#geodesic - March 2020 | Slack Archive

geodesic

46 messages

Discussions related to https://github.com/cloudposse/geodesic

Archive: https://archive.sweetops.com/geodesic/

Feb 2020

March 2020

Apr 2020

SweetOps #geodesicover 6 years ago

There are no events this week

Cloud Posseover 6 years ago

Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

This is an opportunity to ask us questions about INLINECODE_0, get live demos and learn from others using it. Next one is Mar 11, 2020 11:30AM.

👉️ Register for Webinar

#office-hours (our channel)

Cloud Posseover 6 years ago

👉️ Register for Webinar

#office-hours (our channel)

SweetOps #geodesicover 6 years ago

There are no events this week

Joe Nilandover 6 years ago

tl;dr:
Re: https://github.com/cloudposse/terraform-aws-acm-request-certificate
Do I need to maintain remote state resources (S3 and DynamoDB, aka tfstate-backend) in each region we need to create ACM certs?

This module works well, however we’re trying to create a certificate for example.com in two regions: ap-southeast-2 for direct usage in ELB’s and us-east-1 for CloudFront.

ap-southeast-2 is our default region and is where the remote state is stored.

The first run works, but when changing the provider region I found that, because we’re still using remote state in ap-southeast-2, Terraform thinks the certificate already exists in us-east-1 and fails when trying to refresh state.

I’m using geodesic so I’m thinking I need to change the region in following variables (probably in terraform.envc ?) to make this work:

TF_VAR_aws_default_region=ap-southeast-2
TF_VAR_tf_bucket_region=ap-southeast-2
TF_CLI_ARGS_init=-backend-config=region=ap-southeast-2 -backend-config=key=app-cert/terraform.tfstate -backend-config=bucket=acme-prod-terraform-state -backend-config=dynamodb_table=acme-prod-terraform-state-lock -backend-config=encrypt=true -from-module=git::<ssh://git>@bitbucket.org/acme/acme.infra.modules.git//modules/acm-request-certificate?ref=master .module
TF_VAR_aws_region=ap-southeast-2

Thanks!

Andriy Knysh (Cloud Posse)over 6 years ago

@Joe Niland that’s how we did it before https://github.com/cloudposse/terraform-root-modules/blob/master/aws/acm-cloudfront/main.tf

Andriy Knysh (Cloud Posse)over 6 years ago

or you can provide a separate provider to the module by using

providers = {
    aws = aws.east
  }

Andriy Knysh (Cloud Posse)over 6 years ago

https://www.terraform.io/docs/configuration/providers.html

Joe Nilandover 6 years ago(edited)

@Andriy Knysh (Cloud Posse) thanks! I did set aws provider region to var.aws_region and then it does hit the acm.us-east1. endpoint, but it seems the issue is that I need to change the terraform backend to be in us-east-1 also. Would that be correct?

Joe Nilandover 6 years ago

Since we have already created the cert in another region, Terraform expects it to be there and then fails because the API call to acm.us-east-1 returns 404

Joe Nilandover 6 years ago

At least, that’s what I think is happening

Andriy Knysh (Cloud Posse)over 6 years ago

backend needs to have the region where you provisioned the bucket and dynamo table for it

Andriy Knysh (Cloud Posse)over 6 years ago

  backend "s3" {
    encrypt              = true
    bucket               = "..."
    key                  = "terraform.tfstate"
    dynamodb_table       = "...."
    region               = "us-east-1"
  }

Joe Nilandover 6 years ago

I used the cold start process so it’s all defined in the Dockerfile

# Terraform State Bucket
ENV TF_BUCKET_PREFIX_FORMAT="basename-pwd"
ENV TF_BUCKET_ENCRYPT="true"
ENV TF_BUCKET_REGION="${AWS_REGION}"
ENV TF_BUCKET="${NAMESPACE}-${STAGE}-terraform-state"
ENV TF_DYNAMODB_TABLE="${NAMESPACE}-${STAGE}-terraform-state-lock"

Joe Nilandover 6 years ago

so I guess I need to override it for this module?

Andriy Knysh (Cloud Posse)over 6 years ago

so for that particular project, you specify the backend with one region, then add a provider for another region and add that provider to the cert module

Joe Nilandover 6 years ago

ok, thanks very much. I will try that.

Andriy Knysh (Cloud Posse)over 6 years ago

TF will use that backend but will read the cert resources using that provider

Joe Nilandover 6 years ago

ok, cool. I’ll see what I can do. Thanks @Andriy Knysh (Cloud Posse)!

Andriy Knysh (Cloud Posse)over 6 years ago(edited)

yea, so in short, you can specify any regions for the backend and for a set of providers, and TF will use them. Or you can even go cross-account (for any resource you want) if you specify assume_role (granted that the user/role you are using to provision has permissions to assume that cross-account role, and the cross-account role has enabled assuming it in its trust policy)

Joe Nilandover 6 years ago

ok, I see

Joe Nilandover 6 years ago

And is it assumed that I need to run https://github.com/cloudposse/terraform-root-modules/blob/master/aws/tfstate-backend for each region as well?

