#terraform - February 2019

February 2019
johncblandii
johncblandiialmost 8 years ago
I’m seeing the ecs-web-app flag with a basic image (nginx:latest) on Fargate. Any thoughts here?

I don’t see any logs for it, but it does show:

Stopped reason Task failed ELB health checks in (target-group arn:aws:elasticloadbalancing:us-west-2:496386341798:targetgroup/sparkle-view-default-test/8bc8ccfff5c546df)


module "default_backend_web_app" {
  source    = "git::<https://github.com/cloudposse/terraform-aws-ecs-web-app.git?ref=tags/0.10.0>"
  namespace = "${local.application_name}"
  stage     = "default"
  name      = "${var.stage}"
  vpc_id    = "${module.stack.vpc_id}"

  container_image  = "nginx:latest"
  container_cpu    = "256"
  container_memory = "512"
  container_port   = "80"

  #launch_type                 = "FARGATE"
  listener_arns                 = "${module.alb.listener_arns}"
  listener_arns_count           = "1"
  aws_logs_region               = "${data.aws_region.current.name}"
  ecs_cluster_arn               = "${aws_ecs_cluster.this.arn}"
  ecs_cluster_name              = "${aws_ecs_cluster.this.name}"
  ecs_security_group_ids        = ["${module.stack.vpc_default_security_group_id}"]
  ecs_private_subnet_ids        = ["${module.stack.vpc_private_subnets}"]
  alb_ingress_healthcheck_path  = "/"
  alb_ingress_paths             = ["/*"]
  alb_ingress_listener_priority = 100

  codepipeline_enabled = "false"
  ecs_alarms_enabled   = "true"
  autoscaling_enabled  = "false"

  alb_name                                        = "${module.alb.alb_name}"
  alb_arn_suffix                                  = "${module.alb.alb_arn_suffix}"
  alb_target_group_alarms_enabled                 = "true"
  alb_target_group_alarms_3xx_threshold           = "25"
  alb_target_group_alarms_4xx_threshold           = "25"
  alb_target_group_alarms_5xx_threshold           = "25"
  alb_target_group_alarms_response_time_threshold = "0.5"
  alb_target_group_alarms_period                  = "300"
  alb_target_group_alarms_evaluation_periods      = "1"

  environment = [
    {
      name  = "PORT"
      value = "80"
    },
  ]
}
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
@johncblandii what do you mean by flag?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
flap?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
does / return 200?
johncblandii
johncblandiialmost 8 years ago
flap…yes
johncblandii
johncblandiialmost 8 years ago
got some progress. let me check back on the default
johncblandii
johncblandiialmost 8 years ago
yeah, it is INACTIVE now
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
ok, check ports
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago(edited)
is nginx on 80 or 8080?
johncblandii
johncblandiialmost 8 years ago
yeah, just nginx:latest in use
johncblandii
johncblandiialmost 8 years ago
checking ports
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
missing
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago

port_mappings = [{
    "containerPort" = "${var.atlantis_port}"
    "hostPort"      = "${var.atlantis_port}"
    "protocol"      = "tcp"
  }]
johncblandii
johncblandiialmost 8 years ago
target group is port 80
johncblandii
johncblandiialmost 8 years ago
ahh…on the default. 1 sec
johncblandii
johncblandiialmost 8 years ago

  port_mappings = [
    {
      "containerPort" = "80"
      "hostPort"      = "80"
      "protocol"      = "tcp"
    },
    {
      "containerPort" = "80"
      "hostPort"      = "443"
      "protocol"      = "tcp"
    }
  ]
johncblandii
johncblandiialmost 8 years ago(edited)
without ssl on the image, 443 to 80 would still pass, right?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
so on fargate, I tihn kthe hostPort must equal the container port
johncblandii
johncblandiialmost 8 years ago
ah, right. i think i saw that in the docs
johncblandii
johncblandiialmost 8 years ago
def’ understand these ALBs more now
johncblandii
johncblandiialmost 8 years ago
pretty quality
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
yea, they are
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
i love that they added the support for auth
johncblandii
johncblandiialmost 8 years ago
just one with hosts for our domains all mapped through TF. (awyeah)
Maarten van der Hoef
Maarten van der Hoefalmost 8 years ago(edited)
@johncblandii what's also nice is the http->https redirect
johncblandii
johncblandiialmost 8 years ago
yeah, played w/ that as well (not in the tf setup yet)
Lucas
Lucasalmost 8 years ago
Heyho! I'm trying to build a sweeet infra and began using terraform+cloudposse module "terraform-aws-elastic-beanstalk-environment". I try to create a "SingleInstance" environment with a public ip. But i can't get the module convinced to put the EC2 into the public net instead of the private. How to do that? I'm using the "complete" example and switched "environment_type" to SingleInstance and added updating_min_in_service to 0 as the docs tell me.
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
@Lucas 5 min, I’ll take a look
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
@Lucas the module has vars for private and public subnets
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
the private subnets are to place the EC2 instances in
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
but
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
those are just the names (and best practice)
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
if you provide a public subnet ID in the variable "private_subnets", the instance will be placed into the public subnet
Lucas
Lucasalmost 8 years ago
ah! nice, i'll give it a try right away. Indeed the names suggest something different. But maybe it's because its my first day with terraform 🙂
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
You're off to a flying start if you already found our modules on your first day.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)almost 8 years ago
(and found our slack!)
Lucas
Lucasalmost 8 years ago
I looked into terraform because managing AWS by hand seemed not right. Than i saw the huge complicated and potent config of terraform and thought "oh well, that will take some months until i get it running". A video on youtube introtuced the concept of modules to me and i found the cloudposse repo. Bingo 🙂
Lucas
Lucasalmost 8 years ago
Thanks @Andriy Knysh (Cloud Posse) it worked.
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
nice
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)almost 8 years ago
we had a request already to rename the inputs to elb_subnets and instance_subnets (which both could be private or public, your choice) - so maybe it’s a good idea
Krit
Kritalmost 8 years ago(edited)
This is more of an AWS related question but since it was triggered through the terraform-aws-ec2-bastion-server module for my bastion I’m asking here. The security group created by the module doesn’t allow for the builtin user_data.sh to complete all of its tasks since apt is blocked by the outoing secgroup rules, so by design bastion host needs to be added to a more permissive secgroup.

