#terraform - December 2021 | Slack Archive

79 messages

Archive: https://archive.sweetops.com/terraform/

Nov 2021

December 2021

Jan 2022

rssabout 4 years ago

v1.1.0-rc1
1.1.0-rc1 (Unreleased)
UPGRADE NOTES:

Terraform on macOS now requires macOS 10.13 High Sierra or later; Older macOS versions are no longer supported.

The terraform graph command no longer supports -type=validate and -type=eval options. The validate graph is always the same as the plan graph anyway, and the "eval" graph was just an implementation detail of the terraform console command. The default behavior of creating a plan graph should be a reasonable replacement for both of the removed...

Ryan Rykeabout 4 years ago

hey guys and gals, has anyone done the work to allow for awsfirelens in fargate https://github.com/cloudposse/terraform-aws-ecs-web-app/blob/master/variables.tf#L522

Ryan Rykeabout 4 years ago

seems to me the way the options are configured wouldnt allow it https://github.com/cloudposse/terraform-aws-ecs-web-app/blob/master/main.tf#L95

DaniC (he/him)about 4 years ago(edited)

hi folks, not sure if this is the right channel to ask:

how do you manage the K8s objects?

1. tf (which will deploy eks ) + helm + charts ?
2. tf (which will deploy eks) + argocd + helm charts ?
3. tf + kustomize (no helm)?
4. others ?
anyone has any feedback between choosing helm vs kustomize ?

RBabout 4 years ago

Please upvote if you want a progress bar in terraform https://github.com/hashicorp/terraform/issues/28512

Evair Marinho Vilas Boas Porfirioabout 4 years ago

Hey guys! I hope you are all right! I would like to know what different tasks the terraform-provider-awsutils provider performs. Would someone know how to answer me?

MrAtheistabout 4 years ago

Anyone tried to tf apply org cloudtrail and got denied because the “cloudtrail service” hasnt been enabled for the org? Any hack to automate this step and not have to resort to manual clicking in the console?
• seems like it’s not recommended to enable cloudtrail as part of the org…
• but then i dont see any “toggle” under cloudtrail besides literally creating a new trail and check “enable for all accounts in my organization”

MrAtheistabout 4 years ago

Davidabout 4 years ago

Is anyone familiar with a method to get this dynamic statement

  dynamic "statement" {
    for_each = var.principals_lambda

    content {
      effect  = "Allow"
      actions = [
        "ecr:BatchGetImage",
        "ecr:GetDownloadUrlForLayer"
      ]

      principals {
        type        = "Service"
        identifiers = ["<http://lambda.amazonaws.com|lambda.amazonaws.com>"]
      }

      condition {
        test     = "StringLike"
        values   = formatlist("arn:${data.aws_partition.current.partition}:lambda:*:%s:function:*", var.principals_lambda)
        variable = "aws:sourceArn"
      }
    }
  }

to return the following:

+ {
                      + Action    = [
                          + "ecr:GetDownloadUrlForLayer",
                          + "ecr:BatchGetImage",
                        ]
                      + Condition = {
                          + StringLike = {
                              + aws:sourceArn = [
                                  + "arn:aws:lambda:*:222222222222:function:*",
                                  + "arn:aws:lambda:*:333333333333:function:*"
                                ]
                            }
                        }
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "<http://lambda.amazonaws.com|lambda.amazonaws.com>"
                        }
                      + Sid       = "LambdaECRImageCrossAccountRetrievalPolicy"
                    },

rather than

+ {
                      + Action    = [
                          + "ecr:GetDownloadUrlForLayer",
                          + "ecr:BatchGetImage",
                        ]
                      + Condition = {
                          + StringLike = {
                              + aws:sourceArn = [
                                  + "arn:aws:lambda:*:222222222222:function:*",
                                  + "arn:aws:lambda:*:333333333333:function:*"
                                ]
                            }
                        }
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "<http://lambda.amazonaws.com|lambda.amazonaws.com>"
                        }
                      + Sid       = ""
                    },
                  + {
                      + Action    = [
                          + "ecr:GetDownloadUrlForLayer",
                          + "ecr:BatchGetImage",
                        ]
                      + Condition = {
                          + StringLike = {
                              + aws:sourceArn = [
                                  + "arn:aws:lambda:*:222222222222:function:*",
                                  + "arn:aws:lambda:*:333333333333:function:*"
                                ]
                            }
                        }
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "<http://lambda.amazonaws.com|lambda.amazonaws.com>"
                        }
                      + Sid       = ""
                    },

