#terraform - August 2019

connection {
    type     = "winrm"
    host     = "${aws_instance.ec2instance.*.private_ip[count.index]}"
    user     = "${var.username}"
    password = "${var.admin_password}"
    timeout  = "${var.timeout_tf}"
  }

The "count" value depends on resource attributes that cannot be determined

# Verify that the count matches the list
resource "null_resource" "verify_list_count" {
  provisioner "local-exec" {
    command = <<SH
if [ ${var.topic_arns_count} -ne ${length(var.topic_arns)} ]; then
  echo "var.topic_arns_count must match the actual length of var.topic_arns";
  exit 1;
fi
SH
  }

Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

👉️ Register for Webinar

#office-hours (our channel)

Resource EC2 {
count = variable

connection 
type     = "winrm"
host     = "${self.private_ip}"
user     = "${var.username}"
password = "${var.admin_password}"
timeout  = "${var.timeout_tf}"

provisioner remote-exec inline
    1. powershell.exe rename-computer -Machine is rebooted once this is run.
provisioner remote-exec inline
    2. powershell copy platform code from s3 bucket
    3. powershell.exe run DomainAdd.ps1 - Machine is rebooted once this is run.
provisioner remote-exec inline
    4. powershell.exe run PreDeploy.ps1 (DSC script)
}

aws_instance.ec2instance[1]: Still creating... [7m0s elapsed]
aws_instance.ec2instance[0]: Still creating... [7m0s elapsed]
aws_instance.ec2instance[1]: Still creating... [7m10s elapsed]
aws_instance.ec2instance[0]: Still creating... [7m10s elapsed]
aws_instance.ec2instance[0]: Still creating... [7m20s elapsed]
aws_instance.ec2instance[1]: Still creating... [7m20s elapsed]
aws_instance.ec2instance[1]: Still creating... [7m30s elapsed]
aws_instance.ec2instance[0]: Still creating... [7m30s elapsed]
aws_instance.ec2instance[0]: Still creating... [7m40s elapsed]
aws_instance.ec2instance[1]: Still creating... [7m40s elapsed]
aws_instance.ec2instance[1]: Still creating... [7m50s elapsed]

variable "controller_name" {
        type    = "list"
        default = [{
        z1      = ["EKS-controller1"]
        z2      = []
        z3      = ["EKS-controller1","EKS-controller2"]
        z4      = []
        }]
}

# Resource 1
tags = merge(
    var.tags,
    map(
      "Name", format("dev-bastion-0%s.${var.domain}",count.index+1),
      "type", "bastion"
    )
  )

# Resource 2

tags = merge(
    var.tags,
    map(
      "Name", format("dev-app-0%s.${var.domain}",count.index+1),
      "type", "app"
    )
  )

data "aws_iam_policy_document" "s3_full_access" {
    statement {
      sid       = "FullAccess"
      effect    = "Allow"
      resources = [
        "arn:aws:s3:::${module.static-app.s3_bucket}",
        "arn:aws:s3:::${module.static-app.s3_bucket}/*"
      ]

      actions = [
        "s3:PutObject",
        "s3:PutObjectAcl",
        "s3:GetObject",
        "s3:DeleteObject",
        "s3:ListBucket",
        "s3:ListBucketVersions",
        "s3:ListBucketMultipartUploads",
        "s3:GetBucketLocation",
        "s3:AbortMultipartUpload",
      ]
    }
  }

  module "s3-write-role" {
    source     = "git::<https://github.com/cloudposse/terraform-aws-iam-role.git?ref=0.4.0>"

    enabled    = "true"
    namespace = "${var.namespace}"
    stage     = "${var.stage}"
    name      = "${var.name}"

    policy_description = "Allow S3 FullAccess"
    role_description   = "IAM role with permissions to perform actions on S3 resources"

    policy_documents = ["${data.aws_iam_policy_document.s3_full_access.json}"]
  }

Error: Incorrect attribute value type

  on .terraform/modules/s3-write-role.aggregated_assume_policy/main.tf line 23, in data "aws_iam_policy_document" "zero":
  23:   override_json = "${element(local.policies, 0)}"

Inappropriate value for attribute "override_json": string required.

