title: Terraform RDS Instance monitoring_role_arn does not work
body: <p>I am trying to create an <strong>AWS RDS DB</strong> instance using <strong>Terraform</strong>. I'm trying to use <strong>PostgreSQL 12</strong> as the DB. Everything seems okay except for the monitoring part where I am unable to specify the '<strong>monitoring_role_arn</strong>' in the script.</p>
  <p>The following is my Terraform script for creating the PostgreSQL DB instance:</p>
  <p><strong>rds.tf</strong></p>
  <pre><code># AWS PSQL RDS Instance 
  resource &quot;aws_db_instance&quot; &quot;test-DB&quot; {
  
    depends_on = [aws_security_group.test-PSQL-DB-SG, aws_iam_role.test-IAM-Role-RDS]
  
    // General Configurations
    name                 = &quot;testdb&quot;
    identifier = &quot;am-poc-spoke1-db&quot;
    engine               = &quot;postgres&quot;
    engine_version       = &quot;12.5&quot;
    instance_class       = &quot;db.t2.micro&quot; 
    parameter_group_name = &quot;default.postgres12&quot;
    port = &quot;5432&quot;
  
    // Authentication
    username             = &quot;postgres&quot;
    password             = &quot;postgres&quot;
  
    // Storage Configurations
    storage_type = &quot;gp2&quot;
    allocated_storage    = 20
    max_allocated_storage = 100
  
    // Networking and Security 
    vpc_security_group_ids = [aws_security_group.test-PSQL-DB-SG.id]
    availability_zone = &quot;ap-southeast-1a&quot;
    publicly_accessible = false
  
    // Backup Configuration
    backup_retention_period = 7
    backup_window = &quot;16:00-16:30&quot;
    copy_tags_to_snapshot = true
  
    // Monitoring and Performance Insight
    performance_insights_enabled = true
    performance_insights_retention_period = 7
  
    monitoring_interval = &quot;60&quot;
    monitoring_role_arn = aws_iam_role.test-IAM-Role-RDS.arn
    enabled_cloudwatch_logs_exports = [&quot;postgresql&quot;]
  
    // Other Configurations
    auto_minor_version_upgrade = false
    deletion_protection = false
    skip_final_snapshot = true
  
    tags = {
      Name = &quot;test-DB&quot;
    }
  }
  </code></pre>
  <p>Since 'monitoring_role_arn' requires an AWS IAM Role with 'AmazonRDSEnhancedMonitoringRole' policy, I had created a script for that as well.</p>
  <p><strong>iam-role.tf</strong></p>
  <pre><code># IAM Role for RDS Enhanced Monitoring
  resource &quot;aws_iam_role&quot; &quot;test-IAM-Role-RDS&quot; {
  
    name = &quot;test-IAM-Role-RDS&quot;
    assume_role_policy = jsonencode({
      Version = &quot;2012-10-17&quot;
      Statement = [
        {
          Action = &quot;sts:AssumeRole&quot;
          Effect = &quot;Allow&quot;
          Sid    = &quot;&quot;
          Principal = {
            Service = &quot;ec2.amazonaws.com&quot;
          }
        },
      ]
    })
  
    tags = {
      Name = &quot;test-IAM-Role-RDS&quot;
    }
  }
  </code></pre>
  <p>Then the policy to add to the IAM Role.</p>
  <p><strong>iam-role-policy.tf</strong></p>
  <pre><code># IAM Role Policy for RDS Enhanced Monitoring
  resource &quot;aws_iam_role_policy&quot; &quot;test-Enhanced-Monitoring-Policy&quot; {
  
    depends_on = [aws_iam_role.test-IAM-Role-RDS]
  
    name = &quot;test-Enhanced-Monitoring-Policy&quot;
    role = aws_iam_role.test-IAM-Role-RDS.id
  
    policy = jsonencode({
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [{
              &quot;Sid&quot;: &quot;EnableCreationAndManagementOfRDSCloudwatchLogGroups&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;logs:CreateLogGroup&quot;,
                  &quot;logs:PutRetentionPolicy&quot;
              ],
              &quot;Resource&quot;: [
                  &quot;arn:aws:logs:*:*:log-group:RDS*&quot;
              ]
          },
          {
              &quot;Sid&quot;: &quot;EnableCreationAndManagementOfRDSCloudwatchLogStreams&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;logs:CreateLogStream&quot;,
                  &quot;logs:PutLogEvents&quot;,
                  &quot;logs:DescribeLogStreams&quot;,
                  &quot;logs:GetLogEvents&quot;
              ],
              &quot;Resource&quot;: [
                  &quot;arn:aws:logs:*:*:log-group:RDS*:log-stream:*&quot;
              ]
          }
      ]
    })
  }
  </code></pre>
  <p>When running <code>'terraform plan'</code> no errors are show. But once I run <code>'terraform apply'</code>, I am getting the following error.</p>
  <blockquote>
  <p><strong>Error: Error creating DB Instance: InvalidParameterValue: IAM role ARN value is invalid or does not include the required permissions for:
  ENHANCED_MONITORING │       status code: 400, request id:
  59e6127d-f39a-453d-885a-868e38415fc1, {</strong></p>
  </blockquote>
  <p>Does anyone now how to fix this?</p>