This leads to the following questions when trying to come up with an outgoing traffic security policy: what’s the best compromise between allowing package managers access and maintaining security, especially for the bastion host? Is the best way enabling outgoing traffic on the secgroup on demand? Am I trying too hard, and should just open ports 1025-65535 to 0.0.0.0/0 and stop thinking about it?
joshmyers
joshmyersover 7 years ago
If you really want to lock it down, could have egress proxies that are a gate to the outside world, a central choke point
Krit
Kritover 7 years ago
Sure, I could route the traffic through the NGW, the thing is, is this worth doing? How are people tackling this in real world scenarios?
joshmyers
joshmyersover 7 years ago
Depends what you real world requirements are?
joshmyers
joshmyersover 7 years ago
Lots of places I know of don’t lock down egress at all
joshmyers
joshmyersover 7 years ago
Others allow only to specific endpoints
joshmyers
joshmyersover 7 years ago
e.g. pypi, rubygems etc
joshmyers
joshmyersover 7 years ago
How locked down do you need this environment?
joshmyers
joshmyersover 7 years ago
It can be a bit painful to manage those outbound rulesets
joshmyers
joshmyersover 7 years ago
Are you running a sandwich making app, or a bank?
Krit
Kritover 7 years ago
No highly sensitive data involved, but private data that should be safeguarded nevertheless. Thanks for your comments, they’re helpful!
joshmyers
joshmyersover 7 years ago
Do you have specific security concerns / accreditation requirements?
Krit
Kritover 7 years ago
In this case none at all, just trying to gauge what’s generally acceptable/best practice
joshmyers
joshmyersover 7 years ago
What kind of outgoing rules would you need to manage? Do you apps/infra need to reach out to all the internets at run time?
joshmyers
joshmyersover 7 years ago
Can you lock it down to DNS outbound and maybe a few upstream endpoints?
Krit
Kritover 7 years ago
Well, front/backend will be using a NGW, my question was just for the bastion host which is exposed, and needs access to the o/s repos, and our gitlab repos for bootstrapping itself.
nutellinoit
nutellinoitover 7 years ago
Hi everyone, using: https://github.com/cloudposse/terraform-aws-ec2-autoscale-group how can i define additional block mappings on ec2?
nutellinoit
nutellinoitover 7 years ago
nutellinoit
nutellinoitover 7 years ago
i know it should be a list, but in the aws_launch_template is an object
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago(edited)
it should be a list of maps. Did you try that?
nutellinoit
nutellinoitover 7 years ago
uhm
johncblandii
johncblandiiover 7 years ago(edited)
(re: my question last week about ecs cli deploys) I found this one to be very useful and really easy to use: https://github.com/fabfuel/ecs-deploy.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
thanks for the follow up
joshmyers
joshmyersover 7 years ago
@johncblandii Pure bash implementation - https://github.com/silinternational/ecs-deploy
johncblandii
johncblandiiover 7 years ago
Yup. I saw that one and it wasn’t being kind. I was under the gun so switched to the pip version
johncblandii
johncblandiiover 7 years ago
our containers have py installed already
mrwacky
mrwackyover 7 years ago
Terraform 0.12 released yet?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
you trolling @mrwacky? 😆
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
Terraform 0.12 is the new Perl 6
Ram
Ramover 7 years ago
Hello Everyone ... i am ram and happy to join this slack channel.
Richy de la cuadra
Richy de la cuadraover 7 years ago
great!
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
Welcome @Ram 😃 Glad you stopped by.
Ram
Ramover 7 years ago
thanks eric.
praveen
praveenover 7 years ago
#terraform, I have a very generic question with regards to deployment of premium services in Azure platform. when I try deployment of Azure premium services like App service environment and Redis Cache. I will run for 1hr and timeout and error with the following message "Error creating deployment: Future#WaitForCompletion: context has been cancelled: StatusCode=200 -- Original Error: context deadline exceeded"
praveen
praveenover 7 years ago
Do we have a fix for Terraform to run deployment process for more than 1 hr?
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago(edited)
@praveen not many people here are familiar wit #azure, sorry if you don’t get an answer you are looking for
praveen
praveenover 7 years ago
@Andriy Knysh (Cloud Posse),not a problem. In general what is the timeout value for Terraform to run a config
Toby
Tobyover 7 years ago(edited)
Hi All and thanks again for the SweetOps resources from CloudPosse! 🙂

I’m trying to use
https://github.com/cloudposse/terraform-aws-vpc-peering/blob/master/main.tf
to set up some peering between VPCs in different accounts where the remote vpc is in the other account and the requestor is ‘my’ account,

I see the aws_vpc_peering_connection https://www.terraform.io/docs/providers/aws/r/vpc_peering.html supports peer_owner_id ? > (Optional) The AWS account ID of the owner of the peer VPC. Defaults to the account ID the AWS provider is currently connected to.

However the cloudposse module does not appear to support peer_owner_id

Am I correct?
Is there a work around?
If not shall I add one with a PR?

Thanks again! 😄
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
Toby
Tobyover 7 years ago
a-ha!!

