#terraform - March 2021

terraform state show "module.gitlab_repository_webhook.gitlab_project_hook.this[15]"

data "aws_iam_policy" "cni_policy" {
  arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
}

module "vpc_cni_oidc_role" {
  source = "cloudposse/eks-iam-role/aws"
  version = "x.x.x"

  [...a bunch of vars...]

  aws_iam_policy_document = data.aws_iam_policy.cni_policy.policy
}

locals {
  lambda_functions = {
    foo = { memory=256, iam_policies = tolist([...]) }
    bar = { memory=128 }
  }
}

dynamic "inline_policy" {
    for_each = length(lookup(local.lambda_functions[each.key], "iam_policies", [])) > 0 ? each.value.iam_policies : []
    content {
      name   = "ExtraPermissions${md5(jsonencode(inline_policy.value))}"
      policy = jsonencode(inline_policy.value)
    }
  }

map = {
  events = ["foo"]
  another_key = "bar"
}

new_map = {
  events = ["foo", "baz"]
  another_key = "bar"
}

The target group with targetGroupArn ... does not have an associated load balancer.

module "db" {
  source  = "terraform-aws-modules/rds/aws"
  version = "2.20.0"

Error: Error Deleting DB Option Group: InvalidOptionGroupStateFault: The option group 'de-qa-env-01-20210119142009861600000003' cannot be deleted because it is in use.
	status code: 400, request id: e9a3c5b5-61fa-4648-bc95-183fba0fa32b

module "redis" {
  source = "cloudposse/elasticache-redis/aws"

  availability_zones               = data.terraform_remote_state.vpc.outputs.azs
  vpc_id                           = data.terraform_remote_state.vpc.outputs.vpc_id
  enabled                          = var.enabled
  name                             = var.name
  tags                             = var.tags

  allowed_security_groups          = [data.terraform_remote_state.vpc.outputs.default_security_group_id]
  allowed_cidr_blocks              = ["20.10.0.0/16"]
  subnets                          = data.terraform_remote_state.vpc.outputs.elasticache_subnets
  cluster_size                     = var.redis_cluster_size #number_cache_clusters
  instance_type                    = var.redis_instance_type
  apply_immediately                = true
  automatic_failover_enabled       = true
  multi_az_enabled                 = true
  engine_version                   = var.redis_engine_version
  family                           = var.redis_family
  cluster_mode_enabled             = false
  replication_group_id             = var.replication_group_id
  at_rest_encryption_enabled       = var.at_rest_encryption_enabled
  transit_encryption_enabled       = var.transit_encryption_enabled
  cloudwatch_metric_alarms_enabled = var.cloudwatch_metric_alarms_enabled
  cluster_mode_num_node_groups     = var.cluster_mode_num_node_groups
  snapshot_retention_limit         = var.snapshot_retention_limit
  snapshot_window                  = var.snapshot_window
  dns_subdomain                    = var.dns_subdomain
  cluster_mode_replicas_per_node_group = var.cluster_mode_replicas_per_node_group

  parameter = [
    {
      name  = "notify-keyspace-events"
      value = "lK"
    }
  ]
}

(email is an option but is unsupported, see below).

    # The endpoint to send data to, the contents will vary with the protocol. (see below for more information)
    endpoint_auto_confirms = bool

data "aws_sns_topic" "cloudposse-hosting" {
  name = "cloudposse-hosting-isawesome"
}

alarm_actions = ["${data.aws_sns_topic.cloudposse-hosting.arn}"]

Error: Invalid count argument

  on .terraform/modules/elastic_beanstalk.elastic_beanstalk_environment.dns_hostname/main.tf line 2, in resource "aws_route53_record" "default":
   2:   count   = module.this.enabled ? 1 : 0

The "count" value depends on resource attributes that cannot be determined
until apply, so Terraform cannot predict how many instances will be created.
To work around this, use the -target argument to first apply only the
resources that the count depends on.

module "master" {
  source = "terraform-aws-modules/rds/aws"
  version = "2.20.0"
  identifier = var.master_identifier
  engine            = var.engine
  engine_version    = var.engine_version
  instance_class    = var.instance_class
  allocated_storage = var.allocated_storage
  storage_type      = var.storage_type
  storage_encrypted = var.storage_encrypted
  name     = var.mariadb_name
  username = var.mariadb_username
  password = var.mariadb_password
  port     = var.mariadb_port
  vpc_security_group_ids = [data.terraform_remote_state.vpc-shared.outputs.default_security_group_id,
                            data.terraform_remote_state.vpc-blue.outputs.default_security_group_id,
                            data.terraform_remote_state.eks-blue.outputs.worker_group_general_security_group_id,
                            data.terraform_remote_state.eks-blue.outputs.worker_group_gitea_security_group_id,
                            data.terraform_remote_state.eks-blue.outputs.all_workers_security_group_id,
                            data.terraform_remote_state.eks-blue.outputs.cluster_security_group_id]
  maintenance_window = var.maintenance_window_master
  backup_window      = var.backup_window_master
  multi_az = true
  tags = {
    Owner       = "MariaDB"
    Environment = "blue-green"
  }
  enabled_cloudwatch_logs_exports = ["audit", "general"]
  subnet_ids = data.terraform_remote_state.vpc-shared.outputs.database_subnets
  create_db_option_group = true
  apply_immediately = true
  family = var.family
  major_engine_version = var.major_engine_version
  final_snapshot_identifier = var.final_snapshot_identifier
  deletion_protection = false
  parameters = [
    {
      name  = "character_set_client"
      value = "utf8"
    },
    {
      name  = "character_set_server"
      value = "utf8"
    }
  ]
  options = [
    {
      option_name = "MARIADB_AUDIT_PLUGIN"
      option_settings = [
        {
          name  = "SERVER_AUDIT_EVENTS"
          value = "CONNECT"
        },
        {
          name  = "SERVER_AUDIT_FILE_ROTATIONS"
          value = "7"
        },
      ]
    },
  ]
}

