#terraform - March 2020

Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

👉️ Register for Webinar

#office-hours (our channel)

tbh - I don't actually know how my module works internally - so far it just has worked. It relies on terraform "bugs" that I "abuse" in a way.

Could you make a github repo with what I could try this out?

"${var.resource_name}-alb-logs-${data.aws_region.current.name}"

format("%s-alb-logs-%s", var.resource_name, data.aws_region.current.name)

$ terraform console
> format("%s-%s-%s-%s-%s-%s", "my", "other", "hand", "is", "a", "sandwich")
my-other-hand-is-a-sandwich

No provider "aws" plugins meet the constraint "~> 1.60,~> 2.0".

Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

👉️ Register for Webinar

#office-hours (our channel)

resource "aws_s3_bucket_object" "object" {
  bucket = var.s3_bucket
  key    = "${var.resource_name}/FILENAME?"
  source = "${path.module}/FILENAME?"

  # The filemd5() function is available in Terraform 0.11.12 and later
  # For Terraform 0.11.11 and earlier, use the md5() function and the file() function:
  # etag = "${md5(file("path/to/file"))}"
  etag = filemd5("path/to/file")
}

"${var.resource_name}/*.zip"

module.eks_cluster.aws_eks_cluster.eks_cluster: Still creating... [11m20s elapsed]

module.eks_cluster.aws_eks_cluster.eks_cluster: Still creating... [11m30s elapsed]


Error: unexpected state 'FAILED', wanted target 'ACTIVE'. last error: %!s(<nil>)


  on ../../../../modules/eks/eks_control_plane/main.tf line 405, in resource "aws_eks_cluster" "eks_cluster":

 405: resource "aws_eks_cluster" "eks_cluster" {

error: You must be logged in to the server (the server has asked for the client to provide credentials)

# Authenticate to the EKS Cluster
data "aws_eks_cluster_auth" "eks_cluster" {
  name = local.eks_cluster.eks_cluster_id
}

# Connect to kubernetes
provider "kubernetes" {
  host                   = local.eks_cluster.eks_cluster_endpoint
  cluster_ca_certificate = base64decode(local.eks_cluster.eks_cluster_certificate_authority_data)
  token                  = data.aws_eks_cluster_auth.eks_cluster.token
  load_config_file       = false
}

Please accept licentse for marketplace images

Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

👉️ Register for Webinar

#office-hours (our channel)

Error: Either `number_cache_clusters` or `cluster_mode` must be set

  on .terraform/modules/redis.elasticache/main.tf line 81, in resource "aws_elasticache_replication_group" "default":
  81: resource "aws_elasticache_replication_group" "default" {

provider "aws" {
  region = "us-east-1"
  ignore_tag_prefixes = ["<http://kubernetes.io/*|kubernetes.io/*>"]
}

      ~ tags                             = {
            "Environment"                                           = "dev"
          - "<http://kubernetes.io/cluster/12-Cluster|kubernetes.io/cluster/12-Cluster>" = "shared" -> null
          ..............
        }
    }

  dynamic "vpc_config" {
    for_each = var.vpc_config == null ? [] : [var.vpc_config]
    content {
      security_group_ids = vpc_config.value.security_group_ids
      subnet_ids         = vpc_config.value.subnet_ids
    }
  }

  selector {
    namespace = "default"
  }

  selector {
    namespace = "kube-system"
  }

variable "selector" {
  type = list(map(string))
}

  dynamic "selector" {
    for_each = var.selector
    content {
      namespace = selector.value["namespace"]
    }
  }

terraform@22975a35d682:~/git-repos/kit.aws.medielogin/terraform/environments/medielogin-dev/04.services$ terraform apply

Error: expected network_mode to be one of [bridge host awsvpc none], got default

  on ../../../modules/ecs-service/main.tf line 30, in resource "aws_ecs_task_definition" "service_task":
  30: resource "aws_ecs_task_definition" "service_task" {

When you register a task definition with Windows containers, you must not specify a network mode.

resource "aws_security_group" "default" {
  count  = var.enabled && var.use_existing_security_groups == false ? 1 : 0
  vpc_id = var.vpc_id
  name   = module.sg_label.id

  dynamic "ingress" {
    for_each = length(var.allowed_security_groups) > 0 ? var.service_ports : null
    iterator = ingress
    content {
      description     = "Allow inbound traffic from existing Security Groups"
      from_port       = ingress.value
      to_port         = ingress.value
      protocol        = "tcp"
      security_groups = length(var.allowed_security_groups) > 0 ? [element(var.allowed_security_groups, count.index)] : null
    }
  }
}

Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

👉️ Register for Webinar

#office-hours (our channel)

variable "destination_cidr_block" {
    default = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24", "10.0.4.0/24"]
}

data "aws_route_tables" "rts" {
  vpc_id = "${var.vpc_id}"

  filter {
    name   = "tag:<http://kubernetes.io/kops/role|kubernetes.io/kops/role>"
    values = ["private*"]
  }
}

resource "aws_route" "r1" {
  count                     = "${length(data.aws_route_tables.rts.ids)}"
  route_table_id            = "${data.aws_route_tables.rts.ids[count.index]}"
  destination_cidr_block    = "${var.destination_cidr_block[0]}"
  vpc_peering_connection_id = "pcx-0e9a7a9ecd137dc54"
}

resource "aws_route" "r2" {
  count                     = "${length(data.aws_route_tables.rts.ids)}"
  route_table_id            = "${data.aws_route_tables.rts.ids[count.index]}"
  destination_cidr_block    = "${var.destination_cidr_block[1]}"
  vpc_peering_connection_id = "pcx-0e9a7a9ecd137dc54"
}

resource "aws_route" "r3" {
  count                     = "${length(data.aws_route_tables.rts.ids)}"
  route_table_id            = "${data.aws_route_tables.rts.ids[count.index]}"
  destination_cidr_block    = "${var.destination_cidr_block[2]}"
  vpc_peering_connection_id = "pcx-0e9a7a9ecd137dc54"
}

resource "aws_route" "r4" {
  count                     = "${length(data.aws_route_tables.rts.ids)}"
  route_table_id            = "${data.aws_route_tables.rts.ids[count.index]}"
  destination_cidr_block    = "${var.destination_cidr_block[3]}"
  vpc_peering_connection_id = "pcx-0e9a7a9ecd137dc54"
}

variable "dynamodb_table_name" {
  description = "Name of the dynamo db table that holds the proxy whitelist. This table resides in the xxxxxx account so that spinnaker can read the table when building proxy AMIs"
  type        = string
}

module "vpc_peering_cross_account" {
  source           = "git::<https://github.com/cloudposse/terraform-aws-vpc-peering-multi-account.git?ref=master>"
  namespace        = "eg"
  stage            = "dev"
  name             = "cluster"

  requester_aws_assume_role_arn             = "arn:aws:iam::1111111111:role/ops/r_ops_peering_access"
  requester_region                          = "us-west-2"
  requester_vpc_id                          = "vpc-1111111111"
  requester_allow_remote_vpc_dns_resolution = "true"

  accepter_aws_assume_role_arn             = "arn:aws:iam::2222222222:role/ops/r_ops_peering_access"
  accepter_region                          = "us-east-1"
  accepter_vpc_id                          = "vpc-2222222222"
  accepter_allow_remote_vpc_dns_resolution = "true"
}

Error: Error refreshing state: 1 error occurred:
        * module.vpc_peering_cross_account.provider.aws.accepter: The role "arn:aws:iam::2222222222:role/ops/r_ops_peering_access" cannot be assumed.

  There are a number of possible causes of this - the most common are:
    * The credentials used in order to assume the role are invalid
    * The credentials do not have appropriate permission to assume the role
    * The role ARN is not valid

Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

👉️ Register for Webinar

#office-hours (our channel)

resource "aws_eks_fargate_profile" "default" {
  cluster_name           = aws_eks_cluster.eks.name
  fargate_profile_name   = "default"
  pod_execution_role_arn = aws_iam_role.fargate_pod_execution.arn
  subnet_ids             = var.private_subnet_ids
  tags                   = var.tags

  dynamic "selector" {
    for_each = var.selector
    content {
      namespace = selector.value["namespace"]
    }
  }
}

resource "aws_eks_fargate_profile" "example" {
  cluster_name           = aws_eks_cluster.eks.name
  fargate_profile_name   = "default"
  pod_execution_role_arn = aws_iam_role.fargate_pod_execution.arn
  subnet_ids             = var.private_subnet_ids
  tags                   = var.tags

  dynamic "selector" {
    for_each = var.selector
    content {
      namespace = selector.value["namespace"]
    }
  }
}

Error: error creating EKS Fargate Profile (cluster-name:example): ResourceInUseException: Cannot create Fargate Profile example because cluster cluster-name currently has Fargate profile default in status CREATING