[Enhancement]: Support Amazon Timestream for InfluxDB CMK `kms_key_id`

Description

Amazon Timestream for InfluxDB now supports encrypting data at rest with an AWS KMS customer managed key CMK , announced GA on 2026-08-20. The AWS API accepts a KmsKeyId on both CreateDbInstance and CreateDbCluster, and returns the resolved key ARN on the corresponding describe calls. The key is chosen at creation only and cannot be changed afterward (there is no modify path).

The Terraform AWS provider does not currently expose this. aws_timestreaminfluxdb_db_instance and aws_timestreaminfluxdb_db_cluster have no KMS argument, so instances and clusters created through Terraform always fall back to the AWS owned default key, with no way to specify a customer managed key.

This is Timestream for InfluxDB (timestreaminfluxdb), which is distinct from Timestream for LiveAnalytics (timestreamwrite). aws_timestreamwrite_database already exposes kms_key_id; the InfluxDB resources do not.

A few things about how AWS behaves, which shape the request:

• You can only choose the key when the database is first created. AWS does not let you change it afterward.
  • Changing the key to a different one (or adding a key where there was none) will replace the database (destroy and recreate), since recreating is the only way to end up on a different key.
  • Removing the kms_key_id line after it was set does nothing: the database keeps the key it was created with. Terraform will not try to "unset" it, because AWS provides no way to do that.
  • AWS confirms the create-only behavior in the encryption docs for InfluxDB 2 and InfluxDB 3.
• If you do not set a key, nothing changes from today. AWS keeps using its own key.
• This applies to InfluxDB 2 databases and to both InfluxDB 2 and InfluxDB 3 clusters.

Affected Resource(s) or Data Source(s)

• aws_timestreaminfluxdb_db_cluster
• aws_timestreaminfluxdb_db_instance

Potential Terraform Configuration

resource "aws_kms_key" "example" {
  description             = "CMK for Timestream for InfluxDB encryption at rest"
  deletion_window_in_days = 7
}

resource "aws_timestreaminfluxdb_db_instance" "example" {
  allocated_storage      = 20
  bucket                 = "example-bucket-name"
  db_instance_type       = "db.influx.medium"
  username               = "admin"
  password               = "example-password"
  organization           = "organization"
  name                   = "example-db-instance"
  vpc_subnet_ids         = [aws_subnet.example_1.id, aws_subnet.example_2.id]
  vpc_security_group_ids = [aws_security_group.example.id]

  # Proposed setting:
  kms_key_id = aws_kms_key.example.arn
}

resource "aws_timestreaminfluxdb_db_cluster" "example" {
  allocated_storage      = 20
  bucket                 = "example-bucket-name"
  db_instance_type       = "db.influx.medium"
  failover_mode          = "AUTOMATIC"
  username               = "admin"
  password               = "example-password"
  organization           = "organization"
  name                   = "example-db-cluster"
  vpc_subnet_ids         = [aws_subnet.example_1.id, aws_subnet.example_2.id]
  vpc_security_group_ids = [aws_security_group.example.id]

  # Proposed setting:
  kms_key_id = aws_kms_key.example.arn
}

References

• Announcement: Amazon Timestream for InfluxDB now supports customer managed keys (2026-08-20): https://aws.amazon.com/about-aws/whats-new/2026/08/amazon-timestream-influxdb-cmk/
• CMK encryption (InfluxDB 2): https://docs.aws.amazon.com/timestream/latest/developerguide/influxdb2-cmk-encryption.html
• CMK encryption (InfluxDB 3): https://docs.aws.amazon.com/timestream/latest/developerguide/influxdb3-cmk-encryption.html
• AWS SDK for Go v2 service/timestreaminfluxdb v1.23.0 changelog (adds KmsKeyId): https://github.com/aws/aws-sdk-go-v2/blob/main/service/timestreaminfluxdb/CHANGELOG.md
• Related (sibling feature in the same service, not a duplicate): #49393 (backup and restore support)

Would you like to implement the enhancement?

Yes