#terraform - September 2018

* module.vpc_peering.data.aws_route_table.requestor: data.aws_route_table.requestor: value of 'count' cannot be computed

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "1.40.0"

  name = "hub-vpc"
  cidr = "${var.bit_mask_16}.0.0/16"
  azs             = ["${var.az_a}"]
  private_subnets = ["${var.bit_mask_16}.1.0/24"]
  public_subnets  = ["${var.bit_mask_16}.101.0/24"]

  enable_nat_gateway = true
  enable_vpn_gateway = false

  tags = {
    Terraform = "true"
    Environment = "hub"
  }
}

module "vpc_peering" {
  source           = "git::<https://github.com/cloudposse/terraform-aws-vpc-peering.git?ref=master>"
  namespace        = "hub"
  stage            = "dev"
  name             = "hub-to-mc"
  requestor_vpc_id = "${module.vpc.vpc_id}"
  acceptor_vpc_id  = "${var.mc_vpc_id}"

  tags = {
    Terraform = "true"
    Environment = "hub"
  }
}

terraform plan -target=module.vpc
terraform apply -target=module.vpc

terraform plan
terraform apply

with Aurora MySQL you can setup a cross-region Aurora Replica from the RDS console. The cross-region replication is based on single threaded MySQL binlog replication and the replication lag will be influenced by the change/apply rate and delays in network communication between the specific regions selected. Aurora PostgreSQL does not currently support cross-region replicas

  source             = "git::<https://github.com/cloudposse/terraform-aws-rds-cluster.git?ref=tags/0.4.3>"

resource "aws_db_subnet_group" "replica" {
  name       = "replica"
  subnet_ids = ["xxxxxxx", "xxxxxxx", "xxxxxx"]
}

resource "aws_kms_key" "repica" {
  deletion_window_in_days = 10
  enable_key_rotation     = true
}

resource "aws_db_instance" "replica" {
  identifier                  = "replica"
  replicate_source_db         = "${var.source_db_identifier}"
  instance_class              = "${var.instance_class}"
  db_subnet_group_name        = "${aws_db_subnet_group.replica.name}"
  storage_type                = "io1"
  iops                        = 1000
  monitoring_interval         = "0"
  port                        = 5432
  kms_key_id                  = "${aws_kms_key.repica.arn}"
  storage_encrypted           = true
  publicly_accessible         = false
  auto_minor_version_upgrade  = true
  allow_major_version_upgrade = true
  skip_final_snapshot         = true
}

provider "aws" {
  alias  = "remote"
  region = "us-west-2"
}

module "database_remote_replica" {
  source = "..."

  providers = {
    aws = "aws.remote"
  }

  namespace            = "eg"
  stage                = "prod"
  instance_class       = "..."
  source_db_identifier = "<ARN>"
}

but when you actually specify the DB Arn and try to run the script terraform spits out ” You cannot set up replication between a DB instance and a DB cluster across regions.”

$ terraform plan
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.

data.terraform_remote_state.root: Refreshing state...
data.aws_iam_policy_document.login: Refreshing state...
data.aws_iam_policy_document.assume_role: Refreshing state...

------------------------------------------------------------------------

Error: Error running plan: 11 error(s) occurred:

* module.ecr.output.policy_write_name: Resource 'aws_iam_policy.write' not found for variable 'aws_iam_policy.write.name'
* module.ecr.output.role_arn: Resource 'aws_iam_role.default' does not have attribute 'arn' for variable 'aws_iam_role.default.*.arn'
* module.ecr.output.role_name: Resource 'aws_iam_role.default' does not have attribute 'name' for variable 'aws_iam_role.default.*.name'
* module.ecr.aws_iam_instance_profile.default: 1 error(s) occurred:

* module.ecr.aws_iam_instance_profile.default: Resource 'aws_iam_role.default' not found for variable 'aws_iam_role.default.name'
* module.ecr.output.policy_write_arn: Resource 'aws_iam_policy.write' not found for variable 'aws_iam_policy.write.arn'
* module.ecr.aws_iam_role_policy_attachment.default_ecr: 1 error(s) occurred:

* module.ecr.aws_iam_role_policy_attachment.default_ecr: Resource 'aws_iam_role.default' not found for variable 'aws_iam_role.default.name'
* module.ecr.output.policy_login_name: Resource 'aws_iam_policy.login' not found for variable 'aws_iam_policy.login.name'
* module.ecr.output.policy_read_arn: Resource 'aws_iam_policy.read' not found for variable 'aws_iam_policy.read.arn'
* module.ecr.output.policy_read_name: Resource 'aws_iam_policy.read' not found for variable 'aws_iam_policy.read.name'
* module.ecr.output.policy_login_arn: Resource 'aws_iam_policy.login' not found for variable 'aws_iam_policy.login.arn'
* module.ecr.data.aws_iam_policy_document.default_ecr: 1 error(s) occurred:

* module.ecr.data.aws_iam_policy_document.default_ecr: Resource 'aws_iam_role.default' not found for variable 'aws_iam_role.default.arn'

provider "aws" {
    alias = "assume_repo_admin"
    assume_role {
        role_arn     = "arn:aws:iam::${data.terraform_remote_state.root.account_repo_id}:role/OrganizationAccountAccessRole"
        session_name = "setup_account_repo"
    }
}

