#terragrunt - December 2020

Hi, do you know if there is a way to specify which AWS credentials to use in kubergrunt please?

for example

kubergrunt eks deploy --region eu-west-1 --asg-name k8s_workers_windows --kubectl-context-name k8s-test

only works when targeting my default AWS account

to make the command work with any other account, I need to export the AWS access and secret keys like so:

export AWS_ACCESS_KEY_ID=
export AWS_SECRET_ACCESS_KEY=

You can probably use the AWS_PROFILE env var

yep, that worked. thanks!

not sure how easy/hard it would be to add the AWS profile to kubergrunt but that it would be a nice to have...

thanks @Patrick Joyce!

Is there a way to do good old terraform in a terragrunt.hcl file?

I would like to construct iam policy documents using data calls and then passing them in the inputs = { }

in order to use https://github.com/cloudposse/terraform-aws-iam-role

I haven't tested it, but you might be able to do it by:
• Adding a generate block in terragrunt to write out a data source into your terraform module
• Putting an override.tf file next to your terragrunt.hcl file where you override the policy field of the role to point to your generated data source
Override files docs: https://www.terraform.io/docs/configuration/override.html

Personally, I just use jsonencode and create the IAM Policy in terragrunt 🤷‍♂️

jsonencode is really nice because you can use terragrunt vars / dependency outputs the same way you'd use with iam_policy data sources

Can you paste an example of using jsonencode?

I am guessing what you mean is you’re using a module written in terraform that uses jsonecode to generate IAM policy documents using the output of dependency blocks in terragrunt

include {
  path = find_in_parent_folders("terragrunt-config-dev.hcl")
}

terraform {
  source = "git::git@github.com:terraform-aws-modules/terraform-aws-iam//modules/iam-policy?ref=v3.4.0"
}

dependency datadog_param {
  config_path = "${get_parent_terragrunt_dir()}/foo/bar/datadog_ssm_param"
}

dependency ssh_key_param {
  config_path = "${get_parent_terragrunt_dir()}/foo/baz/ssh_key_param"
}

inputs = {
  name        = "FooBarPolicy"
  description = "demo policy"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "AllowFetchingSecrets"
        Effect = "Allow"
        Action = [
          "ssm:GetParameter",
          "ssm:GetParameters",
          "secretsmanager:GetSecretValue"
        ]
        Resource = [
          dependency.datadog_param.outputs.arn,
          dependency.ssh_key_param.outputs.arn,
        ]
      },
      {
        Sid      = "AllowReadingKms",
        Effect   = "Allow",
        Action   = "kms:*",
        Resource = "*",
      }
    ]
  })
}

Nah, I create the policy entirely in terragrunt

hm

What does datadog_param do?

Is it just a data-call module?

It's just another module. In this case, it creates an SSM SecureString parameter. Then this policy module says to create an IAM Policy that has permissions to read/decrypt that SSM Parameter's value

Do you store the value of the DD api key in SSM using terraform?

My policy also needs access to a DD key lol

I am just curious to know how you’re doing it

yeah I do. We use Vault as our source of truth for secrets, and then have a really basic module that copies a Vault Secret -> SSM for when using SSM is easier than Vault for some service

We also have a Lambda function that copies keys in bulk from Vault -> SSM, and then in our policies we use a prefix + wildcard for the output of that lambda run

Needing help with setting terragrunt to use aws assume role

I’m having a hard time understanding how to setup assume role

Hello! Have you seen https://terragrunt.gruntwork.io/docs/features/work-with-multiple-aws-accounts/? If so, do you have any questions that I could expand on?

Thx @David I’ve read it but still a bit lost

that makes sense, I remember it took me a while to get it working the first time. What do you have so far? Do you already have a set of IAM Roles you are trying to use?

And are you trying to get this to work locally, or on a CI system, or both?

anyone have example code of best standards for handling route53 with terragrunt?

Interested in knowing how others are doing testing changes locally before pushing to a remote, in particular ones that support plan-all/apply-all commands

currently I use --terragrunt-source with a path directly to the module which I would like to apply local changes to

this doesn’t work well for a plan all scenario, terragrunt will complain that it isn’t able to find modules for the other terragrunt modules

--terragrunt-source ~/dev/work/forks/example-infrastructure-modules//example-service for example

I have tried just passing the path to the module folder but ran into errors

has anyone run into this issue when running terragrunt plan

Failed to get existing workspaces: S3 bucket does not exist

running terragrunt plan does create the bucket for me but yet it's stating it cannot find an existing bucket. The only way to get around this is if i wack out the .terragrunt-cache dir

Hey all, just wanted to make sure it was put here for anyone who didn’t see it on the Office-Hours this past week. Remote-Run support for Terragrunt is now available in env0!: https://www.env0.com/blog/terragrunt-release