Thanks 🙂
btai
btaiover 7 years ago
have you guys done vpc peering with terraform? does it work well?
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
We do it all the time, works well
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
See the two modules above
btai
btaiover 7 years ago
oh wow i didnt even notice
btai
btaiover 7 years ago
you had pasted it above 😅
Gonzalo Peci
Gonzalo Peciover 7 years ago
Gonzalo Peci
Gonzalo Peciover 7 years ago
as it filters to those tags, and objecets most likely wont have that
Gonzalo Peci
Gonzalo Peciover 7 years ago
It should be a separate var. or removed
joshmyers
joshmyersover 7 years ago
@Gonzalo Peci Please open an issue explaining what you are running, what you expect to see, what you actually see, a proposed fix if there is one, and example of running proposed fix
Gonzalo Peci
Gonzalo Peciover 7 years ago
Ill just open a PR, but I want to first confirm what was the intention of that line
Gonzalo Peci
Gonzalo Peciover 7 years ago
Im actually not experiencing an error, I just saw the config
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
@Gonzalo Peci why do you think it will break the rules? Tags are allowed https://www.terraform.io/docs/providers/aws/r/s3_bucket.html#tags-1
Gonzalo Peci
Gonzalo Peciover 7 years ago
Because it sets them to the ones of the label
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
or you mean id = "log" should be the same as "rule" = "log"?
Gonzalo Peci
Gonzalo Peciover 7 years ago
which you use to label the bucket, but not necessarily the objects in the bucket
Gonzalo Peci
Gonzalo Peciover 7 years ago
the apply works, but the lifecycle "does not work"
Gonzalo Peci
Gonzalo Peciover 7 years ago
the tags passed on that line, are used for filtering which objects to apply the lifecycle to
Gonzalo Peci
Gonzalo Peciover 7 years ago
so in general, it should != the tags of the bucket, but at least should not permanently do that
Gonzalo Peci
Gonzalo Peciover 7 years ago(edited)
given:

name = "this"
stage = "that"

this will ONLY apply lifecycle to objects that have those as tags as well
Gonzalo Peci
Gonzalo Peciover 7 years ago
which I belive is not the intention there
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
ok, so you saying those tags are for filtering? (I did not know that 😞 )
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
can you provide some links where it’s explained?
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
(thanks for finding it out btw)
Gonzalo Peci
Gonzalo Peciover 7 years ago
Yeah, they are for filtering
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
how would we use it then? (e.g. a use-case)
Gonzalo Peci
Gonzalo Peciover 7 years ago
You only want to lifecycle objects with X tag
Gonzalo Peci
Gonzalo Peciover 7 years ago
EG: I have objects with tag Expire = true and other objects
Gonzalo Peci
Gonzalo Peciover 7 years ago(edited)
only apply to Expire = true
Gonzalo Peci
Gonzalo Peciover 7 years ago
but for this, your thing sending the objects has to set the tags on them
Gonzalo Peci
Gonzalo Peciover 7 years ago
you could also reverse that logic
Gonzalo Peci
Gonzalo Peciover 7 years ago
TBH, I have never used it, as we normally just apply to the bucket or not
Gonzalo Peci
Gonzalo Peciover 7 years ago
If you create a resource with that, then inspect in the console, you will see the tags under: Add filter to limit scope to prefix/tags
Gonzalo Peci
Gonzalo Peciover 7 years ago
They work like the prefix setting
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
ok that sounds correct 🙂 and same in the link above from @joshmyers
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago(edited)
can you add a separate var and open a PR? (please rebuild README: make init make readme/deps make/readme)
Gonzalo Peci
Gonzalo Peciover 7 years ago
Yeah sure, will do
Gonzalo Peci
Gonzalo Peciover 7 years ago
https://github.com/cloudposse/terraform-aws-s3-log-storage/pull/14
I intentionally did not rename the output, to keep it compatible
Gonzalo Peci
Gonzalo Peciover 7 years ago
PR passes, give me a minute to test it
Gonzalo Peci
Gonzalo Peciover 7 years ago
Im 90% sure its a map but just in case
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
thanks
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
can you also remove (Optional) from the descriptions, README build will do it automatically
Gonzalo Peci
Gonzalo Peciover 7 years ago
Yeah, I did not know if it was part of your standard
Gonzalo Peci
Gonzalo Peciover 7 years ago
Cleaning
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
(not a big deal, just a few rules to follow for consistency, thanks)
Gonzalo Peci
Gonzalo Peciover 7 years ago(edited)
Yeah, indeed, but since it has (optional) in the rest, I guess its a legacy thing
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
yea, thanks
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
did it work with the tag maps?
Gonzalo Peci
Gonzalo Peciover 7 years ago
Im checking, 1 sec finishing another task 😄
Gonzalo Peci
Gonzalo Peciover 7 years ago
At a glance, it applied but did not create the filter
Gonzalo Peci
Gonzalo Peciover 7 years ago
im checking wasp
Gonzalo Peci
Gonzalo Peciover 7 years ago
duh, used the wrong var name
Gonzalo Peci
Gonzalo Peciover 7 years ago
@Andriy Knysh (Cloud Posse) works like a charm
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
thanks @Gonzalo Peci approved
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
thanks for the contribution @Gonzalo Peci!
Gonzalo Peci
Gonzalo Peciover 7 years ago
You guys put over 100 modules out there to either use or get inspiration from, this is a minor contribution 🤘
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
🙇
tamsky
tamskyover 7 years ago
Anyone here using https://github.com/blinkist/terraform-aws-airship-ecs-service ?
I'm new to ECS, and I like how this module handles bootstrapping an initial task definition, but in other ways it feels pretty limited in what I can do.
For instance, I can't figure out how to use it to define a task that launches two containers together.
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
#airship has more info
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
@Maarten van der Hoef is your goto man.
btai
btaiover 7 years ago
does this error happen intermittently? value of 'count' cannot be computed
drexler
drexlerover 7 years ago
@btai it could be that variable being assigned to count is invalid. Care to share a snippet of the offending code?
btai
btaiover 7 years ago
these are the error messages I got
btai
btaiover 7 years ago
* module.vpc.aws_route_table.private: aws_route_table.private: value of 'count' cannot be computed
* module.vpc.aws_eip.public: aws_eip.public: value of 'count' cannot be computed
* module.vpc.aws_subnet.private: aws_subnet.private: value of 'count' cannot be computed
* module.vpc.aws_subnet.public: aws_subnet.public: value of 'count' cannot be computed
btai
btaiover 7 years ago
fwiw this vpc module has been used before with no issues
btai
btaiover 7 years ago
but here is a snippet of the offending code
btai
btaiover 7 years ago
resource "aws_subnet" "public" {
  count                   = "${local.region-to-az-count-map[var.region]}"
  vpc_id                  = "${aws_vpc.default.id}"
  cidr_block              = "${cidrsubnet(local.public_subnet_block, ceil(log(local.region-to-az-count-map[var.region] * 2, 2)), count.index)}"
  availability_zone       = "${var.region}${local.num-to-az-letter-map[count.index]}"
  map_public_ip_on_launch = true

