#terraform-aws-modules - November 2019

Hey Guys - Quick Question --- if any one has every come across this "Is there any way we can make our S3 bucket Private and then Cloudfront provides - URL , Which can be viewed from this Private S3 Bucket" ?

Yes see our terraform module for hosting an s3 website

Oh with cloud front.. we have something for that too

I think that does what you want

(Not a github.com/terraform-aws-module though which is what this channel is for)

Hey guys, I have been using cloudposse for getting our emr cluster up, though I am able to get my cluster up in our vpc , but our autoscaling policy is unable get triggered with the error Failed to provision the AutoScaling policy: Unable to assume IAM role: arn:aws:iam::216727*****:role/emr-stage-dataorc-emr-ec2-autoscaling , though in the module <https://github.com/cloudposse/terraform-aws-emr-cluster> i can see most of the assume policy requirement given, any direction I can look up or something I am missing

Hi! I use this module https://github.com/cloudposse/terraform-aws-dynamic-subnets and can't figure out how to allow connections from public subnets to private ones (I am setting up bastion host) - what am I missing?

Make sure they are all in the same route table

Make sure your bastion’s security group permits the relative networks

have you guys run into any issues with this release of terraform-aws-vpc? https://github.com/cloudposse/terraform-aws-vpc/releases/tag/0.8.0

when we upgraded to TF 12 and applied this module it removed all of our default security group rules, which included rules to allow egress traffic

according to the docs

When Terraform first adopts the Default Security Group, it immediately removes all ingress and egress rules in the Security Group. It then proceeds to create any rules specified in the configuration. This step is required so that only the rules specified in the configuration are created.

I understand best practice is to not use the default security group, but in our case we have to because of legacy infrastructure

seems like this should have been a 1.0.0 release instead of a minor release with some documentation in the readme describing how the new version will remove any SG rules on your existing default SG

We don’t have a single 1.0 module :-)

In semver pre-1.0 has a special meaning

ahhhh okay that makes sense

The change came about because we are working to achieve compliance with CIS Benchmarks

The default group was flagged

that needs to be fixed, maybe by adding default_security_group_enabled flag

i also don’t think the way terraform implemented this is very intuitive either … this is the only case i’ve seen where they automatically import the resource and remove things from it

it’s better to specify default egress in any SG

Also, reminded me of https://aws.amazon.com/blogs/compute/update-issue-affecting-hashicorp-terraform-resource-deletions-after-the-vpc-improvements-to-aws-lambda/

But I don’t think related

agreed, in our case we had used a previous version of the module so it implicitly created the egress, so when we updated terraform removed it

Greetings people

I’m new here with a burning question on terraform <> AWS

resource "aws_kinesis_analytics_application" "app" {
  name = var.analytics_app_name
  tags = local.tags

  // TODO: need to make inputs & outputs dynamic -- cater for cases of multiple columns, e.t.c.
  //  inputs {
  //    name_prefix = ""
  //    "schema" {
  //      "record_columns" {
  //        name = ""
  //        sql_type = ""
  //      }
  //      "record_format" {}
  //    }
  //  }
  //  outputs {
  //    name = ""
  //    "schema" {}
  //  }
}

Here’s my quandary

number of columns is not fixed

(perhaps try #terraform as it doesn't seem like this is related to https://github.com/terraform-aws-modules)

Anyone have a good base module for a redshift cluster? i could have sworn cloudposse had one, but i'm not seeing it in their github

This message was deleted.