RDS does not support Storage Encryption

[DarkenVamp]

I was practicing terraform and came across an issue where it kept rebuilding my database.
I narrowed down the cause to storage encryption, which is not supported on floci. I tried with and without explicit KMS ID.

I searched the documentation for RDS and RDS Data but couldn't find anything on encryption.

I would like to ask if this is a known caveat or is it planned or is encryption supposed to be disabled for local development?

Thanks in advance!

Example for creating instance with KMS

aws rds create-db-instance \
  --db-instance-identifier smoke-test-postgres \
  --engine postgres \
  --db-instance-class db.t3.micro \
  --allocated-storage 20 \
  --storage-type gp3 \
  --storage-encrypted \
  --kms-key-id alias/smoke-test-rds \
  --db-subnet-group-name smoke-test-private-db-subnet-group \
  --no-publicly-accessible \
  --vpc-security-group-ids sg-df6fa2840943a8508 \
  --db-name smoke-test \
  --master-username postgres \
  --master-user-password 'dummy'

And then verify Encryption Status with

aws rds describe-db-instances \
  --db-instance-identifier smoke-test-postgres \
  --query 'DBInstances[0].StorageEncrypted'

[ydsveluvolu2996]

This was a real Floci compatibility gap, and it explains Terraform repeatedly proposing replacement: older builds accepted the create inputs but DescribeDBInstances did not return StorageEncrypted or KmsKeyId, so Terraform kept detecting drift.

It was fixed in #2617 and is included in Floci 2.0.0. Upgrade to:

docker pull floci/floci:2.0.0

Newly created instances now store and return StorageEncrypted and KmsKeyId. The KMS identifier may be supplied as a key ID, key ARN, alias, or alias ARN and is returned as the resolved key ARN; specifying a KMS key requires StorageEncrypted=true.

One migration detail: an instance persisted by an older Floci version has no encryption fields, so 2.0.0 reads it with the old default (false). Let Terraform recreate that local instance once after upgrading, or start with a clean local state.

You no longer need to disable the Terraform setting merely for API-state parity. Floci models the AWS API response so IaC converges, but that metadata should not be treated as encryption of the emulator's Docker/host storage; protect that storage separately if the local data is sensitive.

[hectorvent]

@DarkenVamp is this something you can test and validate? Please let us know if something is missing.

If it is all ok, could you please resolve the conversation?

[DarkenVamp]

Thanks for the update. I migrated to 2.0.0 and can validate after testing that StorageEncrypted is being returned as the set value after recreating the local instance. Have marked the discussion as answered.