#terraform - August 2021

// need to do it dynamically somehow but it won't let me assign the key name with variable
  dynamic "integrations" {
    for_each = module.lambdas
    content {
      "ANY /hello-world" = {
        lambda_arn             = module.lambdas["hello-world"].lambda_function_arn
        payload_format_version = "2.0"
        timeout_milliseconds   = 12000
      }
    }
  }

// this works
//  integrations = {
//    "ANY /hello-world" = {
//      lambda_arn             = module.lambdas["hello-world"].lambda_function_arn
//      payload_format_version = "2.0"
//      timeout_milliseconds   = 12000
//    }
//  }

locals {
  a = { foo = { age = 12, items = [1] } }
  b = { foo = { age = 12, items = [2] }, bar = { age = 4, items = [3] } }
  c = { bar = { age = 4, items = [] } }

  # desired output
  out = { foo = { age = 12, items = [1,2] }, bar = { age = 4, items = [3] } }
}

provider "aws" {
  region = var.region
}

provider "aws" {
  region = "eu-west-2"
  alias = "aws.eu-west-2"
}

provider "aws" {
  region = "eu-central-1"
  alias = "aws.eu-central-1"
}

│ Error: Error creating ElasticSearch domain: ValidationException: You must specify exactly two subnets because you've set zone count to two.
│
│   with module.elasticsearch.aws_elasticsearch_domain.default[0],
│   on modules/elasticsearch/main.tf line 100, in resource "aws_elasticsearch_domain" "default":
│  100: resource "aws_elasticsearch_domain" "default" {
│
╵
╷
│ Error: Error creating Security Group: InvalidGroup.Duplicate: The security group 'elastic-test-es-test' already exists for VPC 'vpc-0fbda4f1d6105a68c'
│ 	status code: 400, request id: 6ad8d766-7954-49d5-b257-8b2213d1f8ec
│
│   with module.vpc.module.security_group.aws_security_group.default[0],
│   on modules/sg-cp/main.tf line 28, in resource "aws_security_group" "default":
│   28: resource "aws_security_group" "default" {

The KUBECONFG file is the most reliable [method], […]

At the moment, the exec option appears to be the most reliable method, […]

│ Error: Error creating Security Group: InvalidGroup.Duplicate: The security group 'logger-test-es-test' already exists for VPC 'vpc-0e868046c92d7bb2a'
│ 	status code: 400, request id: be88d8b8-1ed0-43ac-8246-e37265782098
│
│   with module.vpc.module.security_group.aws_security_group.default[0],
│   on modules/sg-cp/main.tf line 28, in resource "aws_security_group" "default":
│   28: resource "aws_security_group" "default" {

  mount_points                  = [
    {
      containerPath = "/var/run/docker.sock"
      sourceVolume = "docker_sock"
      readOnly = true
    },
    {
      containerPath = "/host/sys/fs/cgroup"
      sourceVolume = "cgroup"
      readOnly = true
    },
    {
      containerPath = "/host/proc"
      sourceVolume = "proc"
      readOnly = true
    }
  ]

  volumes                       =  [
    {
      host_path = "/var/run/docker.sock"
      name      = "docker_sock"
      docker_volume_configuration = []
    },
    {
      host_path = "/proc/"
      name      = "proc"
      docker_volume_configuration = []
    },
    {
      host_path = "/sys/fs/cgroup/"
      name      = "cgroup"
      docker_volume_configuration = []
    }
  ]

  dynamic "volume" {
    for_each = var.volumes
    content {
      name      = volume.value.name
      host_path = lookup(volume.value, "host_path", null)

      dynamic "docker_volume_configuration" {
        for_each = lookup(volume.value, "docker_volume_configuration", [])
        content {
          autoprovision = lookup(docker_volume_configuration.value, "autoprovision", null)
          driver        = lookup(docker_volume_configuration.value, "driver", null)
          driver_opts   = lookup(docker_volume_configuration.value, "driver_opts", null)
          labels        = lookup(docker_volume_configuration.value, "labels", null)
          scope         = lookup(docker_volume_configuration.value, "scope", null)
        }
      }
    }
  }

│ Error: Invalid function argument
│
│   on .terraform\modules\worker_tenants.worker_tenant.ssh_key_pair\main.tf line 19, in resource "aws_key_pair" "
imported":
│   19:   public_key = file(local.public_key_filename)
│     ├────────────────
│     │ local.public_key_filename is "C:/projects/terraform-network-worker/app-dev-worker-worker-arrow.pub"
│
│ Invalid value for "path" parameter: no file exists at

data "tls_certificate" "eks_oidc_cert" {
  url = aws_eks_cluster.eks.identity.0.oidc.0.issuer
}

