#terraform - April 2019

* module.backend.module.service.aws_ecs_service.ignore_changes_task_definition: 1 error(s) occurred:
* aws_ecs_service.ignore_changes_task_definition: InvalidParameterException: Unable to assume role and validate the specified targetGroupArn. Please verify that the ECS service role being passed has the proper permissions.

Error: module.eks_cluster.aws_eks_cluster.this: vpc_config.0: invalid or unknown key: endpoint_private_access

Error calling startBuild: User: arn:aws:sts::607643753933:assumed-role/us-west-1-qa-backend-worker-codepipeline-assume/1554183144481 is not authorized to perform: codebuild:StartBuild on resource: arn:aws:codebuild:us-west-1:607643753933:project/us-west-1-qa-backend-worker-build (Service: AWSCodeBuild; Status Code: 400; Error Code: AccessDeniedException;

  statement {
    sid = ""
    actions = ["*"]
    resources = ["*"]
    effect    = "Allow"
  }

data "aws_iam_policy_document" "assume" {
  statement {
    sid = ""
    actions = ["*"]
    resources = ["*"]
    effect    = "Allow"
  }
}

data "aws_iam_policy_document" "codebuild" {
  statement {
    sid = ""

    actions = [
      "codebuild:*",
    ]

    resources = ["${module.build.project_id}"]
    effect    = "Allow"
  }
}

output "project_id" {
  description = "Project ID"
  value       = "${join("", aws_codebuild_project.default.*.id)}"
}

arn:aws:codebuild:us-west-1:607643753933:project/us-west-1-qa-backend-build

arn:aws:codebuild:us-west-1:607643753933:project/us-west-1-qa-backend-build

output "project_id" {
  description = "Project ID"
  value       = "${join("", aws_codebuild_project.default.*.id)}"
}

us-west-1-qa-backend-build

project_id = arn:aws:codebuild:us-west-1:607643753933:project/us-west-1-qa-backend-build
project_name = us-west-1-qa-backend-build

> replace(replace(replace(replace("m1.xlarge,c4.xlarge,c3.xlarge,c5.xlarge,t2.xlarge,r3.xlarge","/^/","{ \"InstanceType\" :\""),"/,/","\"},"),"/$/","\"}"),"/,/",",{\"InstanceType\": \"")
{ "InstanceType" :"m1.xlarge"},{"InstanceType": "c4.xlarge"},{"InstanceType": "c3.xlarge"},{"InstanceType": "c5.xlarge"},{"InstanceType": "t2.xlarge"},{"InstanceType": "r3.xlarge"}

[{ "InstanceType" :"m1.xlarge"},{"InstanceType": "c4.xlarge"},{"InstanceType": "c3.xlarge"},{"InstanceType": "c5.xlarge"},{"InstanceType": "t2.xlarge"},{"InstanceType": "r3.xlarge"}]

[{ "InstanceType" :"m1.xlarge"},{"InstanceType": "c4.xlarge"},{"InstanceType": "c3.xlarge"},{"InstanceType": "c5.xlarge"},{"InstanceType": "t2.xlarge"},{"InstanceType": "r3.xlarge"}]

1) update the vanity domain NS in GoDaddy and then create all subdomains in the same Route53 zone 2) do service discovery domain and subdomains, and then add CNAME to the vanity domain

 aws_route53_zone.root: error deleting Route53 Hosted Zone (Z1I50I6TDQ378M): HostedZoneNotEmpty

 module.backend-worker.module.cicd.module.pipeline.module.build.aws_s3_bucket.cache_bucket: aws_s3_bucket.cache_bucket: error getting S3 Bucket Object Lock configuration: RequestError: send request failed
caused by: Get <https://us-west-1-qa-backend-worker-build-dnwylutrpukx.s3.us-west-1.amazonaws.com/?object-lock=>: dial tcp: lookup <http://us-west-1-qa-backend-worker-build-dnwylutrpukx.s3.us-west-1.amazonaws.com|us-west-1-qa-backend-worker-build-dnwylutrpukx.s3.us-west-1.amazonaws.com> on 192.168.1.1:53: no such host

* module.alb.output.dns_name: 1:16: unknown variable accessed: var.domain in:

${var.stage}.${var.domain}

module "db_computed_merged_sg" {
  # omitted for brevity

  computed_ingress_cidr_blocks = ["10.10.0.0/16", "${data.aws_security_group.default.id}", "${module.vpc.vpc_id}"]
  number_of_computed_ingress_cidr_blocks = 3
}

* provider.vault: failed to create limited child token: Error making API request.

URL: POST <https://vault.abc.net/v1/auth/token/create>
Code: 403. Errors:

* 1 error occurred:

* permission denied

provider "vault" {
}

data "vault_generic_secret" "aws_auth" {
  path = "secret/project/abc/infra_secrets"
}

provider "aws" {
  access_key = "${data.vault_generic_secret.aws_auth.data["access_key"]}"
  secret_key = "${data.vault_generic_secret.aws_auth.data["secret_key"]}"
  #profile = "${var.profile}"
  #profile = "dev"
  region     = "${var.region}"
}

* provider.vault: failed to create limited child token: Error making API request.

URL: POST <https://vault.or1.net/v1/auth/token/create>
Code: 403. Errors:

* 1 error occurred:

* permission denied

helm_release.mydatabase: Couldn't load repositories file (helm/repository/repositories.yaml).