apply