provider "aws" {
  region = "${var.region}"
}

module "static-app" {
  source                   = "git::<https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn.git?ref=0.10.0>"
  namespace                = "${var.namespace}"
  stage                    = "${var.stage}"
  name                     = "${var.name}"
  aliases                  = "${var.aliases}"
  parent_zone_name         = "${var.parent_zone_name}"
  default_root_object      = "${var.default_root_object}"
  acm_certificate_arn      = "${var.acm_certificate_arn}"
  cors_allowed_headers     = ["GET", "HEAD"]
  cors_allowed_methods     = ["GET", "HEAD"]
  cors_allowed_origins     = ["*"]
}

data "aws_iam_policy_document" "s3_full_access" {
  statement {
    sid       = "FullAccess"
    effect    = "Allow"
    resources = ["arn:aws:s3:::${module.static-app.s3_bucket}/*"]

    actions = [
      "s3:PutObject",
      "s3:PutObjectAcl",
      "s3:GetObject",
      "s3:DeleteObject",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:GetBucketLocation",
      "s3:AbortMultipartUpload",
    ]
  }
}

data "aws_iam_policy_document" "base" {
  statement {
    sid = "BaseS3Access"

    actions = [
      "s3:ListBucket",
      "s3:ListBucketVersions",
    ]

    resources = ["*"]
    effect    = "Allow"
  }
}

  module "s3-write-role" {
    source     = "git::<https://github.com/cloudposse/terraform-aws-iam-role.git?ref=0.4.0>"

    enabled    = "true"
    namespace = "${var.namespace}"
    stage     = "${var.stage}"
    name      = "${var.name}"

    policy_description = "Allow S3 FullAccess"
    role_description   = "IAM role with permissions to perform actions on S3 resources"

    policy_documents = [
      "${data.aws_iam_policy_document.base.json}",
      "${data.aws_iam_policy_document.s3_full_access.json}"
      ]
  }

17:04 $ terraform plan

Error: Incorrect attribute value type

  on .terraform/modules/s3-write-role.aggregated_assume_policy/main.tf line 23, in data "aws_iam_policy_document" "zero":
  23:   override_json = "${element(local.policies, 0)}"

Inappropriate value for attribute "override_json": string required.


Error: Incorrect attribute value type

  on .terraform/modules/s3-write-role.aggregated_policy/main.tf line 23, in data "aws_iam_policy_document" "zero":
  23:   override_json = "${element(local.policies, 0)}"

Inappropriate value for attribute "override_json": string required.

Error: Error running plan: 1 error occurred:
	* module.alb_ingress.local.target_group_arn: local.target_group_arn: Resource 'aws_lb_target_group.default' not found for variable 'aws_lb_target_group.default.arn'

locals {
  target_group_enabled = "${var.target_group_arn == "" ? "true" : "false"}"
  target_group_arn     = "${local.target_group_enabled == "true" ? aws_lb_target_group.default.arn : var.target_group_arn}"
}

module "alb_ingress" {
  #source            = "git::<https://github.com/cloudposse/terraform-aws-alb-ingress.git?ref=tags/0.7.0>"
  source            = "../terraform-aws-alb-ingress"
  name              = "${var.name}"
  namespace         = "${var.namespace}"
  stage             = "${var.stage}"
  attributes        = "${var.attributes}"
  vpc_id            = "${var.vpc_id}"
  port              = "${var.container_port}"
  health_check_path = "${var.health_check_path}"
  target_group_arn  = "${module.alb.default_target_group_arn}"

  # Without authentication, both HTTP and HTTPS endpoints are supported
  unauthenticated_listener_arns       = ["${module.alb.listener_arns}"]
  unauthenticated_listener_arns_count = 1

  # All paths are unauthenticated
  unauthenticated_paths    = ["/*"]
  unauthenticated_priority = "100"
}

locals {
  target_group_enabled = "${var.target_group_arn == "" ? "true" : "false"}"
  target_group_arn     = "${local.target_group_enabled == "true" ? aws_lb_target_group.default.arn : var.target_group_arn}"
}

data "aws_lb_target_group" "default" {
  arn = "${local.target_group_arn}"
}

target_group_arn  = "${module.alb.default_target_group_arn}"

null_resource.default: Refreshing state... (ID: 938128705396491941)
aws_security_group.default: Refreshing state... (ID: sg-0dca458073974ca29)
aws_lb_target_group.default: Refreshing state... (ID: arn:aws:elasticloadbalancing:us-east-1:...o-droneio-alb-default/c5d32c308b13dee7)
data.aws_elb_service_account.default: Refreshing state...
data.aws_iam_policy_document.default: Refreshing state...
aws_s3_bucket.default: Refreshing state... (ID: staging-demo-droneio-alb-alb-access-logs)
aws_lb.default: Refreshing state... (ID: arn:aws:elasticloadbalancing:us-east-1:...ging-demo-droneio-alb/61f67535cafe2201)
aws_lb_listener.http: Refreshing state... (ID: arn:aws:elasticloadbalancing:us-east-1:...-alb/61f67535cafe2201/8e7ac22fe675d697)

