Unable to create encrypted Neptune cluster from unencrypted Neptune cluster snapshot

[kalyansundar]

I am trying to create a new encrypted Neptune cluster from an unencrypted cluster snapshot through terraform but the created cluster is not encrypted.

Expected Behavior
Neptune cluster created should be encryption enabled

Current Behavior
Created cluster is not encryption enabled

version

Terraform v0.12.29
+ provider.aws v3.7.0

Steps to Reproduce

1. code snippet:

resource "aws_neptune_cluster" "default" {
  cluster_identifier        = "name"
  apply_immediately         = true
  backup_retention_period   = 5
  engine                    = "neptune"
  engine_version            = "1.0.1.0"
  final_snapshot_identifier = "name-final"
  neptune_subnet_group_name = "neptune-subnets"
  port                      = 8182
  preferred_backup_window   = "06:25-06:55"
  skip_final_snapshot       = false
  snapshot_identifier       = "snapshot_arn"

  # Encryption
  storage_encrypted       = true
  kms_key_arn             = "KMD_key_arn"

  vpc_security_group_ids = [ "security_group_id" ]

  
}

2. terraform plan - shows storageEncrypted as true
3. terraform apply - successfully created
4. on verification in aws console the cluster shows Encryption as Not Enabled

Additional info is, looks it supporting only if the snapshot tooks from encrypted cluster only.

[FarhanKhan-sains]

Any updates on this? I deleted a cluster thinking I would be able to recreate it with encryption enabled using a snapshot but am running into this problem.

[nlaxmi]

as far as I remember, It's not possible to take a snapshot from an unencrypted cluster and try to encrypt it.

https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/neptune.html

[FarhanKhan-sains]

@nlaxmi That's to copy a snapshot though. I'm trying to create a new cluster using a snapshot. This should be possible according to the AWS docs:

https://docs.aws.amazon.com/neptune/latest/userguide/encrypt.html

[triggan]

Bubbling this back up related to another issue due to changing KMS encryption keys from a source snapshot into a cluster with a newly assigned KMS key. It appears that the KMS key value is not being accepted as part of the RestoreDBClusterFromSnapshot API call input here:

terraform-provider-aws/internal/service/neptune/cluster.go

Lines 395 to 399 in a0364dd

	if v, ok := d.GetOk("kms_key_arn"); ok {
	v := v.(string)
	inputC.KmsKeyId = aws.String(v)
	}

[github-actions]

This functionality has been released in v5.17.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.