title: AWS RDS Stack update always replaces the DB Cluster
body: <p>I first restored an Aurora RDS Cluster using a cluster snapshot with a cloud formation template. Then removed the snapshot identifier, updated the password and performed a stack update keeping everything else unchanged in the CFT. But stack always prints the </p>
  
  <blockquote>
    <p>Requested update requires the creation of a new physical resource;
    hence creating one.</p>
  </blockquote>
  
  <p>message and start creating a new cluster. Here is my CFT for the cluster.</p>
  
  <pre><code>"DatabaseCluster": {
    "Type": "AWS::RDS::DBCluster",
    "DeletionPolicy": "Snapshot",
    "Properties": {
      "BackupRetentionPeriod": {
        "Ref": "BackupRetentionPeriod"
      },
      "Engine": "aurora-postgresql",
      "EngineVersion": {
        "Ref": "EngineVersion"
      },
      "Port": {
        "Ref": "Port"
      },
      "MasterUsername": {
        "Fn::If" : [
          "isUseDBSnapshot",
          {"Ref" : "AWS::NoValue"},
          {"Ref" : "MasterUsername"}
        ]
      },
      "MasterUserPassword": {
        "Fn::If" : [
          "isUseDBSnapshot",
          {"Ref" : "AWS::NoValue"},
          {"Ref" : "MasterPassword"}
        ]
      },
      "DatabaseName": {
        "Fn::If" : [
          "isUseDBSnapshot",
          {"Ref" : "AWS::NoValue"},
          {"Ref" : "DBName"}
        ]
      },
      "SnapshotIdentifier" : {
        "Fn::If" : [
          "isUseDBSnapshot",
          {"Ref" : "SnapshotIdentifier"},
          {"Ref" : "AWS::NoValue"}
        ]
      },
      "PreferredBackupWindow": "01:00-02:00",
      "PreferredMaintenanceWindow": "mon:03:00-mon:04:00",
      "DBSubnetGroupName": {"Ref":"rdsDbSubnetGroup"},
      "StorageEncrypted":{"Ref" : "StorageEncrypted"},
      "DBClusterParameterGroupName": {"Ref" : "RDSDBClusterParameterGroup"},
      "VpcSecurityGroupIds": [{"Ref" : "CommonSGId"}]
    }
  }
  </code></pre>
  
  <p>According to the <a href="https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-rds-dbcluster.html#cfn-rds-dbcluster-masteruserpassword" rel="nofollow noreferrer">AWS RDS CFT doc</a> MasterUserPassword update doesn't need a cluster replacement. </p>
  
  <p>Is there anything wrong with my CFT or is this an issue with AWS?</p>