module "replica" {
  source = "terraform-aws-modules/rds/aws"
  version = "2.20.0"
  identifier = var.replica_identifier
  replicate_source_db = module.master.this_db_instance_id
  engine            = var.engine
  engine_version    = var.engine_version
  instance_class    = var.instance_class
  allocated_storage = var.allocated_storage
  username = ""
  password = ""
  port     = var.mariadb_port
  vpc_security_group_ids = [data.terraform_remote_state.vpc-shared.outputs.default_security_group_id,
                            data.terraform_remote_state.vpc-blue.outputs.default_security_group_id,
                            data.terraform_remote_state.eks-blue.outputs.worker_group_general_security_group_id,
                            data.terraform_remote_state.eks-blue.outputs.worker_group_gitea_security_group_id,
                            data.terraform_remote_state.eks-blue.outputs.all_workers_security_group_id,
                            data.terraform_remote_state.eks-blue.outputs.cluster_security_group_id]

  maintenance_window = var.maintenance_window_replica
  backup_window      = var.backup_window_replica
  multi_az = false
  backup_retention_period = 0
  create_db_subnet_group = false
  create_db_option_group    = false
  create_db_parameter_group = false
  major_engine_version = var.major_engine_version
}

resource aws_lambda_function main {
  for_each = local.functions
  ...
}

variable "expiry_date" {
  description = "The date you wish the certificate to expire."
  type        = string

  validation {
    condition = regex("(\\d\\d\\d\\d)-(\\d\\d)-(\\d\\d)")
    error_message = "The expiry_date value must be in the format YYYY-MM-DD."
  }
}

variable "expiry_date" {
  description = "The date you wish the certificate to expire."
  type        = string

  validation {
    condition     = length(regexall("(\\d\\d\\d\\d)-(\\d\\d)-(\\d\\d)", var.expiry_date)) > 0
    error_message = "The expiry_date value must be in the format YYYY-MM-DD."
  }
}

Error: Failed to download module

Could not download module "pr-16696-acme-migrate"
(pr-16696-acme-migrate.tf.json:3) source code from
"git::<https://github.com/acme/repo.git?ref=>....": subdir ".terraform" not found

  # module.redirect_cert.aws_acm_certificate_validation.cert[0] must be replaced
-/+ resource "aws_acm_certificate_validation" "cert" {
        certificate_arn         = "arn:aws:acm:us-east-1:000:certificate/b55ddee7-8d98-4bf2-93eb-0029cb3e8929"
      ~ id                      = "2020-10-28 18:31:37 +0000 UTC" -> (known after apply)
      ~ validation_record_fqdns = [ # forces replacement
          + "<http://_2b63a2227feb97338346b0920e49818b.xxx.com|_2b63a2227feb97338346b0920e49818b.xxx.com>",
          + "<http://_423e90cf36285adac5ee4213289e73ab.xxx.com|_423e90cf36285adac5ee4213289e73ab.xxx.com>",
        ]
    }

terraform {
  required_providers {
    aws = {
      source = "hashicorp/aws"
    }
    helm = {
      source = "hashicorp/helm"
    }
    kubernetes = {
      source = "hashicorp/kubernetes"
    }
  }
  required_version = ">= 0.13"
}

Error: error loading module: Unsuitable value type: Unsuitable value: string required (in versions.tf line 3)

obj = { 
  one = {
    two = {
      foo = bar
    }
  },
  three = "four"
}

obj = { 
  one = {
    two = {
      foo = bar,
      biz = baz
    }
  },
  three = "four"
}

Failed to load state: Terraform 0.14.5 does not support state version 4, please update.