~ id           = "2021-08-05 16:09:43.671261128 +0000 UTC" -> "2021-08-05 16:09:58.401961984 +0000 UTC"

resource "aws_s3_bucket_policy" "default" {
  count      = local.enabled && (var.allow_ssl_requests_only || var.allow_encrypted_uploads_only || length(var.s3_replication_source_roles) > 0 || var.policy != "") ? 1 : 0
  bucket     = join("", aws_s3_bucket.default.*.id)
  policy     = join("", data.aws_iam_policy_document.aggregated_policy.*.json)
  depends_on = [aws_s3_bucket_public_access_block.default]
}

Bug-Issue: https://github.com/cloudposse/terraform-aws-s3-bucket/issues/100

PR: https://github.com/cloudposse/terraform-aws-s3-bucket/pull/101

  policy = jsonencode({
    "Version" = "2012-10-17",
    "Id"      = "MYBUCKETPOLICY",
    "Statement" = [
      {
        "Sid" = "${var.bucket_name}-bucket_policy",
        "Effect" = "Allow",
        "Action" = [
          "s3:PutObject",
          "s3:GetObject",
          "s3:DeleteObject",
          "s3:ListBucket",
          "s3:ListBucketMultipartUploads",
          "s3:GetBucketLocation",
          "s3:AbortMultipartUpload"
        ],
        "Resource" = [
          "arn:aws:s3:::${var.bucket_name}",
          "arn:aws:s3:::${var.bucket_name}/*"
        ],
        "Principal" = {
          "AWS" : [var.privileged_principal_arn]
        }
      },
    ]
  })

Error: Invalid count argument

  on .terraform/modules/service.s3-bucket.s3_bucket/main.tf line 367, in resource "aws_s3_bucket_policy" "default":
 367:   count      = local.enabled && (var.allow_ssl_requests_only || var.allow_encrypted_uploads_only || length(var.s3_replication_source_roles) > 0 || var.policy != "") ? 1 : 0

The "count" value depends on resource attributes that cannot be determined
until apply, so Terraform cannot predict how many instances will be created.
To work around this, use the -target argument to first apply only the
resources that the count depends on.

aws_cloudwatch_event_rule.this: Creating...
╷
│ Error: Creating CloudWatch Events Rule failed: InvalidEventPatternException: Event pattern is not valid. Reason: Filter is not an object

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # aws_cloudwatch_event_rule.this will be created
  + resource "aws_cloudwatch_event_rule" "this" {
      + arn            = (known after apply)
      + description    = "This is event rule description."
      + event_bus_name = "default"
      + event_pattern  = "\"{\\\"detail\\\":{\\\"eventTypeCategory\\\":[\\\"issue\\\"],\\\"service\\\":[\\\"EC2\\\"]},\\\"detail-type\\\":[\\\"AWS Health Event\\\"],\\\"source\\\":[\\\"aws.health\\\"]}\""
      + id             = (known after apply)
      + is_enabled     = true

Error: Unsupported block type

  on .terraform/modules/wafv2/rules.tf line 253, in resource "aws_wafv2_web_acl" "default":
 253:             dynamic "forwarded_ip_config" {

Blocks of type "forwarded_ip_config" are not expected here.


Error: Unsupported block type

  on .terraform/modules/wafv2/rules.tf line 306, in resource "aws_wafv2_web_acl" "default":
 306:             dynamic "ip_set_forwarded_ip_config" {

Blocks of type "ip_set_forwarded_ip_config" are not expected here.


Error: Unsupported block type

  on .terraform/modules/wafv2/rules.tf line 409, in resource "aws_wafv2_web_acl" "default":
 409:             dynamic "forwarded_ip_config" {

Blocks of type "forwarded_ip_config" are not expected here.

Error: Invalid count argument

  on .terraform/modules/service.s3_bucket.s3_bucket/main.tf line 367, in resource "aws_s3_bucket_policy" "default":
 367:   count      = local.enabled && (var.allow_ssl_requests_only || var.allow_encrypted_uploads_only || length(var.s3_replication_source_roles) > 0 || length(var.privileged_principal_arns) > 0 || var.policy != "") ? 1 : 0

The "count" value depends on resource attributes that cannot be determined
until apply, so Terraform cannot predict how many instances will be created.
To work around this, use the -target argument to first apply only the
resources that the count depends on.

