How do I use only an encrypted version of my AWS RDS password in my terraform code?
If I am understanding your question correctly, what you are describing sounds like a perfect use case for SSM. You can store your RDS password as a secure string parameter encrypted by KMS, then reference it in you terraform file as a data source with decryption. With this method, you only have to reference your decrypted password, and never directly store the encrypted or plain text in your tf file. 

data "aws_ssm_parameter" "foo" {
  name = "foo"
  with_decryption = true
}