Latest version of AWS provider 6.43.0 resource aws_db_instance not honoring character_set_name for Microsoft SQL RDS

[vinayaksakharkar]

Terraform and AWS Provider Version

- Installing hashicorp/aws v6.43.0...
- Installed hashicorp/aws v6.43.0 (signed by HashiCorp)

Terraform v1.13.4

Affected Resource(s) or Data Source(s)

aws_db_instance

Expected Behavior

I am passing character_set_name = Latin1_General_BIN

Actual Behavior

It creating with SQL_Latin1_General_CP1_CI_AS . We tried directly from console everything works fine. Additional information I am trying to create developer edition of RDS with custom CVE

Relevant Error/Panic Output

  + resource "aws_db_instance" "db" {
      + address                               = (known after apply)
      + allocated_storage                     = 700
      + allow_major_version_upgrade           = false
      + apply_immediately                     = true
      + arn                                   = (known after apply)
      + auto_minor_version_upgrade            = true
      + availability_zone                     = (known after apply)
      + backup_retention_period               = 30
      + backup_target                         = (known after apply)
      + backup_window                         = "02:00-03:00"
      + ca_cert_identifier                    = (known after apply)
      + character_set_name                    = (known after apply)
      + copy_tags_to_snapshot                 = false
      + database_insights_mode                = (known after apply)
      + db_name                               = (known after apply)
      + db_subnet_group_name                  = "dev-vpc"
      + dedicated_log_volume                  = false
      + delete_automated_backups              = true
      + deletion_protection                   = false
      + domain                                = "intentional deleted"
      + domain_fqdn                           = (known after apply)
      + domain_iam_role_name                  = "intentional deleted"
      + enabled_cloudwatch_logs_exports       = [
          + "agent",
          + "error",
        ]
      + endpoint                              = (known after apply)
      + engine                                = "sqlserver-dev-ee"
      + engine_lifecycle_support              = (known after apply)
      + engine_version                        = "16.00.4215.2.<intentional deleted>-developer-edition-cu21"
      + engine_version_actual                 = (known after apply)
      + final_snapshot_identifier             = "intentional deleted"
      + hosted_zone_id                        = (known after apply)
      + id                                    = (known after apply)
      + identifier                            = "intentional deleted"
      + identifier_prefix                     = (known after apply)
      + instance_class                        = "db.r6i.2xlarge"
      + iops                                  = 8000
      + kms_key_id                            = "intentional deleted"
      + latest_restorable_time                = (known after apply)
      + license_model                         = "bring-your-own-license"
      + listener_endpoint                     = (known after apply)
      + maintenance_window                    = "sun:03:30-sun:04:30"
      + master_user_secret                    = (known after apply)
      + master_user_secret_kms_key_id         = (known after apply)
      + max_allocated_storage                 = 900
      + monitoring_interval                   = 60
      + monitoring_role_arn                   = "intentional deleted"
      + multi_az                              = false
      + nchar_character_set_name              = (known after apply)
      + network_type                          = (known after apply)
      + option_group_name                     = "intentional deleted"
      + parameter_group_name                  = "intentional deleted"
      + password                              = (sensitive value)
      + password_wo                           = (write-only attribute)
      + performance_insights_enabled          = true
      + performance_insights_kms_key_id       = "intentional deleted"
      + performance_insights_retention_period = 7
      + port                                  = 1433
      + publicly_accessible                   = false
      + region                                = "us-east-1"
      + replica_mode                          = (known after apply)
      + replicas                              = (known after apply)
      + resource_id                           = (known after apply)
      + skip_final_snapshot                   = false
      + snapshot_identifier                   = (known after apply)
      + status                                = (known after apply)
      + storage_encrypted                     = true
      + storage_throughput                    = 500
      + storage_type                          = "gp3"
      + tags                                  = {
               intentional deleted
        }
      + tags_all                              = (known after apply)
      + timezone                              = (known after apply)
      + upgrade_rollout_order                 = (known after apply)
      + username                              = "intentional deleted"
      + vpc_security_group_ids                = [
          + "intentional deleted",
          + "intentional deleted",
        ]
      + timeouts {
          + create = "2h"
          + delete = "2h"
        }
    }