Davidabout 4 years ago

for_each is acting as intended, but we only want it to loop once

Justin Kingabout 4 years ago(edited)

did you try updating your foreach to simply run on a match condition instead of iterating?

for_each = var.principals_lambda != {} ? ["statement"] : []

Vikram Yerneniabout 4 years ago

Fellas, I do have a module that basically creates S3 bucket (using typical terraform resource "aws_s3_bucket") with given terraform code that includes properties like "lifecycle_rule, server_side_encryption_configuration & logging" added in my main.tf file and we use Gitlab for the CI setup.
However, I am trying to setup my Gitlab merge request process only goes through when ONLY RUNS WHEN THE ABOVE PROPERTIES ARE ADDED TO THE MAIN.TF FILE. I am not sure if this can be controlled at Terraform plan level or even before.
Anyone here in the community set this type of setup before?

Kevin Neufeld(PayByPhone)about 4 years ago(edited)

If have time and do not mind to help promote with 👍️ on a PR for a new terraform aws resource rds_cluster_activity_stream one my colleagues is trying to get merged. I will be would be greatly appreciated.

Thank you in advance.
https://github.com/hashicorp/terraform-provider-aws/pull/22097

Adam McKinleyabout 4 years ago(edited)

Hi all. I’ve got this code in my main.tf:

module "user" {
  source = "cloudposse/iam-user/aws"
  version = "0.8.1"

  name = "adam"
  user_name = "<mailto:adam@awmckinley.net|adam@awmckinley.net>"
  pgp_key = "keybase:awmckinley"
  groups = []
}

Getting this error message:

Do you want to perform these actions in workspace "gbl-root"?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes 

module.user.aws_iam_user.default[0]: Creating...
 
Error: Error creating IAM User <mailto:adam@awmckinley.net|adam@awmckinley.net>: InvalidClientTokenId: The security token included in the request is invalid
        status code: 403, request id: e55b8264-73ea-47d8-865b-712c193054fb

Any suggestions?

aimbotdabout 4 years ago(edited)

AWS is still pooping all over the bed. I wouldn't really attempt to work on AWS until all issues are resolved.

Adam McKinleyabout 4 years ago

Got it.

Adam McKinleyabout 4 years ago

Didn’t see the news about the outage.

Adam McKinleyabout 4 years ago(edited)

Thanks! 🙂

aimbotdabout 4 years ago

Oh yea. It's been a dumpster fire all morning.

Adam McKinleyabout 4 years ago

Looking at the Personal Health Dashboard shows issues only in us-east-1

Adam McKinleyabout 4 years ago

https://phd.aws.amazon.com/phd/home#/dashboard/open-issues

aimbotdabout 4 years ago

Yes and also very much no.

aimbotdabout 4 years ago

Various services have dependencies on services within us-east-1, such as STS, iam, auth, etc.

PePe Amengualabout 4 years ago

us-east-1 is the center of everything pretty much

PePe Amengualabout 4 years ago

what he said

PePe Amengualabout 4 years ago

S3 auth, SSL certs, Cloudfront TLS and a bunch of other stuff

aimbotdabout 4 years ago

I'm in us-east-2 but I put a freeze on all deployments because theres a chance that a deployment to prod may not come online due to some unseen dependencies within AWS.

aimbotdabout 4 years ago

For instance, the aws console was down for everyone in every region today for the better part of the day. 5 hours at the very least.

Adam McKinleyabout 4 years ago

Dang. Well, thanks for educating me about the hidden dependencies on us-east-1. Didn’t know.

lorenabout 4 years ago

my favorite is that within the console (if you had a session from before the outage began), it started reporting that the us-east-1 region was "invalid" 😂

lorenabout 4 years ago

they fixed that maybe 30 minutes ago. i'm really glad that they found it

aimbotdabout 4 years ago

We always joke about regional failure and what to do and more often than not, people are like, well, its an entire region goes out, we're probably at war.

aimbotdabout 4 years ago

And then AWS comes to the party and says ha, heres your regional outage ya plebs.