Error: Error running plan: 1 error occurred:
	* module.alb_ingress.local.target_group_arn: local.target_group_arn: Resource 'aws_lb_target_group.default' not found for variable 'aws_lb_target_group.default.arn'

terraform apply -target data.aws_lb_target_group.default                                                                                                                              
aws_lb_target_group.default: Refreshing state... (ID: arn:aws:elasticloadbalancing:us-east-1:...o-droneio-alb-default/c5d32c308b13dee7)

locals {
  target_group_enabled = "${var.target_group_arn == "" ? "true" : "false"}"
  target_group_arn     = "${local.target_group_enabled == "true" ? aws_lb_target_group.default.arn : var.target_group_arn}"
}

Terraform v0.11.14
+ provider.aws v2.23.0
+ provider.local v1.3.0
+ provider.null v2.1.2
+ provider.random v2.2.0
+ provider.template v2.1.2
+ provider.tls v2.0.1

resource "aws_lb_target_group" "default" {
  count       = "${local.target_group_enabled == "true" ? 1 : 0}"

make init
make readme/deps
make readme

1 error occurred:
        * module.s3cdn-dev.aws_route53_record.cert_validation: At column 19, line 1: list "local.dvo" does not have any elements so cannot determine type. in:

${lookup(local.dvo[count.index], "resource_record_value")}

Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

👉️ Register for Webinar

#office-hours (our channel)

# Grafana
module "grafana" {
  source  = "terraform-aws-modules/ec2-instance/aws"
  version = "~> 2.0"

  name           = "grafana-xlt"
  instance_count = 1

  ami                    = var.grafana_ami
  instance_type          = "m4.xlarge"
  key_name               = ""
  monitoring             = true
  vpc_security_group_ids = [module.ec2_sg.this_security_group_id]
  subnet_id              = module.vpc.private_subnets[0]
  #private_ip = "10.0.1.200"
   associate_public_ip_address = false

  user_data = "{\"auth\": [ {\"name\": \"admin\", \"pass\": \"${var.password}\"}]}"

  tags = {
    Name   = "grafana"
    Terraform   = "true"
    Environment = "dev"
  }
}

#resource "aws_eip" "grafana" {
#  vpc = true
#  associate_with_private_ip = "10.0.1.200"
#}
#
#resource "aws_eip_association" "grafana" {
#  instance_id                  = module.grafana.id[0]
#  allocation_id = aws_eip.grafana.id
#}

resource "aws_ssm_document

module "ssm_tls_ssh_key_pair" {
  source               = "git::<https://github.com/cloudposse/terraform-aws-ssm-tls-ssh-key-pair.git?ref=0.2.0>"
  namespace            = "${var.namespace}"
  stage                = "${var.stage}"
  name                 = "${var.name}"
  attributes           = "${var.attributes}"
  
  ssm_path_prefix      = "${var.stage}/${var.name}/infrastructure/ssh_keys"
  ssh_key_algorithm    = "RSA"
  ssh_private_key_name = "${module.default_label.id}-private"
  ssh_public_key_name  = "${module.default_label.id}-public"
  #kms_key_id           = "${module.kms_key.key_id}"
}

Error refreshing state: 1 error occurred:
	* module.ssm_tls_ssh_key_pair.data.aws_kms_key.kms_key: 1 error occurred:
	* module.ssm_tls_ssh_key_pair.data.aws_kms_key.kms_key: data.aws_kms_key.kms_key: error while describing key [alias/test-demo-chamber]: NotFoundException: Alias arn:aws:kms:us-east-1:046894643055:alias/test-demo-chamber is not found.
	status code: 400, request id: 7e387954-2256-4ef2-a40e-b48269259e9c

Error downloading modules: Error loading modules: module dynamic_subnets: Error parsing .terraform/modules/e972fa1c1c4c2e3a44d52f7491016697/label.tf: At 3:25: Unknown token: 3:25 IDENT var.attributes

