What’s the cleanest way to manage RDS and DocumentDB users with Terraform?

Another workable pattern is a Lambda or similar one-shot execution per user. Terraform can create the secret or parameter, then invoke the function for each username. The function reads the password from the secret store and creates or updates the database account. Make the secret an explicit dependency so the user cannot be provisioned before its credential exists. This keeps Terraform in charge of orchestration while the database-specific operations remain in application code. Secrets Manager is generally preferable to Parameter Store here if you need built-in rotation workflows.

An external secrets platform such as OpenBao can also handle the credential lifecycle, but it adds another service to operate. Unless there is a broader requirement for centralized, multi-cloud secrets management, AWS Secrets Manager plus a small idempotent provisioning job is probably the simpler choice for this setup.

Keep Terraform as the source of truth for the clusters, IAM permissions, Secrets Manager, and the job execution role. Handle database users with one idempotent bootstrap or migration job that runs inside the VPC and connects to both databases. It can create or alter users, generate credentials, store them in Secrets Manager, and handle rotation without putting passwords into Terraform state. The job could run as an ECS task, CodeBuild job, Kubernetes Job, or similar. If network access requires a bastion, use SSM port forwarding rather than exposing the host, but keep the user lifecycle in the script instead of maintaining a second IaC state file.