Manage RDS password in Terraform in a sane way

database.tf

resource "random_string" "db_master_pass" {
  length            = 40
  special           = true
  min_special       = 5
  override_special  = "!#$%^&*()-_=+[]{}<>:?"
  keepers           = {
    pass_version  = 1
  }
}

resource "aws_db_instance" "mysql_db" {
  username                            = "mysql_user"
  password                            = "${random_string.db_master_pass.result}"
  ...
}

secret.tf

resource "aws_secretsmanager_secret" "db-pass" {
  name = "db-pass-${terraform.workspace}"
}

resource "aws_secretsmanager_secret_version" "db-pass-val" {
  secret_id     = "${aws_secretsmanager_secret.db-pass.id}"
  secret_string = "${random_string.db_master_pass.result}"
}