Sample Terraform Configuration

Click to expand configuration

  + resource "aws_db_instance" "db" {
      + address                               = (known after apply)
      + allocated_storage                     = 700
      + allow_major_version_upgrade           = false
      + apply_immediately                     = true
      + arn                                   = (known after apply)
      + auto_minor_version_upgrade            = true
      + availability_zone                     = (known after apply)
      + backup_retention_period               = 30
      + backup_target                         = (known after apply)
      + backup_window                         = "02:00-03:00"
      + ca_cert_identifier                    = (known after apply)
      + character_set_name                    = (known after apply)
      + copy_tags_to_snapshot                 = false
      + database_insights_mode                = (known after apply)
      + db_name                               = (known after apply)
      + db_subnet_group_name                  = "dev-vpc"
      + dedicated_log_volume                  = false
      + delete_automated_backups              = true
      + deletion_protection                   = false
      + domain                                = "intentional deleted"
      + domain_fqdn                           = (known after apply)
      + domain_iam_role_name                  = "intentional deleted"
      + enabled_cloudwatch_logs_exports       = [
          + "agent",
          + "error",
        ]
      + endpoint                              = (known after apply)
      + engine                                = "sqlserver-dev-ee"
      + engine_lifecycle_support              = (known after apply)
      + engine_version                        = "16.00.4215.2.<intentional deleted>-developer-edition-cu21"
      + engine_version_actual                 = (known after apply)
      + final_snapshot_identifier             = "intentional deleted"
      + hosted_zone_id                        = (known after apply)
      + id                                    = (known after apply)
      + identifier                            = "intentional deleted"
      + identifier_prefix                     = (known after apply)
      + instance_class                        = "db.r6i.2xlarge"
      + iops                                  = 8000
      + kms_key_id                            = "intentional deleted"
      + latest_restorable_time                = (known after apply)
      + license_model                         = "bring-your-own-license"
      + listener_endpoint                     = (known after apply)
      + maintenance_window                    = "sun:03:30-sun:04:30"
      + master_user_secret                    = (known after apply)
      + master_user_secret_kms_key_id         = (known after apply)
      + max_allocated_storage                 = 900
      + monitoring_interval                   = 60
      + monitoring_role_arn                   = "intentional deleted"
      + multi_az                              = false
      + nchar_character_set_name              = (known after apply)
      + network_type                          = (known after apply)
      + option_group_name                     = "intentional deleted"
      + parameter_group_name                  = "intentional deleted"
      + password                              = (sensitive value)
      + password_wo                           = (write-only attribute)
      + performance_insights_enabled          = true
      + performance_insights_kms_key_id       = "intentional deleted"
      + performance_insights_retention_period = 7
      + port                                  = 1433
      + publicly_accessible                   = false
      + region                                = "us-east-1"
      + replica_mode                          = (known after apply)
      + replicas                              = (known after apply)
      + resource_id                           = (known after apply)
      + skip_final_snapshot                   = false
      + snapshot_identifier                   = (known after apply)
      + status                                = (known after apply)
      + storage_encrypted                     = true
      + storage_throughput                    = 500
      + storage_type                          = "gp3"
      + tags                                  = {
               intentional deleted
        }
      + tags_all                              = (known after apply)
      + timezone                              = (known after apply)
      + upgrade_rollout_order                 = (known after apply)
      + username                              = "intentional deleted"
      + vpc_security_group_ids                = [
          + "intentional deleted",
          + "intentional deleted",
        ]
      + timeouts {
          + create = "2h"
          + delete = "2h"
        }
    }

