MasterUserSecret field missing in describe-db-instances API - amazon-web-services

Question

I have created the database with ManageMasterUserPassword=True. But I couldn't get the Secret Arn from the describe-db-instances command.
aws rds describe-db-instances --db-instance-identifier database-1 --query DBInstances[*].[MasterUsername,MasterUserSecret]
[
[
"postgres",
null
]
]
I have created the database even from console,
Still I am facing the same error.
But I can clearly see the database ARN in SecretsManager and Secrets ARN in database.

Answer 1

Make sure you have more recent awscli, the support for this feature was added in 2.9.10:
https://raw.githubusercontent.com/aws/aws-cli/v2/CHANGELOG.rst
2.9.10
...
* api-change:``rds``: Add support for managing master user password in AWS Secrets Manager for the DBInstance and DBCluster.
...
With this, the output (only when the feature is enabled on the db instance) will contain:
$ aws rds describe-db-instances --db-instance-identifier database-1 --region=us-east-1
...
"MasterUserSecret": {
"SecretArn": "arn:aws:secretsmanager:us-east-1:776665554444:secret:rds!db-88888888-82e1-4a59-8c35-888888888888-SyXcpL",
"SecretStatus": "active",
"KmsKeyId": "arn:aws:kms:us-east-1:888888888888:key/88888888-c6c4-43da-a4a4-888888888888"
},
You can get the actual values with (for example):
$ secret_arn=$(aws rds describe-db-instances --db-instance-identifier database-1 --region=us-east-1 --query DBInstances[*].[MasterUserSecret.SecretArn] --output text)
$ aws secretsmanager get-secret-value --secret-id ${secret_arn} --region us-east-1 --query SecretString --output text
{"username":"admin","password":"SVxxxxxxxxxxxxxxxxxxxxxxxY7gwkD"}