ERRO[0043] Hit multiple errors:
Hit multiple errors:
exit status 1 

Error: Cannot import non-existent remote object
│ 
│ While attempting to import an existing object to "aws_codebuild_project.lambda", the provider detected that no object exists with the given id. Only pre-existing objects can be imported; check that the id is correct and that it is associated with the provider's
│ configured region or endpoint, or use "terraform apply" to create a new remote object for this resource.

data "aws_vpc" "vpc-dev" {
  tags       = { environment = "dev" }
  depends_on = [module.vpc-dev]
}

data "aws_subnet_ids" "vpc-dev-private-subnet-ids" {
  vpc_id     = data.aws_vpc.vpc-dev.id
  depends_on = [module.vpc-dev]
  tags = {
    Name = "*private*"
  }
}

│ Error: Invalid count argument
│ 
│   on .terraform/modules/my-redis-cluster.redis/main.tf line 31, in resource "aws_elasticache_subnet_group" "default":
│   31:   count      = module.this.enabled && var.elasticache_subnet_group_name == "" && length(var.subnets) > 0 ? 1 : 0
│ 
│ The "count" value depends on resource attributes that cannot be determined until apply, so Terraform cannot predict how many instances will be created. To work around this, use
│ the -target argument to first apply only the resources that the count depends on.

podSecurityPolicy:
  enabled: true
grafana:
  datasources:
    datasources.yaml:
    apiVersion: 1
    datasources:
    - name: Cloudwatch
      type: cloudwatch
      isDefault: true
      jsonData:
        authType: arn
        assumeRoleArn: "${ASSUME_ROLE_ARN}"
        defaultRegion: "${CLUSTER_REGION}"
        customMetricsNamespaces: ""
    version: 1
  grafana.ini:
    feature_toggles:
      enable: "ngalert"
  autoscaling:
    enabled: true
    minReplicas: 1
    maxReplicas: 10
    metrics:
    - type: Resource
      resource:
        name: cpu
        targetAverageUtilization: 80
    - type: Resource
      resource:
        name: memory
        targetAverageUtilization: 80
  image:
    repository: grafana/grafana
    tag: 8.1.0
  ingress:
  %{ if GRAFANA_HOST != "" }
    enabled: true
    hosts:
      - ${GRAFANA_HOST}
  %{ else }
    enabled: false
  %{ endif }
prometheus:
  prometheusSpec:
    storageSpec:
      ## Using PersistentVolumeClaim
      volumeClaimTemplate:
        spec:
          storageClassName: gp2
          accessModes: ["ReadWriteOnce"]
          resources:
            requests:
              storage: 50Gi

var.name        = "super-cool-unicorn-application"
var.environment = "staging"

resource "aws_iam_role" "task" {
    ...
    name_prefix = substr("${var.name}-${var.environment}-task-", 0, 32)
    ...
}

resource "azuredevops_serviceendpoint_github" "serviceendpoint_github" {
  project_id            = azuredevops_project.project.id
  service_endpoint_name = "xyz"

  auth_personal {
    personal_access_token = "TOKEN"
  }
}

module "foo" {
  source = "git::<https://foo.com/bar.git?ref=${var.module_version}>"

module.aws_config.aws_config_aggregate_authorization.central[0]: Creating...
aws_iam_policy.support_policy: Creating...
module.aws_config.aws_config_configuration_recorder.recorder[0]: Creating...
aws_iam_role.support_role: Creating...
module.aws_config_storage.module.storage[0].aws_s3_bucket.default[0]: Creating...
module.aws_config.aws_config_configuration_recorder.recorder[0]: Creation complete after 0s [id=config]
module.aws_config.aws_config_aggregate_authorization.central[0]: Creation complete after 1s [id=NNNNNN:us-east-1]
aws_iam_policy.support_policy: Creation complete after 1s [id=arn:aws:iam::NNNNNNNNN:policy/terraform-NNNNNN]
aws_iam_role.support_role: Creation complete after 1s [id=test-policy]
aws_iam_policy_attachment.support_policy_attach: Creating...
aws_iam_policy_attachment.support_policy_attach: Creation complete after 0s [id=test-policy]
╷
│ Error: Error creating S3 bucket: AuthorizationHeaderMalformed: The authorization header is malformed; the region 'us-east-1' is wrong; expecting 'eu-west-1'
│ 	status code: 400, request id: ID, host id: ID
│
│   with module.aws_config_storage.module.storage[0].aws_s3_bucket.default[0],
│   on .terraform/modules/aws_config_storage.storage/main.tf line 1, in resource "aws_s3_bucket" "default":
│    1: resource "aws_s3_bucket" "default" {

╷
│ Error: Error in function call
│ 
│   on .terraform/modules/subnets/outputs.tf line 53, in output "nat_ips":
│   53:   value       = coalescelist(aws_eip.default.*.public_ip, aws_eip.nat_instance.*.public_ip, data.aws_eip.nat_ips.*.public_ip, list(""))
│ 
│ Call to function "list" failed: the "list" function was deprecated in Terraform v0.12 and is no longer available; use tolist([ ...
│ ]) syntax to write a literal list.