Steps to Reproduce

below is the terraform plan for RDS Microsoft SQL RDS developer edition

  + resource "aws_db_instance" "db" {
      + address                               = (known after apply)
      + allocated_storage                     = 700
      + allow_major_version_upgrade           = false
      + apply_immediately                     = true
      + arn                                   = (known after apply)
      + auto_minor_version_upgrade            = true
      + availability_zone                     = (known after apply)
      + backup_retention_period               = 30
      + backup_target                         = (known after apply)
      + backup_window                         = "02:00-03:00"
      + ca_cert_identifier                    = (known after apply)
      + character_set_name                    = (known after apply)
      + copy_tags_to_snapshot                 = false
      + database_insights_mode                = (known after apply)
      + db_name                               = (known after apply)
      + db_subnet_group_name                  = "dev-vpc"
      + dedicated_log_volume                  = false
      + delete_automated_backups              = true
      + deletion_protection                   = false
      + domain                                = "intentional deleted"
      + domain_fqdn                           = (known after apply)
      + domain_iam_role_name                  = "intentional deleted"
      + enabled_cloudwatch_logs_exports       = [
          + "agent",
          + "error",
        ]
      + endpoint                              = (known after apply)
      + engine                                = "sqlserver-dev-ee"
      + engine_lifecycle_support              = (known after apply)
      + engine_version                        = "16.00.4215.2.<intentional deleted>-developer-edition-cu21"
      + engine_version_actual                 = (known after apply)
      + final_snapshot_identifier             = "intentional deleted"
      + hosted_zone_id                        = (known after apply)
      + id                                    = (known after apply)
      + identifier                            = "intentional deleted"
      + identifier_prefix                     = (known after apply)
      + instance_class                        = "db.r6i.2xlarge"
      + iops                                  = 8000
      + kms_key_id                            = "intentional deleted"
      + latest_restorable_time                = (known after apply)
      + license_model                         = "bring-your-own-license"
      + listener_endpoint                     = (known after apply)
      + maintenance_window                    = "sun:03:30-sun:04:30"
      + master_user_secret                    = (known after apply)
      + master_user_secret_kms_key_id         = (known after apply)
      + max_allocated_storage                 = 900
      + monitoring_interval                   = 60
      + monitoring_role_arn                   = "intentional deleted"
      + multi_az                              = false
      + nchar_character_set_name              = (known after apply)
      + network_type                          = (known after apply)
      + option_group_name                     = "intentional deleted"
      + parameter_group_name                  = "intentional deleted"
      + password                              = (sensitive value)
      + password_wo                           = (write-only attribute)
      + performance_insights_enabled          = true
      + performance_insights_kms_key_id       = "intentional deleted"
      + performance_insights_retention_period = 7
      + port                                  = 1433
      + publicly_accessible                   = false
      + region                                = "us-east-1"
      + replica_mode                          = (known after apply)
      + replicas                              = (known after apply)
      + resource_id                           = (known after apply)
      + skip_final_snapshot                   = false
      + snapshot_identifier                   = (known after apply)
      + status                                = (known after apply)
      + storage_encrypted                     = true
      + storage_throughput                    = 500
      + storage_type                          = "gp3"
      + tags                                  = {
               intentional deleted
        }
      + tags_all                              = (known after apply)
      + timezone                              = (known after apply)
      + upgrade_rollout_order                 = (known after apply)
      + username                              = "intentional deleted"
      + vpc_security_group_ids                = [
          + "intentional deleted",
          + "intentional deleted",
        ]
      + timeouts {
          + create = "2h"
          + delete = "2h"
        }
    }

Debug Logging

Click to expand log output

GenAI / LLM Assisted Development

n/a

Important Facts and References

No response

Would you like to implement a fix?

No

[github-actions]

Community Guidelines

This comment is added to every new Issue to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Issue and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.
• For new resources and data sources, use skaff to generate scaffolding with comments detailing common expectations.

[dosubot]

Hey @vinayaksakharkar 👋 Thank you for taking the time to raise this!

I looked into how character_set_name is handled in the provider code. The provider does pass character_set_name directly to the AWS CreateDBInstance API without any engine-specific filtering [1], and Latin1_General_BIN is listed as a supported collation for SQL Server in AWS RDS. So the provider is sending the value you specified — the question is why AWS is silently falling back to the default SQL_Latin1_General_CP1_CI_AS.

A couple of things that would help with investigation:

1. Your Terraform plan shows character_set_name = (known after apply) rather than character_set_name = "Latin1_General_BIN". This strongly suggests the attribute isn't actually being set in your configuration. Could you double-check that character_set_name is explicitly defined in your .tf file (not just in the plan output you shared)?

2. If it is set in your config, please enable debug logging (TF_LOG=DEBUG) and re-run the apply. This will show the exact API request being sent to AWS and confirm whether CharacterSetName is included.

3. You can also verify the actual state of the created instance via CLI:

   aws rds describe-db-instances --db-instance-identifier <your-instance> --query 'DBInstances[0].CharacterSetName'

The fact that the plan shows (known after apply) for character_set_name is the key clue here — it typically means the attribute is not being set in the configuration, so Terraform isn't sending it to the API and is instead deferring to whatever value AWS returns after creation. Please confirm your HCL configuration actually includes character_set_name = "Latin1_General_BIN" as a direct attribute assignment.

Written by @dosu, approved by justinretzolk

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.