Using provisioner for RDS password generation

postgres_instance.tf

resource "aws_db_instance" "postgres" {
  identifier = "${var.postgres_id}"
  name = "${var.postgres_name}"

  engine = "${var.postgres_engine}"
  engine_version = "${var.postgres_version}"
  multi_az = "${var.postgres_multi_az}"
  instance_class = "${var.postgres_class}"
  db_subnet_group_name = "${var.postgres_subnet_group}"

  username = "${var.postgres_username}"
  password = "temporaryPasswordOverriddenBelowOnFirstApply"
        provisioner "local-exec" {
        command = "bash -c 'DBPASS=$$(openssl rand -base64 16) && echo $${DBPASS} >> ${self.id}.passwd && aws --region ${var.provider_settings["region"]} rds modify-db-instance --db-instance-identifier ${self.id} --master-user-password $${DBPASS} --apply-immediately'"
  }

  storage_type = "${var.postgres_storage_type}"
  allocated_storage = "${var.postgres_storage_capacity}"

  vpc_security_group_ids = ["${aws_security_group.postgres_security_group.id}"]
}