Merge pull request #9060 from TimeIncOSS/b-aws-aurora-encryption

provider/aws: Make encryption in Aurora instances computed-only

builtin/providers/aws/resource_aws_rds_cluster_instance.go

@@ -85,16 +85,12 @@ func resourceAwsRDSClusterInstance() *schema.Resource {
 
 			"kms_key_id": &schema.Schema{
 				Type:     schema.TypeString,
-				Optional: true,
 				Computed: true,
-				ForceNew: true,
 			},
 
 			"storage_encrypted": &schema.Schema{
 				Type:     schema.TypeBool,
-				Optional: true,
-				Default:  false,
-				ForceNew: true,
+				Computed: true,
 			},
 
 			"monitoring_role_arn": &schema.Schema{
@@ -233,6 +229,7 @@ func resourceAwsRDSClusterInstanceRead(d *schema.ResourceData, meta interface{})
 	d.Set("instance_class", db.DBInstanceClass)
 	d.Set("identifier", db.DBInstanceIdentifier)
 	d.Set("storage_encrypted", db.StorageEncrypted)
+	d.Set("kms_key_id", db.KmsKeyId)
 	d.Set("promotion_tier", db.PromotionTier)
 
 	if db.MonitoringInterval != nil {

builtin/providers/aws/resource_aws_rds_cluster_instance_test.go

@@ -281,8 +281,6 @@ resource "aws_rds_cluster_instance" "cluster_instances" {
   cluster_identifier      = "${aws_rds_cluster.default.id}"
   instance_class          = "db.r3.large"
   db_parameter_group_name = "${aws_db_parameter_group.bar.name}"
-  storage_encrypted = true
-  kms_key_id = "${aws_kms_key.foo.arn}"
 }
 
 resource "aws_db_parameter_group" "bar" {