  tags = "${merge(
    var.public_subnet_tags,
    var.tags,
    map(
      "Name", "public-${var.name}-${var.region}${local.num-to-az-letter-map[count.index]}",
      "Environment", "${var.environment}",
      "AvailabilityZone", "${var.region}${local.num-to-az-letter-map[count.index]}"
    )
  )}"
}
btai
btaiover 7 years ago(edited)
locals {
  region-to-az-count-map = {
    "us-west-1" = 3
    "us-west-2" = 3
    "us-east-1" = 6
    "us-east-2" = 3
  }

  num-to-az-letter-map = {
    "0" = "a"
    "1" = "b"
    "2" = "c"
    "3" = "d"
    "4" = "e"
    "5" = "f"
  }
}
drexler
drexlerover 7 years ago
off to team meeting...will take a closer look in the hour.
btai
btaiover 7 years ago
yeah the frustrating thing is ive used this module in the past without issues
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
TF does not like maps in counts
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
even if the map is static (as in your case)
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
btai
btaiover 7 years ago
@Andriy Knysh (Cloud Posse) weirdly I have used this same exact code before for over a year and I never ran into this error until today 😫
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
i have noticed this before
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
stuff we had working stops....
btai
btaiover 7 years ago
yeah
btai
btaiover 7 years ago
sad
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago(edited)
that’s probably because you introduced other dependencies and TF now calculates things differently or in diff order
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
(@Fogal lags by a few days 🙂 )
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
@Vlad Shlosberg ☝️
loren
lorenover 7 years ago
it also happens when you change the inputs... so something might apply at first, then the inputs change, then you get cannot compute count errors...
Vlad Shlosberg
Vlad Shlosbergover 7 years ago
will ping u offline @Andriy Knysh (Cloud Posse).. Thanks @Erik Osterman (Cloud Posse)
btai
btaiover 7 years ago
i’ve seen this count error many times in passing but it hadn’t happened to me. (I’ve avoided dynamic counts for the most part just really for this case where different regions require different # of subnets etc)
btai
btaiover 7 years ago
I thgought i avoided it mostly because my map is static
btai
btaiover 7 years ago
but frustrating to have to use the workarounnd
i5okie
i5okieover 7 years ago
was about to use the terraform-aws-ecs-web-app module, but found an inception of terraform-terraform-lable or null label usage throughout. and we use a slightly different naming convention so I keep a local copy of modules with modified label modules. but this one is on another level lol. sigh this is too meta
i5okie
i5okieover 7 years ago
ours is <brand/product>-<name>-<stage>-<attributes>
i5okie
i5okieover 7 years ago
hmm
i5okie
i5okieover 7 years ago
lolz
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
you can use variable "label_order" to reorder the attributes as you like
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
for <brand/product> use environment 🙂
giphy
giphyover 7 years ago
i5okie
i5okieover 7 years ago
but for modules that use terraform-terraform modules i guess its different
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
yea, that one is simple 🙂
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
<brand/product>-<name>-<stage>-<attributes> should be covered by namespace-name-stage-attributes
i5okie
i5okieover 7 years ago
terraform terraform label i just ended up modifying the one line id = "${local.enabled == true ? lower(join(var.delimiter, compact(concat(list(var.namespace, var.name, var.stage), var.attributes)))) : ""}"
i5okie
i5okieover 7 years ago
your ecs modules, include your other modules, which each reference the label modules from your git. so i do i download each of those modules and point them all to the local label module.. orrr just frankenstine my own terraform files by using your terraform modules for inspiration? 😛
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
and you know, those are just names, you can assign anything to them, although will look ugly, should work 😉
i5okie
i5okieover 7 years ago
that is certainly true.
i5okie
i5okieover 7 years ago
i could just say to the devs. deal with it.
i5okie
i5okieover 7 years ago
and use your naming convention
i5okie
i5okieover 7 years ago
😄
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
(i proposed before to just name them p1, p2, p3, p4, p5 🙂 )
i5okie
i5okieover 7 years ago
even better
i5okie
i5okieover 7 years ago
im just wondering, what are your examples of actual use for “namespace” value?
i5okie
i5okieover 7 years ago
like real-life examples
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
or, that’s the MAIN attribute 🙂
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
to namespace all resources for a company
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
so we use cp and cpco a lot
i5okie
i5okieover 7 years ago
nice and short. nice
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
for all clients we namespace their resources by using the company name or abbreviation
i5okie
i5okieover 7 years ago
yeah that makes sense.
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago(edited)
in this case, we can have the same stage, name and attributes, but still have unique names (especially for global resources like S3 buckets)
i5okie
i5okieover 7 years ago
cool. here’s a diff question. whats the difference between terraform-aws-ecs-web-app and terraform-aws-ecs-alb-service-task
i5okie
i5okieover 7 years ago
?
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
the former includes the later 🙂
i5okie
i5okieover 7 years ago
oh geez
i5okie
i5okieover 7 years ago
ic
i5okie
i5okieover 7 years ago
super meta
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
terraform-aws-ecs-web-app has everything to deploy a web app
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
(it’s opinionated)
i5okie
i5okieover 7 years ago
so many cool features. i like it.
i5okie
i5okieover 7 years ago
so, our stack includes the main monolith, and 3 supporting services. so each would be its own service. but only two are on public alb. would this module be a good fit for the supporting services? or should i just use the service-task for those?
I’m hoping i can, because having the build badges would be neat lol. (the most important part of course)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
Also, here's an example of using terraform-aws-ecs-web-app to deliver a service like atlantis
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
for example, if you had a company project called "widget-store", you would create a terraform module called terraform-aws-ecs-widget-store
erik
erikover 7 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
any one kick the tires yet?
johncblandii
johncblandiiover 7 years ago
We’re on TFE paid so don’t know the difference w/ the free, but I like it so far.
joshmyers
joshmyersover 7 years ago
@johncblandii What is TFE differences? Atlas?
Gonzalo Peci
Gonzalo Peciover 7 years ago
Not super in favor of this TFE thing
Gonzalo Peci
Gonzalo Peciover 7 years ago
I think its just forcing people to their hosted product, like the "remote runner" backend they added
Gonzalo Peci
Gonzalo Peciover 7 years ago
which is only for their private service
Gonzalo Peci
Gonzalo Peciover 7 years ago
at least the registry is public
joshmyers
joshmyersover 7 years ago
I’ve literally never even looked at it
johncblandii
johncblandiiover 7 years ago
remote runner is optional. Use it or don’t. The same w/ remote state.
johncblandii
johncblandiiover 7 years ago
@joshmyers TFE is basically a TF customized CI. You can run TF locally and validate it against the remote state like anywhere else (s3, etc), but the config is miles easier than creating multiple buckets, paths, etc
nutellinoit
nutellinoitover 7 years ago
@Andriy Knysh (Cloud Posse) resolved block_device_mappings 😄
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
list of maps worked?
nutellinoit
nutellinoitover 7 years ago(edited)
yes!
joshmyers
joshmyersover 7 years ago
Nice!
loren
lorenover 7 years ago(edited)
have to wonder how many people complaining are paying for or contributing to any hashicorp products?
joshmyers
joshmyersover 7 years ago
Always the way
joshmyers
joshmyersover 7 years ago
OS - I haven’t paid for your this thing you have ploughed time and effort into, that I chose to use, but I demand you support my use case!
johncblandii
johncblandiiover 7 years ago
That’s a solid response by mitchellh.
Gonzalo Peci
Gonzalo Peciover 7 years ago(edited)
You even have the opposite now, companies like AWS/etc, put OS tooling for their platform (unique to their paid platform) and then just expect people to add all the features. eg: ecs-cli or similar
deftunix
deftunixover 7 years ago
hi everyone, is someone of you using terratest?
erik
erikover 7 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago

We expect that users will stick to 0.11 through at least the end of 2019.
Krit
Kritover 7 years ago
@Erik Osterman (Cloud Posse) and the rest of Cloud Posse, what do you guys think about the points /u/xulsitatirev raised in the link you shared, as people who have so much of their work based on Terraform?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago

Tons of issues have been closed or ignored, because of: This problem will be solved in Terraform 0.12.


We’ve definitely encountered this a fair bit. There are a lot of pain points in < 0.11.x, but they are a “known evil” - like the “count of cannot be computed”. Due to the interoperability between our modules, we need to be strategic about how we orchestrate this move, so we are not left straddling both versions. Also, we are soliciting input for how to manage versions of our modules across 0.11 and 0.12

We’re not yet investing in porting our modules 0.12. That will definitely happen, but we are not sure yet how easy that will be.
btai
btaiover 7 years ago
does gracefully shutting down terraform ever work for you guys?
Trent Scholl
Trent Schollover 7 years ago
Depends on what it's doing when you try to stop it
antonbabenko
antonbabenkoover 7 years ago
https://docs.geopoiesis.io/manual/ - looks pretty interesting but incomplete. Did anyone look into it? Is it very similar to Atlantis, or what?
antonbabenko
antonbabenkoover 7 years ago
I think I like UI very much, but I have not tried it myself 🙂
joshmyers
joshmyersover 7 years ago
Never seen 😮
Jeff McCollum
Jeff McCollumover 7 years ago
I'm starting to play with Terraform Enterprise and one thing I'm courious to hear what others are doing is around configuring workspaces and variables. Using the TFE Terraform provider to create and manage workspaces, works great and make sense, however it feels odd using the TFE provider to declare variable resources which then push vars into TFE.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
@johncblandii ☝️
btai
btaiover 7 years ago
have you guys gotten this with your vpc peering?
btai
btaiover 7 years ago
* module.vpc_peer_database.data.aws_route_table.requestor: data.aws_route_table.requestor: value of 'count' cannot be computed
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
no, but it depends on many factors
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
we create peering after all other resources get created
btai
btaiover 7 years ago
oh
btai
btaiover 7 years ago
darn
btai
btaiover 7 years ago
😫 this error is becoming the bane of my existence
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
Yes this is the biggest PIA
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
Basically in terraform they don’t support nesting of modules
btai
btaiover 7 years ago
im not nesting modules though
btai
btaiover 7 years ago
😧
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
ok, in this case data provider is the problem - yea
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago(edited)
sounds like theres a "create" happening somewhere there's a "data" lookup in the same lifecycle event
btai
btaiover 7 years ago
yeah the subnets havent been created yet
btai
btaiover 7 years ago
in this case
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
😢
Mark Grube
Mark Grubeover 7 years ago
anyone using automated testing for your modules? I was looking at inspec, but not sure if there are some better tools out there. maybe terratest?
btai
btaiover 7 years ago
you guys arent using the helm provider for anything right
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
No, helm provider is insufficient for what we do
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
Terraform template files do not support conditionals
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
DocumentDB support merged
Abel Luck
Abel Luckover 7 years ago
Anyone given terraform 0.12 beta for a spin yet?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
there are a few brave souls in #terraform-0_12
Abel Luck
Abel Luckover 7 years ago
why is it common in terraform to see arguments defined as lists, but then only support a single element in the list?
Abel Luck
Abel Luckover 7 years ago
but there are several others I've encountered too
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
I think it’s not so much terraform as it is the upstream AWS API
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
so the API is “aspirational” and defined so that it may “one day” support it
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
and terraform is just piggy backing on that interface for consistency.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
it’s annoying though 😃
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
I’ve run into that with alb target groups. i want to define a list of paths that map to a service. the property supports a list. but the api rejects if you specify more than one path.
Abel Luck
Abel Luckover 7 years ago
indeed
Laur
Laurover 7 years ago
Hello, I am trying to deploy a Elastic Beanstalk application on AWS with terraform using your module, but i don't fully understand it, in order to deploy the app i need the two modules; https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment and https://github.com/cloudposse/terraform-aws-elastic-beanstalk-application ?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
We have an advanced example of the beanstalk implementation here:
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago(edited)
Laur
Laurover 7 years ago
i don't find it
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
that shows the interplay between the modules
Laur
Laurover 7 years ago
thank you, let me see
Laur
Laurover 7 years ago
so.. what if I have the application in a .zip file, can i import it?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
not sure - it’s been a loooooooooooooooong time since we used beanstalk
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
(we’re using k8s, eks, ecs)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
there are quite a few folks in this channel though using these beanstalk modules though
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
(most are based in US, and asleep right now)
Ralph
Ralphover 7 years ago
Hello there guys and gals! I was going through the impressive CP library as I was hunting for naming inspiration. I'm trying to put together a service/module catalog of my own and I was wondering what the differences are between the terrarform-null-label and the terraform-terraform-label. They seem to implement the same thing while one of them doesn't use the null provider? Is that right? The main.tf of the null-version is way more complicated (for the lack of a better word...) Are you guys recommending one over the other? THX
Steven
Stevenover 7 years ago
You're right, one uses null while the other uses locals. I have similar modules I use. Using locals is simplier, faster, doesn't change state, but has limitations. Lately CloudPosse has been extending the null version more. So, if you need those features, your decision is made. With my modules the functionaly is almost the same with 1 important difference. The locals version can only create data for a single label, while the null version can create many. So, I use the locals version whenever I need a single lable and the null version when I need a list of labels
joshmyers
joshmyersover 7 years ago
@Ralph In short, terraform-null-label was written first and ended up getting quite a lot added to fit general community use cases, but because of that ended up with a hairier more complex implementation.
Ralph
Ralphover 7 years ago
@Steven @joshmyers Thanks a ton guys, that helped! In the spirit of KISS, I guess I'll use terraform-terraform-label as a starting point and evolve it from there... 👍️
johncblandii
johncblandiiover 7 years ago
Sooooo…fargate task role uploading to S3 without supplying the access key via env vars. Anyone get through that?