{
  my policy doc
}
{
  my next policy doc
}

Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

👉️ Register for Webinar

#office-hours (our channel)

data "aws_ami" "potato" {
  filter {
    ...local.default_filters
  }
}

Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

👉️ Register for Webinar

#office-hours (our channel)

resource "aws_route53_record" "cert_validation" {
  name    = "${aws_acm_certificate.cert.domain_validation_options.0.resource_record_name}"
  type    = "${aws_acm_certificate.cert.domain_validation_options.0.resource_record_type}"
  zone_id = "${data.aws_route53_zone.zone.id}"
  records = ["${aws_acm_certificate.cert.domain_validation_options.0.resource_record_value}"]
  ttl     = 60
}

resource "aws_acm_certificate" "cert" {
  provider          = "aws.acm"
  domain_name       = "*.${var.domain}.${element(var.certs, count.index)}.${var.aws_env == "prod" ? "com." : "test."}"
  validation_method = "DNS"

  tags = "${local.required_tags}"

  lifecycle {
    create_before_destroy = true
  }
  count = "${length(var.certs)}"
}

resource "aws_route53_record" "cert_validation" {
  count = "${length(var.certs)}"

  name    = "${aws_acm_certificate.cert.domain_validation_options.*.resource_record_name[count.index]}"
  type    = "${aws_acm_certificate.cert.domain_validation_options.*.resource_record_type[count.index]}"
  zone_id = "${data.aws_route53_zone.zone.id}"
  records = ["${aws_acm_certificate.cert.domain_validation_options.*.resource_record_value[count.index]}"]
  ttl     = 60
}

resource "aws_acm_certificate_validation" "cert" {
  certificate_arn         = "${aws_acm_certificate.cert.arn}"
  validation_record_fqdns = ["${aws_route53_record.cert_validation.fqdn}"]
}

resource "aws_acm_certificate_validation" "cert" {
  certificate_arn         = "${aws_acm_certificate.cert.arn}"
  validation_record_fqdns = ["${aws_route53_record.cert_validation.*.fqdn}"]
}

  terraform-null-label git:(0.11) ✗ terraform validate

Error: local.generated_tags: local.generated_tags: zipmap: count of keys (1) does not match count of values (0) in:

${zipmap(
    compact(list("Name", local.namespace != "" ? "Namespace" : "", local.environment != "" ? "Environment" : "", local.stage != "" ? "Stage" : "")),
    compact(list(local.id, local.namespace, local.environment, local.stage))
    )}

resource "aws_route53_record" "cert_validation" {
  count   = length(var.certs)
  name    = aws_acm_certificate.cert[count.index].domain_validation_options.0.resource_record_name
  type    = aws_acm_certificate.cert[count.index].domain_validation_options.0.resource_record_type
  zone_id = aws_route53_zone.zones[count.index].id
  records = ["${aws_acm_certificate.cert[count.index].domain_validation_options.0.resource_record_value}"]
  ttl     = 60
}

Error: Invalid index

  on ../modules/bootstrap/acm_validation.tf line 4, in resource "aws_route53_record" "cert_validation":
   4:   type    = aws_acm_certificate.cert[count.index].domain_validation_options.0.resource_record_type
    |----------------
    | aws_acm_certificate.cert is tuple with 2 elements
    | count.index is 0

The given key does not identify an element in this collection value.


Error: Invalid index

  on ../modules/bootstrap/acm_validation.tf line 6, in resource "aws_route53_record" "cert_validation":
   6:   records = ["${aws_acm_certificate.cert[count.index].domain_validation_options.0.resource_record_value}"]
    |----------------
    | aws_acm_certificate.cert is tuple with 2 elements
    | count.index is 0

The given key does not identify an element in this collection value.


Error: Invalid index

  on ../modules/bootstrap/acm_validation.tf line 6, in resource "aws_route53_record" "cert_validation":
   6:   records = ["${aws_acm_certificate.cert[count.index].domain_validation_options.0.resource_record_value}"]
    |----------------
    | aws_acm_certificate.cert is tuple with 2 elements
    | count.index is 0

The given key does not identify an element in this collection value.

module.nonprod.aws_route53_record.cert_validation[1]: Still destroying... [id=Z3FZBH8XNPPPYT__3aedbf37656ebde46d6db19a4f38212c.test-api.dev._CNAME, 30s elapsed]
module.prod.aws_route53_record.cert_validation[1]: Still destroying... [id=Z2IAS5UODUXPHA__73016316fbab15ae3d5db4d2b9b240c8.test-api.com._CNAME, 30s elapsed]

chamber write test-ec2-helloworld ecs_parameter_secret password333

test-ec2-helloworld

chamber export test-ec2-hello -f tfvars                                                               1350ms  Wed 28 Aug 15:42:11 2019
ecs_parameter_secret = "password1"
ecs_parameter_string = "NOTSECRET"

resource "aws_s3_bucket" "remote_state" {
    bucket = local.bucket_name
    force_destroy = var.force_destroy
    acl = "private"
    
    versioning {
      enabled = var.versioning_enabled
    }

    tags = local.required_tags
}

locals {
  bucket_name = "account-${var.aws_env}-${project_domain}-${var.aws_region}"
}

