#terraform - November 2019

lower(join("-", flatten(regexall("([A-Z][a-z]*)", "ThisIsTitleCaseStuff"))))

Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

👉️ Register for Webinar

#office-hours (our channel)

data "aws_ssm_parameter" "eks_ami" {
  name = "/aws/service/eks/optimized-ami/${var.kubernetes_version}/amazon-linux-2/recommended/image_id"
}

module "eks_workers_1" {
  source = "git::<https://github.com/cloudposse/terraform-aws-eks-workers.git?ref=tags/0.10.0>"

  use_custom_image_id = true
  image_id            = data.aws_ssm_parameter.eks_ami.value

A: I don't know if I'll need to add more subnets or AZs in the future
B: I don't think that cidrsubnets() will accurately chop up the cidr blocks into my subnets consistently

    environment {
      AWS_ACCESS_KEY_ID = "${data.aws_caller_identity.current.access_key}"
      AWS_ACCESS_KEY_ID = "${data.aws_caller_identity.current.secret_key}"
    }

aws-vault exec PROFILE -- terraform apply -var 'region=us-east-2' -var-file=staging.tfvars 

provider "aws" {
  region = var.region

  # Comment this if you are using aws-vault locally
  assume_role {
    role_arn = var.role_arn
  }
}

resource "aws_kinesis_analytics_application" "app" {
  name = var.analytics_app_name
  tags = local.tags

  // TODO: need to make inputs & outputs dynamic -- cater for cases of multiple columns, e.t.c.
  //  inputs {
  //    name_prefix = ""
  //    "schema" {
  //      "record_columns" {
  //        name = ""
  //        sql_type = ""
  //      }
  //      "record_format" {}
  //    }
  //  }
  //  outputs {
  //    name = ""
  //    "schema" {}
  //  }
}

// Add environment variables.
  environment {
    variables {
      SLACK_URL = "${var.slack_url}"
    }
  }

  // Add environment variables.
  environment {
    variables {
      "${var.env_vars}"
    }
  }

data "external" "layers" {
  program = ["python3", "${path.module}/scripts/layers.py"]
  query = {
    runtime = "${var.runtime}"
  }
}

input: { purpose = "ci_worker", lifecycle = "Ec2Spot" }
output: "purpose=ci_worker,lifecycle=Ec2Spot" 

layers = [ list(var.layers, local.dd_layer) ]  
  else: 
layers = [ var.layers ]

  layers                         = [
    "${var.enable_datadog ? "${local.dd_layer}:${data.external.layers.result["arn_suffix"]}" : var.layers }"
  ]

  layers                         = [
    "${var.enable_datadog ? data.external.layers.result["arn_suffix"] : var.layers }"
  ]

Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

👉️ Register for Webinar

#office-hours (our channel)

module "cert" {
  source                            = "git::<https://github.com/cloudposse/terraform-aws-acm-request-certificate.git?ref=0.4.0>"
  zone_name                         = local.zone
  domain_name                       = local.origin_dns
  subject_alternative_names         = local.origin_san
  ttl                               = "300"
  process_domain_validation_options = true
  wait_for_certificate_issued       = true
}

  filter {
    name   = "key"
    values = ["Team"]
  }

  filter {
    name   = "value"
    values = ["Pets"]
  }

  filter {
    name   = "key"
    values = ["tag:Name"]
  }

  filter {
    name   = "value"
    values = ["my-name-tag-value"]
  }

Initializing provider plugins...
- Checking for available provider plugins...

Error verifying checksum for provider "okta"

-/+ module.eks_cluster.aws_eks_cluster.default (new resource required)
      id:                                                     "mycluster" => <computed> (forces new resource)
      arn:                                                    "arn:aws:eks:us-west-2:xxxxxxx:cluster/mycluster" => <computed>

resource "aws_iam_openid_connect_provider" "this" {
  client_id_list  = ["<http://sts.amazonaws.com|sts.amazonaws.com>"]
  thumbprint_list = [
    "9e99a48a9960b14926bb7f3b02e22da2b0ab7280" # <https://github.com/terraform-providers/terraform-provider-aws/issues/10104#issuecomment-545264374>
  ]
  url             = "${aws_eks_cluster.this.identity.0.oidc.0.issuer}"
}