I’ve tried VPC access, but this is a front-end upload (via Angular) so not technically from within the VPC. I tried opening up the access via Allow policies…no go.
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
so we usually do this kind of things by creating separate IAM roles for the k8s nodes to assume (via kiam)
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
can Fargate assume roles?
johncblandii
johncblandiiover 7 years ago
it receives a role (task and execution roles) but I’m not sure about assuming a different one
johncblandii
johncblandiiover 7 years ago(edited)
yes, @Andriy Knysh (Cloud Posse):


{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "<http://ecs-tasks.amazonaws.com|ecs-tasks.amazonaws.com>"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}


https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_IAM_role.html
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
nice
Abel Luck
Abel Luckover 7 years ago
Hmm, i'm having trouble adding an IAM Server certificate to a cloudfront distribution. It says that the cert must exist in us-east-1, but the aws_iam_server_certificate resource has no region attribute
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
Alec
Alecover 7 years ago
Not long ago someone linked a site for terraform best practices -- and I apparently forgot to bookmark it. It was like it's own site, had small/med/large templates, etc. Anyone familiar?
Abel Luck
Abel Luckover 7 years ago
how annoying. thanks @Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
Alec
Alecover 7 years ago
Awesome, thank you @Andriy Knysh (Cloud Posse)
antonbabenko
antonbabenkoover 7 years ago(edited)
Please open or issues if you find something very important missing or simply wrong ☝️
S
SweetOpsover 7 years ago
Are you using some of our terraform-modules in your projects? Maybe you could leave us a testimonial! It means a lot to us to hear from people like you.
johncblandii
johncblandiiover 7 years ago
Anyone doing automated Terraform unit/integration testing? (Kitchen, etc)
loren
lorenover 7 years ago(edited)
a little basic stuff, but just using terraform itself to apply/destroy, wrapped in a CodeBuild job
loren
lorenover 7 years ago
recently started digging a bit using Terratest
johncblandii
johncblandiiover 7 years ago
same. we have a test/ folder and just write implementations there to test
loren
lorenover 7 years ago
exactly
johncblandii
johncblandiiover 7 years ago
I have seen Terratest, but me no go. 😄
johncblandii
johncblandiiover 7 years ago
I can read it but fumble writing
loren
lorenover 7 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
@johncblandii you might like our approach then
johncblandii
johncblandiiover 7 years ago
loren
lorenover 7 years ago
ruby... shudder
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
johncblandii
johncblandiiover 7 years ago
agreed, @loren. it isn’t rocket surgery, but still hesitate to introduce something like that
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
Use bats to define simple tests that any one with modest sh experience can write.
johncblandii
johncblandiiover 7 years ago
lol @ ruby, @loren. 😄 it is my preferred. 😉
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
even hashicorp uses bats
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
johncblandii
johncblandiiover 7 years ago
interesting @Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
I know it's controversial and there's no "right answer", but here's our write up: https://docs.cloudposse.com/design-decisions/0002-infrastructure-integration-testing/
johncblandii
johncblandiiover 7 years ago
only controversial at the water cooler 🙂
johncblandii
johncblandiiover 7 years ago
use what works for your squad
johncblandii
johncblandiiover 7 years ago
btw, did you mean 03.itempotent.bats to 03.idempotent.bats?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
lol
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
typo
loren
lorenover 7 years ago
just change it to itemtotem and everyone wins
johncblandii
johncblandiiover 7 years ago
😄
johncblandii
johncblandiiover 7 years ago
that’s pretty dope, though. my concern w/ Kitchen was teaching the squad Ruby. It isn’t for everyone
johncblandii
johncblandiiover 7 years ago
they all know shell to an extent
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
what I like about the shell approach is it mimicks the human operator experience
johncblandii
johncblandiiover 7 years ago
right
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago(edited)
while some elaborate framework does not. I am not writing ruby code to run terraform. i am not writing go code to run terraform.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
i am writing shell scripts all the time to run terraform.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
also, sometimes we do more than terraform
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
terraform + kops + helm + chamber + etc
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
i think the bats approach supports better story around testing the integration of all tools
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
not just one tool
johncblandii
johncblandiiover 7 years ago
cool. will revisit it when I can breathe. 🙂
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
bats is simple
loren
lorenover 7 years ago
good points...
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
johncblandii
johncblandiiover 7 years ago
(interactive tutorial)
johncblandii
johncblandiiover 7 years ago
pretty simple there, @Andriy Knysh (Cloud Posse). what i like is i could copy that to any CI w/ docker support
joshmyers
joshmyersover 7 years ago
If parsing/munging data structures (like tfstate), I’d take ruby/python over Bash
deftunix
deftunixover 7 years ago
hi everyone, do you have any example of how to implement a rolling upgrade using terrafrom aws autoscaling group?
deftunix
deftunixover 7 years ago
I am changing the ami and the launch config and I would like to terminate old instance one by one
deftunix
deftunixover 7 years ago
I add wait_for_elb_capacity and the name related to the lc name
deftunix
deftunixover 7 years ago
but for stateful service like consul is not enough
Gonzalo Peci
Gonzalo Peciover 7 years ago
@deftunix we use an external python script fo rthis
Gonzalo Peci
Gonzalo Peciover 7 years ago
and you want your ASG to have termination_policies = ["OldestLaunchTemplate", "Default"]
Gonzalo Peci
Gonzalo Peciover 7 years ago