50:   bucket_name = "account-${var.aws_env}-${project_domain}-${var.aws_region}"

A reference to a resource type must be followed by at least one attribute
access, specifying the resource name.

assume_role_policy = "${data.aws_iam_policy_document.enhanced_monitoring.json}"

module "s3-remote-state-bucket" {
  source = "../../modules/remote_state"

  versioning_enabled = var.versioning_enabled
  force_destroy = var.force_destroy

  aws_env = "nonprod"
  aws_region = var.aws_region
  aws_account_id_nonprod = var.aws_account_id_nonprod
  aws_account_id_prod = var.aws_account_id_prod

  providers = {
    aws = "aws.nonprod"
  }                                                         
}

variable "aws_env" {
  description = "aws account environment"
  type = string
}

 terraform apply
var.aws_env
  aws account environment

  Enter a value:

module "s3_bucket" {
  source                              = "git:xxxxx/terraform-modules/aws-s3.git?ref=terraform_0.11"
  enabled                             = "true"              
  user_enabled                        = "false"         
  allowed_bucket_actions              = []                                                             
  policy                              = ""              
  force_destroy                       = "false"        
  versioning_enabled                  = "true"          
  allow_encrypted_uploads_only        = "false"         
  sse_algorithm                       = "AES256"        
  kms_master_key_arn                  = ""             
  namespace                           = "test"
  name                                = "frontend"
  stage                               = ""
  attributes                          = []
  delimiter                           = "-"              
  tags  = {
    "BusinessUnit" = "XYZ",
    "Snapshot"     = "true"
  }
}

variable "namespace" {
  type        = "string"
  #default     = ""
  description = "Namespace (e.g. `eg` or `cp`)"
}

variable "stage" {
  type        = "string"
  #default     = ""
  description = "Stage (e.g. `prod`, `dev`, `staging`)"
}

variable "name" {
  type        = "string"
  #default     = ""
  description = "Name  (e.g. `app` or `db`)"
}

variable "delimiter" {
  type        = "string"
  default     = "-"
  description = "Delimiter to be used between `namespace`, `stage`, `name` and `attributes`"
}

variable "attributes" {
  type        = "list"
  default     = []
  description = "Additional attributes (e.g. `1`)"
}

variable "tags" {
  type        = "map"
  default     = {}
  description = "Additional tags (e.g. `{ BusinessUnit = \"XYZ\" }`"
}

variable "acl" {
  type        = "string"
  default     = "private"
  description = "The canned ACL to apply. We recommend `private` to avoid exposing sensitive information"
}

variable "policy" {
  type        = "string"
  default     = ""
  description = "A valid bucket policy JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a terraform plan. In this case, please make sure you use the verbose/specific version of the policy."
}

variable "region" {
  type        = "string"
  default     = ""
  description = "If specified, the AWS region this bucket should reside in. Otherwise, the region used by the callee."
}

variable "force_destroy" {
  type        = "string"
  default     = "false"
  description = "A boolean string that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable."
}

variable "versioning_enabled" {
  type        = "string"
  default     = "false"
  description = "A state of versioning. Versioning is a means of keeping multiple variants of an object in the same bucket."
}

variable "sse_algorithm" {
  type        = "string"
  default     = "AES256"
  description = "The server-side encryption algorithm to use. Valid values are `AES256` and `aws:kms`"
}

variable "kms_master_key_arn" {
  type        = "string"
  default     = ""
  description = "The AWS KMS master key ARN used for the `SSE-KMS` encryption. This can only be used when you set the value of `sse_algorithm` as `aws:kms`. The default aws/s3 AWS KMS master key is used if this element is absent while the `sse_algorithm` is `aws:kms`"
}

variable "enabled" {
  type        = "string"
  description = "Set to `false` to prevent the module from creating any resources"
  default     = "true"
}

variable "user_enabled" {
  type        = "string"
  default     = "false"
  description = "Set to `true` to create an S3 user with permission to access the bucket"
}

variable "allowed_bucket_actions" {
  type        = "list"
  default     = ["s3:PutObject", "s3:PutObjectAcl", "s3:GetObject", "s3:DeleteObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:GetBucketLocation", "s3:AbortMultipartUpload"]
  description = "List of actions the user is permitted to perform on the S3 bucket"
}

variable "allow_encrypted_uploads_only" {
  type        = "string"
  default     = "false"
  description = "Set to `true` to prevent uploads of unencrypted objects to S3 bucket"
}