ansible/test/integration/targets/rds_instance/tasks/test_encryption.yml

---
  - block:
      - name: set up aws connection info
        set_fact:
          aws_connection_info: &aws_connection_info
            aws_access_key: "{{ aws_access_key }}"
            aws_secret_key: "{{ aws_secret_key }}"
            security_token: "{{ security_token }}"
            region: "{{ aws_region }}"
        no_log: yes

      - name: Ensure the resource doesn't exist
        rds_instance:
          id: "{{ instance_id }}"
          state: absent
          skip_final_snapshot: True
          <<: *aws_connection_info
        register: result

      - assert:
          that:
            - not result.changed
        ignore_errors: yes

      - name: Create a mariadb instance
        rds_instance:
          id: "{{ instance_id }}"
          state: present
          engine: mariadb
          username: "{{ username }}"
          password: "{{ password }}"
          db_instance_class: "{{ storage_encrypted_db_instance_class }}"
          allocated_storage: "{{ allocated_storage }}"
          storage_encrypted: True
          <<: *aws_connection_info
        register: result

      - assert:
          that:
            - result.changed
            - "result.db_instance_identifier == '{{ instance_id }}'"
            - result.kms_key_id
            - result.storage_encrypted == true

    always:

      - name: Delete DB instance
        rds_instance:
          id: "{{ instance_id }}"
          state: absent
          skip_final_snapshot: True
          <<: *aws_connection_info
        register: result