@joshmyers @Andriy Knysh (Cloud Posse) I highlighted some comments here: https://github.com/cloudposse/terraform-aws-organization-access-group/pull/12, just pinging here so it does not get lost
joshmyers
joshmyersover 7 years ago
Hey @Gonzalo Peci this was biting us in client deployments and needed a fix asap, users kept being removed from groups
Gonzalo Peci
Gonzalo Peciover 7 years ago
Yeah, we have a similar situation at my company
Gonzalo Peci
Gonzalo Peciover 7 years ago(edited)
but I dont think the solution is the correct one IMHO. I would have changed the user defintion to add the groups instead
Gonzalo Peci
Gonzalo Peciover 7 years ago
the group definition, as when using SecurityGroups without attachs, its meant to be independent and the source of truth when used with aws_iam_group_membership in a group definition
Gonzalo Peci
Gonzalo Peciover 7 years ago
Using aws_iam_user_group_membership could have other issues, as described in my comment there, and also leave leftovers (any member not in the state)
Gonzalo Peci
Gonzalo Peciover 7 years ago
and I think this will bite you on a from scratch provisioning, it only works in the current config if:
A) user_names is NOT coming from the output of something else
B) this output was already defined in the past (so terraform can calculate against an old state, ending in some really odd situations)
Gonzalo Peci
Gonzalo Peciover 7 years ago
you could pass user_names from vars, but that mean you need some external logic that makes those users pre exist
Gonzalo Peci
Gonzalo Peciover 7 years ago
eg. in the code from CP, you have modules to create users, they will have to be run separately
Gonzalo Peci
Gonzalo Peciover 7 years ago(edited)
It could be this is accepted, i was just unsure, as we have similar code and wanted to highlight the potential problems on a bootstrap situation (eg a new AWS account in the org)
joshmyers
joshmyersover 7 years ago
Yeah, we have users in different TF state that gets run first and in our use cases e.g. https://github.com/cloudposse/terraform-root-modules/blob/master/aws/iam/security.tf#L14 is an empty list and group membership is defined in https://github.com/cloudposse/root.cloudposse.co/tree/master/conf/users
Gonzalo Peci
Gonzalo Peciover 7 years ago
👍️
Gonzalo Peci
Gonzalo Peciover 7 years ago(edited)
Im trying to a avoid the file/module per user waiting for TF12, but seems like that is taking forever 😞 we might have to end up splitting
joshmyers
joshmyersover 7 years ago
Have you confirmed that you get count cannot be computed if passing in users from another module directly into this in the same run?
Gonzalo Peci
Gonzalo Peciover 7 years ago(edited)
Not for this particular run, but count cant compute from output unless output is preexiting (from a previous run)
Gonzalo Peci
Gonzalo Peciover 7 years ago(edited)
Its due to terraform 11 internals (i think it fixed in 12, not sure) as it computes the count in plan stage, and at that stage, the output is empty
joshmyers
joshmyersover 7 years ago
Yes if the thing in question is a computed value
joshmyers
joshmyersover 7 years ago
12 is supposed to fix most of this I think, but yet to test
Gonzalo Peci
Gonzalo Peciover 7 years ago
Exactly, and that is there length(var.user_names)
Gonzalo Peci
Gonzalo Peciover 7 years ago
so your count cant exist if user_names = "${module.this.names}" sort of thing
Gonzalo Peci
Gonzalo Peciover 7 years ago
Freaking TF12 its building so much hope/expectation that im afraid of what is actually going to be there or when 🧌
joshmyers
joshmyersover 7 years ago
There was a post on this recently
Gonzalo Peci
Gonzalo Peciover 7 years ago
Yeah, saw it on reddit but still ¯\(ツ)/¯
joshmyers
joshmyersover 7 years ago
As names is not a computed value, I’m not sure this would trigger a count cannot be computed - https://github.com/terraform-providers/terraform-provider-aws/blob/master/aws/resource_aws_iam_user.go#L44-L48
joshmyers
joshmyersover 7 years ago
It would be good to confirm this and open an issue if so
joshmyers
joshmyersover 7 years ago
We can hit the count cannot be computed in quite a few modules depending on usage, which is a massive pain.
Gonzalo Peci
Gonzalo Peciover 7 years ago
Yeah true, it really depends on how you use them
joshmyers
joshmyersover 7 years ago
Gonzalo Peci
Gonzalo Peciover 7 years ago
I know names is not, but if you pass user_names = "${module.this.names}" as in my example
Gonzalo Peci
Gonzalo Peciover 7 years ago
to generate an implicit dependency
Gonzalo Peci
Gonzalo Peciover 7 years ago
then it is the product of certain output, and that output doesnt exist in the plan phase, so the it cannot know the count
Gonzalo Peci
Gonzalo Peciover 7 years ago
ill do small test if you want, but im farily certain it will trigger in that use case
Gonzalo Peci
Gonzalo Peciover 7 years ago(edited)
as you are passing a list of users from tfvars it should be fine, as they are known when calculating the count
joshmyers
joshmyersover 7 years ago
Correct
Gonzalo Peci
Gonzalo Peciover 7 years ago(edited)
I was not sure how CP was using it, and was just commenting as to the unintended side-effect that now user_names can no longer be the output of some other module, so potentially breaking your use-case or for anyone using it, so i'd rather comment and make sure this is "known"
joshmyers
joshmyersover 7 years ago
For your use case, I wonder if you could use null_data_source to create a dependency between the two modules, while passing in the same list of users to both modules.
joshmyers
joshmyersover 7 years ago
YMMV - totally untested
joshmyers
joshmyersover 7 years ago
joshmyers
joshmyersover 7 years ago
I know the above can be used to create deps between resources, not tried with modules @Gonzalo Peci too late on a Sunday to test 🙂
Gonzalo Peci
Gonzalo Peciover 7 years ago
Yeah, no worries, we have a different module, but was looking at the change and saw that situation. Im sure I follow your last message.
antonbabenko
antonbabenkoover 7 years ago
@Erik Osterman (Cloud Posse) interesting monologue in why-helm.mp4. I don’t have much to add because I still didn’t pass and embrace the complexity of k8s as operator. Once I understand it 100% or someone takes care it for me I will be happy to give less tasks to custom scripts/ansible/terraform. We are still too early in the evolution or maturity.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
thanks @antonbabenko 😃
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
any thoughts on changing defaults?
johncblandii
johncblandiiover 7 years ago
+1
johncblandii
johncblandiiover 7 years ago
Follow-up from last weeks issue of S3 uploads….CORS. 🤦‍♂️🏽 🤦‍♂️🏽 🤦‍♂️🏽 🤦‍♂️🏽