# create ECR repositories

module "ecr" {
    providers = {
        aws = "aws.assume_repo_admin"
    }
    source      = "git::<https://github.com/cloudposse/terraform-aws-ecr.git?ref=master>"
    name        = "cloud/databank_fe"
    namespace   = "repo"
    stage       = "travis"
}

  solution_stack_name:          "" => "64bit Amazon Linux 2018.03 v2.8.1 running PHP 7.2"
  tags.%:                       "" => "4"
  tags.Environment:             "" => ""

* module.elastic_beanstalk_environment.aws_elastic_beanstalk_environment.default: 1 error(s) occurred:

* aws_elastic_beanstalk_environment.default: InvalidParameter: 1 validation error(s) found.
- minimum field size of 1, CreateEnvironmentInput.Tags[0].Value.

tags = {
  "Environment" = "example"
}

terraform {
  required_version = ">= 0.11.3"
  
  backend "s3" {
    region         = "us-east-1"
    bucket         = "< the name of the S3 bucket >"
    key            = "terraform.tfstate"
    dynamodb_table = "< the name of the DynamoDB table >"
    encrypt        = true
  }
}

"Outputs": {
  "OutputName": {
    "Condition": //ConditionName,
    // Normal Output Arguments
  }
}

  resource "aws_cloudformation_stack" "autoscaling_group" {
   count = ".... create t/f
.......
    "Outputs": {
      "AsgName": {
        "Description": "The name of the auto scaling group",
         "Value": {"Ref": "${local.name}"}
      }
    }
  }
  EOF
  }

output "datapipeline_ids" {
  value       = "${aws_cloudformation_stack.datapipeline.outputs["DataPipelineId"]}"
  description = "Datapipeline ids"
}

locals {
  list = "${coalescelist(aws_cloudformation_stack.datapipeline.*.outputs, list(map("DataPipelineId", "")))}"
  map  = "${local.list[0]}"
  item = "${lookup(local.map, "DataPipelineId", "")}"
}

output "datapipeline_ids" {
  value       = "${local.item}"
  description = "Datapipeline ids"
}

functions:
  index:
    handler: handler.hello
    events:
      - http: GET hello

data "archive_file" "lambda_py_0" {
  type        = "zip"
  source_file = "${local.lambda_py_0_source_file}"
  output_path = "${local.lambda_py_0_zip}"

  depends_on = ["null_resource.py_0_build"]
  count      = "${local.lambda_py_0_count}"
}

* aws_ecs_service.default: InvalidParameterException: The target group with targetGroupArn arn:aws:elasticloadbalancing:us-west-2:629113624323:targetgroup/bv-staging-hw/c0cd39cd95d47b66 does not have an associated load balancer.
	status code: 400, request id: bb3f68be-b905-11e8-a342-17f3363522bb "bv-staging-hw"

module "alb" {
source             = "git::<https://github.com/cloudposse/terraform-aws-alb.git?ref=tags/0.2.5>"
name               = "cluster"
namespace          = "${var.namespace}"
stage              = "${var.stage}"
attributes         = "${var.attributes}"
vpc_id             = "${module.vpc.vpc_id}"
ip_address_type    = "ipv4"
subnet_ids         = ["${module.subnets.public_subnet_ids}"]
security_group_ids = ["${module.vpc.vpc_default_security_group_id}"]
access_logs_region = "${var.region}"

https_enabled = "true"
http_ingress_cidr_blocks = "${var.ingress_cidr_blocks_http}"
https_ingress_cidr_blocks = "${var.ingress_cidr_blocks_https}"
certificate_arn    = "${var.default_cert_arn}"
}


module "ecs_cluster_label" {
source    = "git::<https://github.com/cloudposse/terraform-terraform-label.git?ref=tags/0.1.6>"
name      = "cluster"
namespace = "${var.namespace}"
stage     = "${var.stage}"
}

# ECS Cluster (needed even if using FARGATE launch type)
resource "aws_ecs_cluster" "default" {
name = "${module.ecs_cluster_label.id}"
}

# default backend app
module "default_backend_web_app" {
source    = "git::<https://github.com/cloudposse/terraform-aws-ecs-web-app.git?ref=tags/0.8.0>"
name      = "backend"
namespace = "${var.namespace}"
stage     = "${var.stage}"
vpc_id    = "${module.vpc.vpc_id}"

container_image  = "${var.default_container_image}"
container_cpu    = "256"
container_memory = "512"
container_port   = "80"