data "aws_iam_policy_document" "grafana_cloudwatch" {
  statement {
    sid    = "AllowReadingMetricsFromCloudWatch"
    effect = "Allow"
    actions = [
      "cloudwatch:ListMetrics",
      "cloudwatch:GetMetricStatistics",
      "cloudwatch:GetMetricData"
    ]
    resources = ["*"]
  }

  statement {
    sid    = "AllowReadingLogsFromCloudWatch"
    effect = "Allow"
    actions = [
      "logs:DescribeLogGroups",
      "logs:GetLogGroupFields",
      "logs:StartQuery",
      "logs:StopQuery",
      "logs:GetQueryResults",
      "logs:GetLogEvents"
    ]
    resources = ["*"]
  }
  
  statement {
    sid       = "AllowReadingResourcesForTags"
    effect    = "Allow"
    actions   = ["tag:GetResources"]
    resources = ["*"]
  }
}

data "aws_iam_policy_document" "base_policy" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["<http://ec2.amazonaws.com|ec2.amazonaws.com>"]
    }
    effect = "Allow"
  }
}

data "aws_iam_policy_document" "account_assume_role" {
  source_json = data.aws_iam_policy_document.base_policy.json
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "AWS"
      identifiers = ["${data.aws_caller_identity.current.arn}"]
    }
    effect = "Allow"
  } 
}

resource "aws_iam_role" "cloudwatch_role" {
  name               = "${local.cluster_name}-grafana-cloudwatch-role"
  assume_role_policy = data.aws_iam_policy_document.account_assume_role.json
}

resource "aws_iam_policy" "data_source_policy" {
  name_prefix = "${local.cluster_name}-grafana-cloudwatch-policy"
  policy      = data.aws_iam_policy_document.grafana_cloudwatch.json
}

resource "aws_iam_role_policy_attachment" "DataSourceCloudwatchPolicy" {
  policy_arn = aws_iam_policy.data_source_policy.arn
  role       = aws_iam_role.cloudwatch_role.name
}

data "aws_iam_policy_document" "grafana_datasource" {
  statement {
    sid    = "AllowReadingMetricsFromCloudWatch"
    effect = "Allow"
    actions = [
      "cloudwatch:ListMetrics",
      "cloudwatch:GetMetricStatistics",
      "cloudwatch:GetMetricData"
    ]

    resources = ["*"]

    condition {
      test     = "StringEquals"
      variable = "aws:ResourceTag/Project"
      values = [
        "${local.cluster_name}"
      ]
    }
  }
  statement {
    actions   = ["sts:AssumeRole"]
    resources = [aws_iam_role.grafana_datasource.arn]
  }
}

locals{
  common_tags = {
    Project     = local.cluster_name
    Provisioner = "TERRAFORM"
    Environment = local.environment
  }
}

resource "aws_iam_policy" "data_source_policy" {
  name_prefix = "${local.cluster_name}-grafana-cloudwatch-policy"
  policy      = data.aws_iam_policy_document.grafana_datasource.json
  tags        = local.common_tags
}

   ~ resource "aws_iam_role" "codedeploy" {
      ~ assume_role_policy    = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Principal = {
                          ~ Service = [
                              - "<http://codedeploy.amazonaws.com|codedeploy.amazonaws.com>",
                                "<http://ecs-tasks.amazonaws.com|ecs-tasks.amazonaws.com>",
                              + "<http://codedeploy.amazonaws.com|codedeploy.amazonaws.com>",
                            ]
                        }
                        # (3 unchanged elements hidden)
                    },
                ]
                # (1 unchanged element hidden)
            }
        )

                              - "<http://codedeploy.amazonaws.com|codedeploy.amazonaws.com>",
                                "<http://ecs-tasks.amazonaws.com|ecs-tasks.amazonaws.com>",
                              + "<http://codedeploy.amazonaws.com|codedeploy.amazonaws.com>",

 ~ resources              = [
          - {
              - autoscaling_groups              = [
                  - {
                      - name = "eks-xxxx"
                    },
                ]
              - remote_access_security_group_id = ""
            }, 

  count = length(aws_db_instance.db_instance) 
 on aws_cloudwatch_alarm.tf line 4, in resource "aws_cloudwatch_metric_alarm" "unhealthyhosts":
   4:   alarm_name          = "${aws_db_instance.db_instance[count.index].identifier}.${var.environment} unhealthy machine in ${aws_db_instance.db_instance[count.index].identifier}!"
    |----------------
    | aws_db_instance.db_instance is object with 66 attributes
    | count.index is 27