1. Sign in to the AWS Management Console: Go to the AWS Management Console (https://aws.amazon.com/console/) and sign in using your credentials.
2. Navigate to RDS Service: Click on the “Services” dropdown menu at the top of the page and select “RDS” under the Database section.
3. Select the RDS Instance: From the list of RDS instances, select the instance for which you want to change the master username.
4. Modify the Master Username: In the RDS dashboard, locate the “Configuration” section and click on the “Modify” button.
5. Change the Master Username: In the Modify DB Instance window, scroll down to the “Master Username” field and enter a unique username that you want to set as the new master username.
6. Apply the Changes: Scroll down to the bottom of the page and click on the “Continue” button.
7. Review and Apply Changes: Review the changes you are about to make and click on the “Modify DB Instance” button to apply the changes.
8. Monitor the Modification: The modification process may take a few minutes to complete. You can monitor the progress in the RDS console.
9. Verify the Changes: Once the modification is complete, verify that the master username has been successfully changed to a unique username.

​

1. Identify the RDS Instance: First, identify the RDS instance for which you need to change the master username. You can list all your RDS instances using the following AWS CLI command:
   aws rds describe-db-instances
   
2. Modify the Master Username: Once you have identified the RDS instance, you can modify the master username using the modify-db-instance command. Replace your-db-instance-identifier with the actual DB instance identifier and new-master-username with the unique username you want to set:
   aws rds modify-db-instance --db-instance-identifier your-db-instance-identifier --master-user-password your-new-master-username
   
3. Wait for the Modification to Complete: The modification process may take some time to complete. You can check the status of the modification using the describe-db-instances command:
   aws rds describe-db-instances --db-instance-identifier your-db-instance-identifier --query "DBInstances[*].DBInstanceStatus"
   
4. Verify the Changes: Once the modification is complete, verify that the master username has been successfully updated by describing the DB instance:
   aws rds describe-db-instances --db-instance-identifier your-db-instance-identifier --query "DBInstances[*].MasterUsername"
   

1. Use the AWS SDK for Python (Boto3) to interact with AWS services programmatically. Make sure you have the Boto3 library installed in your Python environment.
2. Write a Python script that does the following: a. Import the necessary libraries:
   import boto3
   
   b. Initialize the RDS client:
   rds_client = boto3.client('rds', region_name='your_region')
   
   c. List all existing RDS instances:
   response = rds_client.describe_db_instances()
   
   d. Check if the master username is unique:
   master_username = 'your_desired_master_username'
   existing_usernames = [instance['MasterUsername'] for instance in response['DBInstances']]
   
   if master_username in existing_usernames:
       print(f"Master username '{master_username}' is already in use. Please choose a different username.")
       # You can either prompt the user to enter a new unique username or generate a unique username programmatically
   else:
       print(f"Master username '{master_username}' is unique.")
   
3. Run the Python script to check if the master username is unique. If it’s not unique, prompt the user to enter a new unique username or generate a unique username programmatically.
4. If the user enters a new unique username, update the master username for the RDS instance using the modify_db_instance method:
   rds_client.modify_db_instance(
       DBInstanceIdentifier='your_db_instance_id',
       MasterUsername='your_new_master_username',
       ApplyImmediately=True
   )
   
5. Verify that the master username has been successfully updated by describing the RDS instance again and checking the master username.

# Existing DB instance (already in your configuration)
resource "aws_db_instance" "existing" {
  identifier = "EXISTING_DB_INSTANCE_IDENTIFIER" # replace with your current DB instance identifier

  # ... all your existing settings (engine, instance_class, subnet_group, etc.) ...

  # Ensure you are NOT hard-coding a weak/standard master username like "admin" or "awsuser"
  # This resource represents the current state and will eventually be removed.
}

# 1) Create a snapshot of the current DB instance (backup before change)
resource "aws_db_snapshot" "username_change" {
  db_instance_identifier = aws_db_instance.existing.id
  db_snapshot_identifier = "${aws_db_instance.existing.identifier}-username-change-snapshot"
}

# 2) Restore a NEW DB instance from the snapshot with a NEW master username and password
resource "aws_db_instance" "replacement" {
  identifier          = "${aws_db_instance.existing.identifier}-new"
  snapshot_identifier = aws_db_snapshot.username_change.id

  # New secure, unique master username and password
  username = "NEW_UNIQUE_ALPHANUMERIC_MASTER_USERNAME"  # replace with your new unique username
  password = "NEW_STRONG_MASTER_PASSWORD"               # replace with a strong password

  # Copy critical settings from the existing instance so behavior matches
  instance_class          = aws_db_instance.existing.instance_class
  db_subnet_group_name    = aws_db_instance.existing.db_subnet_group_name
  vpc_security_group_ids  = aws_db_instance.existing.vpc_security_group_ids
  publicly_accessible     = aws_db_instance.existing.publicly_accessible
  multi_az                = aws_db_instance.existing.multi_az
  storage_type            = aws_db_instance.existing.storage_type
  allocated_storage       = aws_db_instance.existing.allocated_storage
  engine                  = aws_db_instance.existing.engine
  engine_version          = aws_db_instance.existing.engine_version
  parameter_group_name    = aws_db_instance.existing.parameter_group_name
  option_group_name       = aws_db_instance.existing.option_group_name
  backup_retention_period = aws_db_instance.existing.backup_retention_period

  # Ensure deletion protection and maintenance options are set as desired
  deletion_protection = false

  depends_on = [aws_db_snapshot.username_change]
}

# 3) After thoroughly testing aws_db_instance.replacement and updating ALL applications
#    to use its NEW endpoint, delete the original instance.
#    This is IRREVERSIBLE, though a final snapshot will be created.
resource "aws_db_instance" "existing_to_delete" {
  identifier = aws_db_instance.existing.identifier

  # Use the same arguments as aws_db_instance.existing (or move that block here),
  # but configure it to be deleted with a final snapshot.
  # Terraform will destroy this resource on apply.

  # ... copy all the same settings as in aws_db_instance.existing ...

  deletion_protection       = false
  skip_final_snapshot       = false
  final_snapshot_identifier = "${aws_db_instance.existing.identifier}-final-snapshot"

  lifecycle {
    prevent_destroy = false
  }
}

• aws_db_snapshot.username_change: + create
• aws_db_instance.replacement: + create (new instance with the new master username)
• Once you keep only aws_db_instance.replacement and the deletion-configured block for the old instance, the plan should show the old aws_db_instance scheduled for - destroy with a final snapshot.