#launch_type                 = "FARGATE"
listener_arns                = "${module.alb.listener_arns}"
listener_arns_count          = "1"
aws_logs_region              = "${var.region}"
ecs_cluster_arn              = "${aws_ecs_cluster.default.arn}"
ecs_cluster_name             = "${aws_ecs_cluster.default.name}"
ecs_security_group_ids       = ["${module.vpc.vpc_default_security_group_id}"]
ecs_private_subnet_ids       = ["${module.subnets.private_subnet_ids}"]
alb_ingress_healthcheck_path = "/healthz"
alb_ingress_paths            = ["/*"]

codepipeline_enabled = "false"
ecs_alarms_enabled   = "true"
autoscaling_enabled  = "false"

alb_name                                        = "${module.alb.alb_name}"
alb_arn_suffix                                  = "${module.alb.alb_arn_suffix}"
alb_target_group_alarms_enabled                 = "true"
alb_target_group_alarms_3xx_threshold           = "25"
alb_target_group_alarms_4xx_threshold           = "25"
alb_target_group_alarms_5xx_threshold           = "25"
alb_target_group_alarms_response_time_threshold = "0.5"
alb_target_group_alarms_period                  = "300"
alb_target_group_alarms_evaluation_periods      = "1"
}

# web app
module "web_app" {
source    = "git::<https://github.com/cloudposse/terraform-aws-ecs-web-app.git?ref=tags/0.8.0>"
name      = "app"
namespace = "${var.namespace}"
stage     = "${var.stage}"
vpc_id    = "${module.vpc.vpc_id}"

container_image  = "${var.default_container_image}"
container_cpu    = "4096"
container_memory = "8192"

#container_memory_reservation = ""
container_port = "80"
desired_count  = "${var.desired}"

autoscaling_enabled               = "true"
autoscaling_dimension             = "cpu"
autoscaling_min_capacity          = "${var.min}"
autoscaling_max_capacity          = "${var.max}"
autoscaling_scale_up_adjustment   = "1"
autoscaling_scale_up_cooldown     = "60"
autoscaling_scale_down_adjustment = "-1"
autoscaling_scale_down_cooldown   = "300"

#launch_type           = "FARGATE"
listener_arns          = "${module.alb.listener_arns}"
listener_arns_count    = "1"
aws_logs_region        = "${var.region}"
ecs_cluster_arn        = "${aws_ecs_cluster.default.arn}"
ecs_cluster_name       = "${aws_ecs_cluster.default.name}"
ecs_security_group_ids = ["${module.vpc.vpc_default_security_group_id}"]
ecs_private_subnet_ids = ["${module.subnets.private_subnet_ids}"]

alb_ingress_healthcheck_path  = "/"
alb_ingress_paths             = ["/*"]
alb_ingress_listener_priority = "100"

codepipeline_enabled = "true"
github_oauth_token   = "${var.GITHUB_OAUTH_TOKEN}"
repo_owner           = "XXXXX"
repo_name            = "XXXXX"
branch               = "${var.WEB_APP_BRANCH}"
ecs_alarms_enabled   = "true"

alb_target_group_alarms_enabled                 = "true"
alb_target_group_alarms_3xx_threshold           = "25"
alb_target_group_alarms_4xx_threshold           = "25"
alb_target_group_alarms_5xx_threshold           = "25"
alb_target_group_alarms_response_time_threshold = "0.5"
alb_target_group_alarms_period                  = "300"
alb_target_group_alarms_evaluation_periods      = "1"
alb_name                                        = "${module.alb.alb_name}"
alb_arn_suffix                                  = "${module.alb.alb_arn_suffix}"
}

Insufficient permissions
Unable to access the artifact with Amazon S3 object key 'bv-staging-hw-xxxxx/task/kN9HAdK' located in the Amazon S3 artifact bucket 'bv-staging-hw-xxxxx'. The provided role does not have sufficient permissions.

data.aws_vpc_endpoint_service.dynamodb: Refreshing state...
data.aws_vpc.acceptor: Refreshing state...
data.aws_vpc_endpoint_service.s3: Refreshing state...
data.aws_subnet_ids.acceptor: Refreshing state...
data.aws_route_table.acceptor[2]: Refreshing state...
data.aws_route_table.acceptor[4]: Refreshing state...
data.aws_route_table.acceptor[8]: Refreshing state...
data.aws_route_table.acceptor[5]: Refreshing state...
data.aws_route_table.acceptor[6]: Refreshing state...
data.aws_route_table.acceptor[0]: Refreshing state...
data.aws_route_table.acceptor[7]: Refreshing state...
data.aws_route_table.acceptor[3]: Refreshing state...
data.aws_route_table.acceptor[1]: Refreshing state...

Error: Error refreshing state: 1 error(s) occurred:

* module.vpc_peering.module.vpc_peering.data.aws_route_table.requestor: data.aws_route_table.requestor: value of 'count' cannot be computed

module "vpc" {
  source = "../../modules/application-vpc"

  application_name = "vpc-peering-test"
  cidr             = "172.100.0.0/16"
  namespace        = "tf"
  private_subnets  = ["172.100.1.0/24", "172.100.2.0/24", "172.100.3.0/24"]
  public_subnets   = ["172.100.5.0/24", "172.100.6.0/24", "172.100.7.0/24"]
  stage            = "DEV"
}

module "vpc_peering" {
  source = "../../modules/application-vpc-peering"

  application_name = "vpc-peering-test"
  namespace        = "tf"
  stage            = "DEV"

  acceptor_vpc_id  = "vpc-xxx"
  requestor_vpc_id = "${module.vpc.vpc_id}"
}