Adam McKinleyabout 4 years ago

lol

aimbotdabout 4 years ago

For instance, amazon warehouses and deliveries that we're out by 8am pst today, have been grounded since 8am today.

aimbotdabout 4 years ago

https://www.cnbc.com/2021/12/07/amazon-web-services-outage-causes-issues-at-disney-netflix-coinbase.html

The outage also brought down critical tools used inside Amazon. Warehouse and delivery workers, along with drivers for Amazon’s Flex service, reported on Reddit that they couldn’t access the Flex app or the AtoZ app, making it impossible to scan packages or access delivery routes.

lorenabout 4 years ago

maybe it's a reinvent hangover

aimbotdabout 4 years ago

I was going to share some tweets about it but they appear to all have been deleted.

aimbotdabout 4 years ago

At least the ones I had from earlier.

Alex Jurkiewiczabout 4 years ago

next time someone mentions how "simple" multi-region redundancy is, or how it's "critical" for your business to grow to the next level, point out AWS has probably 0.1% annual downtime because of us-east-1, and they are doing fine

aimbotdabout 4 years ago

To be fair, as long as you don't consider the data requirement, it is pretty simple.

aimbotdabout 4 years ago

Even if you do consider it, RDS has cross region replication.

aimbotdabout 4 years ago

its not that hard ... but its definitely a time/effort/cost triangle.

Vlad Ionescu (he/him)about 4 years ago

🤣

PePe Amengualabout 4 years ago

Just do not use Databases

PePe Amengualabout 4 years ago

it is 2021!!!!

Adam McKinleyabout 4 years ago

Hi all. I’m still getting the same problem as last night. So no one has to scroll: I’ve got this code in my main.tf:

module "user" {
  source = "cloudposse/iam-user/aws"
  version = "0.8.1"

  name = "adam"
  user_name = "<mailto:adam@awmckinley.net|adam@awmckinley.net>"
  pgp_key = "keybase:awmckinley"
  groups = []
}

Getting this error message:

Do you want to perform these actions in workspace "gbl-root"?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes 

module.user.aws_iam_user.default[0]: Creating...
 
Error: Error creating IAM User <mailto:adam@awmckinley.net|adam@awmckinley.net>: InvalidClientTokenId: The security token included in the request is invalid
        status code: 403, request id: e55b8264-73ea-47d8-865b-712c193054fb

I’m using the root account with access ID and secret key. I know it’s not best practice, but is there any reason this should fail besides the AWS outage?

J Normentabout 4 years ago

I have a situation where I need to manually set up the .terraform directory for locally running init and validate. I’d like init to not change (at least two modules that) I set up. Is there a way to do that?

rssabout 4 years ago

v1.1.0
1.1.0 (December 08, 2021)
Terraform v1.1.0 is a new minor release, containing some new features and some bug fixes whose scope was too large for inclusion in a patch release.
NEW FEATURES:

moved blocks for refactoring within modules: Module authors can now record in module source code whenever they've changed the address of a resource or resource instance, and then during planning Terraform will automatically migrate existing objects in the state to new addresses.
This therefore avoids the...

DaniC (he/him)about 4 years ago

hi folks, in case someone has real exp with TF and CDK, you mind sharing your thoughts wrt why should you embrace one or another?

Bit of context:

Am familiar with CFN and TF but not much with CDK (even though i know the more you go to L1 construct the more you gonna hit same issues with CFN yaml) and i'd like to try out and not judge based on:

• CDK is vendor lock-in -> not caring as is AWS shop only for now and forever
• marketing or personal pref in picking one or another
In essence i'm thinking for a cdk aws shop, what will be required to move away from it to TF and what business value will bring (not just for the sake of doing it cause ... is cool)

Laurynasabout 4 years ago

Hi, how can I output ip addresses of the nlb created with terraform?