   Type      Protocol   Port range      Source

All traffic     All        All       40.10.0.0/16  (VPC-A)
All traffic     All        All       20.10.0.0/16  (VPC-B)
All traffic     All        All       30.10.0.0/16  (VPC-C)

Outbound rules:
   Type      Protocol   Port range    Destination
All traffic     All        All        0.0.0.0/0

resource "aws_security_group" "shared-elasticsearch-sg" {
  name = var.name_sg
  vpc_id = data.terraform_remote_state.vpc-A.outputs.vpc_id
  ingress {
    from_port = 0
    to_port   = 0
    protocol  = "-1"
    cidr_blocks = [data.terraform_remote_state.vpc-A.outputs.vpc_cidr_block,
                   data.terraform_remote_state.vpc-B.outputs.vpc_cidr_block,
                   data.terraform_remote_state.vpc-C.outputs.vpc_cidr_block]
  }
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
  tags = {
    Name = var.name_sg
  }
}

module "elasticsearch" {
  source                = "git::<https://github.com/cloudposse/terraform-aws-elasticsearch.git?ref=tags/0.24.1>"
  security_groups       = [aws_security_group.shared-elasticsearch-sg.id,
                           data.terraform_remote_state.vpc-A.outputs.default_security_group_id]
  vpc_id                 = data.terraform_remote_state.vpc-A.outputs.vpc_id
  ......
}

Inbound rules:
  Type      Protocol   Port range         Source
All TCP       TCP       0 - 65535   sg-0288988f38d2007be / shared-elasticSearch-sg
All TCP       TCP       0 - 65535   sg-0893dfcdc1be34c63 / default
Outbound rules:
  Type      Protocol   Port range    Destination
All TCP       TCP      0 - 65535      0.0.0.0/0

   Type      Protocol   Port range      Source
All traffic     All        All       40.10.0.0/16  (VPC-A)
All traffic     All        All       20.10.0.0/16  (VPC-B)
All traffic     All        All       30.10.0.0/16  (VPC-C)

Outbound rules:
   Type      Protocol   Port range    Destination
All traffic     All        All        0.0.0.0/0

data "aws_security_groups" "cloudposse-ips" {
  tags = {
    Name = "cloudposse-ips"
  }
}


vpc_security_group_ids      = ["data.aws_security_groups.cloudposse-ips.ids"]

data "aws_security_groups" "cloudposse-ips" {
    arns    = [
        "arn:aws:ec2:eu-west-1:564923036937:security-group/sg-0d5e812c1bb1c471a",
    ]
    id      = "eu-west-1"
    ids     = [
        "sg-0d5e812c1bb1c471a",
    ]
    tags    = {
        "Name" = "cloudposse-ips"
    }
    vpc_ids = [
        "vpc-0baf4791f3db9bd8c",
    ]
}

export ARM_CLIENT_ID=aaaa
export ARM_CLIENT_SECRET=bbbb
export ARM_SUBSCRIPTION_ID=cccc
export ARM_TENANT_ID=dddd

resource "aws_security_group" "es_internal" {
  description = "internal traffic"
  name        = module.label.id
  tags        = module.label.tags
  vpc_id      = data.aws_vpc.main.id
}

I query the instance id with a datasource like this:data "aws_instance" "instancetoapplyto" {
  filter {
    name   = "tag:Name"
    values = ["${var.instancename}"]
  }
}

    InstanceId = data.aws_instance.instancetoapplyto.id

Warning: Interpolation-only expressions are deprecated

  on ../../../modules/cloudwatch/alarms.tf line 8, in data "aws_instance" "instancetoapplyto":
   8:     values = ["${var.instancename}"]

  groups = {
    Diagnose: [
      "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
      "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
      ...
     ], ...

locals {
    groups_helper = chunklist(flatten([for key in keys(local.groups): setproduct([key], local.groups[key])]), 2)
}

resource "aws_iam_group_policy_attachment" "this" {
    for_each = {
      for group in local.groups_helper : "${group[0]}.${group[1]}" => group
  }

  group = each.value[0]
  policy_arn = each.value[1]
}

      %{for index in range(length(local.mylist))}
      [item${index}]
      name=local.mylist[item].name
      %{endfor}

variable "site_configs" {
type = map(object({
   lambdas_definitions = map(object({
                      lambda_zip_path = string
                     }))
  }))
}

object({
    bucket_name = string
    prefix      = string
  })

terraform_0.13.5 plan -var=build_version_inputs={get-data:\"1.0.1_1\",post-data:\"1.0.1_1\"} 

Error: Extra characters after expression

  on <value for var.build_version_inputs> line 1:
  (source code not available)

An expression was successfully parsed, but extra characters were found after
it.

/usr/local/bin/terraform_0.13.5 plan -var=build_version_inputs={"get-data":"1.0.1_1"},{"post-data":"1.0.1_1"}
/usr/local/bin/terraform_0.13.5 plan -var=build_version_inputs={\"get-data\":\"1.0.1_1\",\"post-data\":\"1.0.1_1\"}
/usr/local/bin/terraform_0.13.5 plan -var=build_version_inputs={get-data:\"1.0.1_1\",post-data:\"1.0.1_1\"}
/usr/local/bin/terraform_0.13.5 plan -var=build_version_inputs={get-data:"1.0.1_1",post-data:"1.0.1_1"}
/usr/local/bin/terraform_0.13.5 plan -var=build_version_inputs={get-data:1.0.1_1,post-data:1.0.1_1}
/usr/local/bin/terraform_0.13.5 plan -var=build_version_inputs={"get-data":"1.0.1_1","post-data":"1.0.1_1"}

 {
	"variable": {
		"build_version_inputs": {
			"get-data": "1.0.1_1",
			"post-data": "1.0.1_1"
		}
	}
}