Terraform resets credentials when importing existing RDS db resource

Question

We have a bunch of existing resources on AWS that we want to import under terraform managment. One of these resources is an RDS db. So we wrote something like this :

resource "aws_db_instance" "db" {
    engine   = "postgres"
    username = var.rds_username 
    password = var.rds_password
    # other stuff...
}

variable "rds_username" {
    type    = string 
    default = "master_username"
}

variable "rds_password" {
    type      = string 
    default   = "master_password"
    sensitive = true  
}

Note these are the existing master credentials. That's important. Then we did this:

terraform import aws_db_instance.db db-identifier 

And then tried terraform plan a few times, tweaking the code to fit the existing resource until finally, terraform plan indicated there were no changes to be made (which was the goal).

However, once we ran terraform apply, it reset the master credentials of the DB instance. Worse, other resources that had previously connected to that DB using these exact credentials suddenly can't anymore.

Why is this happening? Is terraform encrypting the password behind the scenes and not telling me? Why can't other services connect to the DB using the same credentials? Is there any way to import an RDS instance without resetting credentials?