Grummfyabout 4 years ago

look at the doc : https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb#import you have all the attribute et argument reference :
• ipv6 : https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb#ipv6_address
• ipv4 https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb#private_ipv4_address
• allocation id https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb#allocation_id (so you can load it with the data of eip)

michael sewabout 4 years ago

Question about the Cloudwatch Log Groups that are enabled by turning on RDS Enabling Exports (ie. ["alert", "audit", "listener", "trace"]), do those log groups get tagged by terraform? I'm finding that they're not. Is there a param I'm supposed to set?

resource "aws_db_instance" "default" {
  enabled_cloudwatch_logs_exports = ["alert", "audit", "listener", "trace"]
  tags                            = var.tags

Erik Osterman (Cloud Posse)about 4 years ago

https://www.cnbc.com/amp/2021/12/09/cloud-software-maker-hashicorp-hcp-starts-trading-on-nasdaq.html

Jamie Kabout 4 years ago

This looks like a breaking change was introduced where replica DNS for RDS clusters is only created if the configuration is serverless?
https://github.com/cloudposse/terraform-aws-rds-cluster/blob/master/main.tf#L331
would this have been intentional for any sort of reason? trying to pull my configuration forward and its not serverless and will remove the DNS record.

Benjamin Boyleabout 4 years ago

Hi! I'm looking for someone who can help me with small (paid) ad-hoc projects involving terraform and kubernetes. I'm a devops beginner launching a new product. The terraform/kubernetes side of it is really small and simple, but occasionally challenges come up that I can't solve, (or which take much too long for me to learn how to solve).

For example, right now, I have kubernetes ingress working fine with the AWS Load Balancer Controller. (AWS Load balancers are created to serve the k8 ingresses). But I'm having trouble installing certmanager and solving letsencrypt http challenges. The first project would be to get the tls features working.

Onboarding is really fast. It's all on github with a remote backend, and I've setup a docker container command tools environment that has everythign you need in just a couple of minutes onboarding.

I'd really appreciate (and enjoy) having a friend/consultant to help out when it's too hard for me. Thank you in advance for reaching out.

Benjamin Boyleabout 4 years ago

This is the .tf code I'm having trouble with (as you can see, it's very small) https://github.com/FastFinTech/FFT.Signals.GitOps/blob/main/ingress.tf

batman_93about 4 years ago

Hi, Can someone please take a look at this reddit post and help me out? https://www.reddit.com/r/Terraform/comments/rf2473/access_value_from_map_of_list/
I am trying to remove a duplicate var in the main.tf.

Mark Garringerabout 4 years ago

Is it possible to create multiple Client VPNs in the same region with different VPCs using https://github.com/cloudposse/terraform-aws-ec2-client-vpn? I'm using the SSM functionality to store the cert information and it seems like there's no way to specify new key names for the SSM keys, and collisions occur?

jonjitsuabout 4 years ago

What are the options for keeping secrets out of the state file?

PePe Amengualabout 4 years ago

@Andriy Knysh (Cloud Posse) is it possible to create resources without tags? ( using cloudposse module that uses context)

Sam Bishopabout 4 years ago

We really need some kind of Cloudposse published artifact list for helping https://github.com/cloudposse/terraform-external-module-artifact with "broken defaults"... because https://github.com/cloudposse/terraform-aws-ses-lambda-forwarder/issues/13 seems to be back, but since the module doesnt log the actual curl request anywhere I have no log of the actually attempted url, and also no way to know what the correct one to try explicitly setting it to is... because its just an S3 bucket and if i don't know the key... well then I just get 404.

Sam Bishopabout 4 years ago

"dynamic subgraph encountered errors: failed to execute "curl": curl: (22) The requested URL returned error: 404" is not a lot to go on for debugging...

jonjitsuabout 4 years ago

Any thoughts/opinions on kitchen-terraform?

Ben Dubuissonabout 4 years ago

Hi, using the https://github.com/cloudposse/terraform-aws-sso repo and getting some strange errors when applying changes:

ConflictException: Could not delete because PermissionSet has ApplicationProfile associated with it

Has anyone ever seen those?

rssabout 4 years ago(edited)

v1.1.1
1.1.1 (December 15, 2021)
BUG FIXES:
core: Fix crash with orphaned module instance due to changed count or for_each value (#30151)
core: Fix regression where some expressions failed during validation when referencing resources expanded with count or for_each (<a href="https://github.com/hashicorp/terraform/issues/30171"...

J Normentabout 4 years ago(edited)

Hi. I need to iterate through a list of objects that I’m using to build WAF ACLs. The trick here is that the order in the list absolutely matters. I’ve tried googling a number of keyword combinations of “for_each preserve order”, “for_each dynamic guarantee order”, and so on, and haven’t really found anything that can answer my question. How might I go about doing this? Any code that includes for / for_each and dynamic inside of a resource should give me what I need to get it implemented in my use-case.