Andriy Knysh (Cloud Posse)over 6 years ago

that’s how you decide to use it. You can provision backend in just one account/region and store states from diff accounts/regions in it

Andriy Knysh (Cloud Posse)over 6 years ago(edited)

or you can provision backend for each account (or region, if it makes sense)

Joe Nilandover 6 years ago

I would prefer to use one region but it seems that this is causing my issue.

So I created a cert for example.com in ap-southeast-2.
Then I change the aws provider region to us-east-1 and run the module again to try to create a cert for example.com in ap-southeast-2

I get this error:

Error: Invalid index

  on .terraform/modules/acm_request_certificate/main.tf line 16, in locals:
  16:   domain_validation_options_list    = local.process_domain_validation_options ? aws_acm_certificate.default.0.domain_validation_options : []
    |----------------
    | aws_acm_certificate.default is empty tuple

The given key does not identify an element in this collection value.

And this is because:

2020-03-10T10:38:29.979Z [DEBUG] plugin.terraform-provider-aws_v2.52.0_x4: X-Amz-Target: CertificateManager.DescribeCertificate
2020-03-10T10:38:29.979Z [DEBUG] plugin.terraform-provider-aws_v2.52.0_x4: Accept-Encoding: gzip
2020-03-10T10:38:29.979Z [DEBUG] plugin.terraform-provider-aws_v2.52.0_x4: 
2020-03-10T10:38:29.979Z [DEBUG] plugin.terraform-provider-aws_v2.52.0_x4: {"CertificateArn":"arn:aws:acm:ap-southeast-2:xx:certificate/4252bd2a-...-...-...-..."}
...
2020-03-10T10:38:30.949Z [DEBUG] plugin.terraform-provider-aws_v2.52.0_x4: 2020/03/10 10:38:30 [DEBUG] [aws-sdk-go] DEBUG: Validate Response acm/DescribeCertificate failed, attempt 0/25, error ResourceNotFoundException: Could not find Certificate for Account xx
2020/03/10 10:38:30 [ERROR] module.acm_request_certificate: eval: *terraform.EvalLocal, err: Invalid index: The given key does not identify an element in this collection value.

Joe Nilandover 6 years ago

The ARN it’s trying to find is from the ap-southeast-2 region

Joe Nilandover 6 years ago(edited)

Maybe the issue is that internally the ACM cert state doesn’t contain region

Joe Nilandover 6 years ago

I guess I can get around this by just using multiple modules actually - since then they’ll have their own state file in s3

Andriy Knysh (Cloud Posse)over 6 years ago

If you need two certificates in different regions, you instantiate the module two times and give them different providers, one per region

Andriy Knysh (Cloud Posse)over 6 years ago(edited)

Where the backend is, doesn’t matter - it has it’s own region param

Andriy Knysh (Cloud Posse)over 6 years ago

It could be in one of those regions

Andriy Knysh (Cloud Posse)over 6 years ago

Or in a completely different

Andriy Knysh (Cloud Posse)over 6 years ago

Backend is a separate part of terraform

Andriy Knysh (Cloud Posse)over 6 years ago

Not related to AWS providers

Joe Nilandover 6 years ago

OK, I see.
I think that is how it should work, but it isn’t because aws_acm_certificate.default.0.domain_validation_options is referencing something that is found in the backend but isn’t found in the region.

Joe Nilandover 6 years ago

I will keep messing around and see what I can find. Thanks again for your help!

Andriy Knysh (Cloud Posse)over 6 years ago

looks like the state is messed up

Andriy Knysh (Cloud Posse)over 6 years ago

I would delete eveything and start with instantiating the module two times with diff provider per region

Joe Nilandover 6 years ago

ok good advice - will start from scratch

Tega McKinneyover 6 years ago

We may have a scenario where we need to change our Root AWS Account for our organization. While I’ve done this for accounts without Geodesic, is it recommended for a set accounts setup against the reference architecture? Any recommended steps to take and things to watch out for?

SweetOps #geodesicover 6 years ago

There are no events this week

Cloud Posseover 6 years ago

👉️ Register for Webinar

#office-hours (our channel)

Cloud Posseover 6 years ago

👉️ Register for Webinar

#office-hours (our channel)

skel84over 6 years ago

Hi, if i want to start with the reference architecture, shall i follow this https://docs.cloudposse.com/reference-architectures/cold-start/ or this https://github.com/cloudposse/reference-architectures ?

Erik Osterman (Cloud Posse)over 6 years ago

Adding @U010XGY9B46 bot

Cloud Posseover 6 years ago

👉️ Register for Webinar

#office-hours (our channel)

February 2020 Browse by date April 2020