Yea, one of the outputs of the module is the EKS cluster name. With this we _could_ use with the `aws_eks_cluster` datasource like you've done above… however doesn't seem like we can do an indirect variable reference like with `eval`in bash

module "eks_cluster" {
  source                 = "../../"
  namespace              = var.namespace
  stage                  = var.stage
  name                   = var.name
  attributes             = var.attributes
  tags                   = var.tags
  region                 = var.region
  vpc_id                 = module.vpc.vpc_id
  subnet_ids             = module.subnets.public_subnet_ids
  kubernetes_version     = var.kubernetes_version
  kubeconfig_path        = var.kubeconfig_path
  local_exec_interpreter = var.local_exec_interpreter

  configmap_auth_template_file = var.configmap_auth_template_file
  configmap_auth_file          = var.configmap_auth_file

  workers_role_arns          = [module.eks_workers.workers_role_arn]
  workers_security_group_ids = [module.eks_workers.security_group_id]
}

data "aws_eks_cluster" "example" {
  name = module.eks_cluster.eks_cluster_id
}

locals {
	oidc_issuer = data.aws_eks_cluster.example.identity.0.oidc.0.issuer
}

resource "aws_api_gateway_domain_name" "domain" {
  count           = var.create_custom_domain == "true" ? 1 : 0
  certificate_arn = var.aws_acm_certificate_arn
  domain_name     = var.domain_name
}

resource "aws_route53_record" "domain" {
  count = length(var.route53_record_types)
  name    = aws_api_gateway_domain_name.domain.domain_name
  type    = var.route53_record_types[count.index]
  zone_id = "xxxxxxxxxx"

  alias {
    evaluate_target_health = false
    name                   = aws_api_gateway_domain_name.domain.cloudfront_domain_name
    zone_id                = aws_api_gateway_domain_name.domain.cloudfront_zone_id
  }
}

count  = var.create_custom_domain ? length(var.route53_record_types) : 0                 

Error: Missing resource instance key

  on ../modules/frontend/main.tf line 263, in resource "aws_route53_record" "domain":
 263:     name                   = aws_api_gateway_domain_name.domain.cloudfront_domain_name

Because aws_api_gateway_domain_name.domain has "count" set, its attributes
must be accessed on specific instances.

For example, to correlate with indices of a referring resource, use:
    aws_api_gateway_domain_name.domain[count.index]


Error: Missing resource instance key

  on ../modules/frontend/main.tf line 264, in resource "aws_route53_record" "domain":
 264:     zone_id                = aws_api_gateway_domain_name.domain.cloudfront_zone_id

Because aws_api_gateway_domain_name.domain has "count" set, its attributes
must be accessed on specific instances.

For example, to correlate with indices of a referring resource, use:
    aws_api_gateway_domain_name.domain[count.index]

name                   = aws_api_gateway_domain_name.domain[0].cloudfront_domain_name

join("", aws_api_gateway_domain_name.domain.*.cloudfront_domain_name)

name = length(aws_api_gateway_domain_name.domain) > 0 ? aws_api_gateway_domain_name.domain[0].cloudfront_domain_name : null

module "label" {
  source     = "git::<https://github.com/cloudposse/terraform-null-label.git?ref=tags/0.14.1>"
  enabled    = var.enabled
  namespace  = var.namespace
  name       = var.name
  stage      = var.stage
  delimiter  = var.delimiter
  attributes = var.attributes
  tags       = var.tags
}

host        = module.ec2.public_ip
Inappropriate value for attribute "host": string required.

resource "null_resource" "test" {
  provisioner "file" {
    source      = file(var.source_path)
    destination = file(var.destination_path)
    //    on_failure  = "continue"
    connection {
      type        = "ssh"
      user        = var.ssh_user
      private_key = var.ssh_key
      host        = module.ec2.public_ip
    }
  }
}

Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

👉️ Register for Webinar

#office-hours (our channel)

resource "azurerm_app_service_plan" "main" {
  count               = var.plan.id == "" ? 1 : 0
  name                = coalesce(local.plan.name, local.default_plan_name)
  location            = data.azurerm_resource_group.main.location
  resource_group_name = data.azurerm_resource_group.main.name
  ...
}

resource "azurerm_app_service" "main" {
  name                = var.name
  app_service_plan_id = coalesce(var.plan.id, azurerm_app_service_plan.main[0].id)
  ...
}

Error: Invalid index

  on .terraform/modules/web_container/innovationnorway-terraform-azurerm-web-app-container-ee1e8d4/main.tf line 27, in resource "azurerm_app_service" "main":
  27:   app_service_plan_id = coalesce(var.plan.id, azurerm_app_service_plan.main[0].id)
    |----------------
    | azurerm_app_service_plan.main is empty tuple

The given key does not identify an element in this collection value.

resource "aws_codebuild_project" "build" {
  name         = "${var.repo}-build"
......

Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

👉️ Register for Webinar

#office-hours (our channel)

resource "null_resource" "create_snapshot" {
  provisioner "local-exec" {
    command = "aws create-snapshot --volume-id <value>"
  }
}

Error: Missing resource instance key

  on ../modules/vpc-peering/main.tf line 46, in data "aws_subnet_ids" "requestor":
  46:   vpc_id = "${data.aws_vpc.requestor.id}"

Because data.aws_vpc.requestor has "count" set, its attributes must be
accessed on specific instances.

For example, to correlate with indices of a referring resource, use:
    data.aws_vpc.requestor[count.index]

Warning: Quoted type constraints are deprecated

  on ../modules/vpc-peering/variables.tf line 73, in variable "tags":
  73:   type        = "map"

Terraform 0.11 and earlier required type constraints to be given in quotes,
but that form is now deprecated and will be removed in a future version of
Terraform. To silence this warning, remove the quotes around "map" and write
map(string) instead to explicitly indicate that the map elements are strings.


Warning: Interpolation-only expressions are deprecated

  on .terraform/modules/vpc_peering_mgmt_prod.label/main.tf line 2, in resource "null_resource" "default":
   2:   count = "${var.enabled == "true" ? 1 : 0}"

Terraform 0.11 and earlier required all non-constant expressions to be
provided via interpolation syntax, but this pattern is now deprecated. To
silence this warning, remove the "${ sequence from the start and the }"
sequence from the end of this expression, leaving just the inner expression.

Template interpolation syntax is still used to construct strings from
expressions when the template includes multiple interpolation sequences or a
mixture of literal strings and interpolations. This deprecation applies only
to templates that consist entirely of a single interpolation sequence.


Warning: Quoted type constraints are deprecated

  on .terraform/modules/vpc_peering_mgmt_prod.label/variables.tf line 19, in variable "delimiter":
  19:   type        = "string"

Terraform 0.11 and earlier required type constraints to be given in quotes,
but that form is now deprecated and will be removed in a future version of
Terraform. To silence this warning, remove the quotes around "string".


Warning: Quoted type constraints are deprecated

  on .terraform/modules/vpc_peering_mgmt_prod.label/variables.tf line 25, in variable "attributes":
  25:   type        = "list"

Terraform 0.11 and earlier required type constraints to be given in quotes,
but that form is now deprecated and will be removed in a future version of
Terraform. To silence this warning, remove the quotes around "list" and write
list(string) instead to explicitly indicate that the list elements are
strings.


Warning: Quoted type constraints are deprecated

  on .terraform/modules/vpc_peering_mgmt_prod.label/variables.tf line 31, in variable "tags":
  31:   type        = "map"

Terraform 0.11 and earlier required type constraints to be given in quotes,
but that form is now deprecated and will be removed in a future version of
Terraform. To silence this warning, remove the quotes around "map" and write
map(string) instead to explicitly indicate that the map elements are strings.

Error: Failed to download module

Could not download module "domain" (<http://main.tf:45|main.tf:45>) source code
from "git@github.com:org/terraform-aws-domain.git": error
downloading '<ssh://git>@github.com/org/terraform-aws-domain.git':
/usr/bin/git exited with 128: Cloning into
'.terraform/modules/domain'...
Host key verification failed.
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.



Error: Failed to download module

variable "default_firewall_source_ranges" {
  type        = list
  default = ["10.0.0.0/8", "10.0.0.2/32", "10.0.0.1/32"]
}

resource "helm_release" "haproxy-mysql" {
  name  = "haproxy-mysql"
  chart = "${path.module}/charts/haproxy-mysql"
  namespace = "default"
  values = [
     "${file("${path.module}/charts/haproxy-mysql/values.yaml")}"
  ]
  set {
    name  = "service.loadBalancerIP"
    value = google_compute_address.haproxy_mysql.address
  }
  set {
    name  = "service.loadBalancerSourceRanges"
    value = "{${join(",", var.default_firewall_source_ranges)}}"
  }

  depends_on = [google_container_cluster.gke-cluster]
}

Error: rpc error: code = Unknown desc = release haproxy-mysql failed: Service "haproxy-mysql" is invalid: spec.LoadBalancerSourceRanges: Invalid value: "[10.0.0.0/8 10.0.0.2/32 10.0.0.1/32]": must be a list of IP ranges. For example, 10.240.0.0/24,10.250.0.0/24

set {
  name  = "service.loadBalancerSourceRanges"
  value = "{${join(",", var.default_firewall_source_ranges)}}"
}