IKabout 4 years ago

hey guys.. with authoring modules, do you prefer putting the complexity of your module in the front or backend? For e.g. assume i’m writing a module to create security groups. The expectation is that another team member can directly reference this module, pass it a YAML file with all the ingress/egress rules and a vpc_id.. should i be building my module to handle a single vpc_id and expect the user/consumer to handle all the front-end logic i.e. create for_each loops within their reference to the module, or should i make the front-end simple (where they can pass me either a single vpc_id or a list of vpc_ids) and then within the module, do my for_each loops etc; i keep switching back and forth between the 2 different ways.. part of me wants to keep the front end simple so consuming it is easy but then i’m having to write additional logic to handle the various permutations so thinking of shifting the complexity back to the user/consumer.. any ideas? cheers guys!

zeidabout 4 years ago

Anyone here using Terraform Enterprise? We are migrating from atlantis to TFE and was wondering how people deal with the issue where you can't do targeted applies when using VCS integration. Sometimes terraform has issues with planning and needs some help with targeted applies.

rssabout 4 years ago

v1.1.2
1.1.2 (December 17, 2021)
If you are using Terraform CLI v1.1.0 or v1.1.1, please upgrade to this new version as soon as possible.
Terraform CLI v1.1.0 and v1.1.1 both have a bug where a failure to construct the apply-time graph can cause Terraform to incorrectly report success and save an empty state, effectively "forgetting" all existing infrastructure. Although configurations that already worked on previous releases should not encounter this problem, it's possible that incorrect future...

OZZZYabout 4 years ago

Good morning, how can I change the configuration items not created by terraform with terraform?

Johanabout 4 years ago(edited)

only after you import them https://www.terraform.io/cli/import

PePe Amengualabout 4 years ago

is there a way to pass a permission boundary to TF provider instead of to a resource?

Brice Zakraabout 4 years ago(edited)

Hello Guys, I am working on a Postgres Flexible Server Terraform Module on Azure. I have found a documentation on Terraform but I am a little bit lost. Can anybody help me with that please? Does anybody ever worked on the same or similar project? Thanks

wabout 4 years ago

hi. i'm using
https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn
and wondering about error_document . The doc says the value used here is used for all 4xx errors.
When i set this value to a string like "error.html, however, it doesn't seem to do anything.

What is the expected result when using this input?

Slackbotabout 4 years ago

This message was deleted.

OliverSabout 4 years ago

has anyone used https://registry.terraform.io/providers/paultyng/sql/latest/docs/resources/migrate to initialize a DB (in RDS or Redshift) after creating it in AWS?

It seems a much nicer solution, state based, than using a local (which relies on local OS to provide db client and ssh client) or remote exec (which requires an ec2 to ssh into and it must have a db client like psql, not really appropriate for a bastion).

I'm guessing the provider tracks migrations via a table in the db but I have not checked the code.

Alec Fongabout 4 years ago

Hello, I am creating and deleting eks clusters using the https://github.com/cloudposse/terraform-aws-eks-cluster complete example and have run into this error multiple times. Is there anyway to resolve properly? My workaround has been terraform state rm module.eks_cluster.kubernetes_config_map.aws_auth_ignore_changes .

module.eks_cluster.kubernetes_config_map.aws_auth_ignore_changes[0]: Refreshing state... [id=kube-system/aws-auth]
╷
│ Error: Get "<http://localhost/api/v1/namespaces/kube-system/configmaps/aws-auth>": dial tcp [::1]:80: connect: connection refused
│ 
│   with module.eks_cluster.kubernetes_config_map.aws_auth_ignore_changes[0],
│   on .terraform/modules/eks_cluster/auth.tf line 115, in resource "kubernetes_config_map" "aws_auth_ignore_changes":
│  115: resource "kubernetes_config_map" "aws_auth_ignore_changes" {

michael sewabout 4 years ago(edited)

Q: Does anybody have any examples of AWS RDS Events to Pagerduty terraform code/modules? Lot of examples I see are RDS cloudwatch alarms, but not necessarily RDS events. Am I supposed to search for "SNS to Pagerduty" instead?

November 2021 Browse by date January 2022