Update the bucket and 💥 ….uploads.
btai
btaiover 7 years ago
fyi this ticket has closed for those following it: https://github.com/terraform-providers/terraform-provider-aws/pull/4904
btai
btaiover 7 years ago
there is a aws_eks_cluster_auth data resource now https://www.terraform.io/docs/providers/aws/d/eks_cluster_auth.html
Richy de la cuadra
Richy de la cuadraover 7 years ago
Richy de la cuadra
Richy de la cuadraover 7 years ago
hello guys
Richy de la cuadra
Richy de la cuadraover 7 years ago
it’s safe to get directily the modules from public repo for my corporate infrestructure?
antonbabenko
antonbabenkoover 7 years ago
I would say yes, but based on number of forks on some of the modules (https://github.com/terraform-aws-modules/terraform-aws-vpc has 430 forks) people like to fork them and use their forks instead.
Richy de la cuadra
Richy de la cuadraover 7 years ago
perfect, it is the best practice, i guess!
antonbabenko
antonbabenkoover 7 years ago
I don’t know if it is, I never use my forked repos even if I am not managing those repos myself.
Richy de la cuadra
Richy de la cuadraover 7 years ago(edited)
in npm for instance, public utilities are very abstract so there’s not problem, but in terraform the code has power, could be change in the public repo , then when you run an update if not checks the plan, some resources are comprome
antonbabenko
antonbabenkoover 7 years ago
true, but you don’t have to run untrusted code unverified (hi curl | bash) anyway.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
I wrote up some thoughts on this before
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
there are also some approaches to "vendoring" in terraform
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
see terrafile
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
the problem with terraform and vendoring is with nested modules
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
the sources need to be rewritten
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
@antonbabenko how's the azure+atlantis coming along?
antonbabenko
antonbabenkoover 7 years ago
No progress there since we talked last time, too many other things
Andrew Jeffree
Andrew Jeffreeover 7 years ago
Do you guys have a tool or similar you use to bootstrap a new git repo for a customer and/or module? e.g adds .gitignore and basic makefile etc
Ryan Ryke
Ryan Rykeover 7 years ago
hi dudes, noticed you added mountpoints to the aws-ecs-container-definition module. but i didnt see anything for volumes
Ryan Ryke
Ryan Rykeover 7 years ago
am i missing something here?
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
@Ryan Ryke if we missed anything (https://github.com/cloudposse/terraform-aws-ecs-container-definition/commit/a1bf0d8338918e379c00097e29698265512b52d3), your contributions are welcome (it was a PR from an outside contributor)
Ryan Ryke
Ryan Rykeover 7 years ago
saw that commit thanks. i just noticed though that you need to have a volume created in order to use the mount point
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago(edited)
(the mountpoints were contributed by a community member; we're not using them anywhere right now)
Ryan Ryke
Ryan Rykeover 7 years ago
so the mountpoint is great if you already have a volume created
Ryan Ryke
Ryan Rykeover 7 years ago
i didnt know if there was some cool shit that you guys figured out
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
😃
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
haha
Ryan Ryke
Ryan Rykeover 7 years ago
im looking at adding "volumes" now
Ryan Ryke
Ryan Rykeover 7 years ago
but for whatever reason ecs isnt recognizing the option
Ryan Ryke
Ryan Rykeover 7 years ago
gonna read the docs some mroe
Ryan Ryke
Ryan Rykeover 7 years ago(edited)
just fyi if anyone else sees this later, im looking at this doc
Steven
Stevenover 7 years ago
@Ryan Ryke If it helps, I use both mount points and volumes in my module. https://github.com/devops-workflow/terraform-aws-ecs-service
Ryan Ryke
Ryan Rykeover 7 years ago
thanks dude
Samuli
Samuliover 7 years ago
Any advice on how to get terraform to update ecs service's task definition when using https://github.com/cloudposse/terraform-aws-ecs-alb-service-task
Samuli
Samuliover 7 years ago

 terraform state show module.regatta_portal.module.alb_service_task_portalbackend.aws_ecs_task_definition.default
id                                  = hiab-qa2-regattaportal-bend
arn                                 = arn:aws:ecs:eu-west-1:594350645011:task-definition/hiab-qa2-regattaportal-bend:3
revision                            = 3
Samuli
Samuliover 7 years ago

terraform state show module.regatta_portal.module.alb_service_task_portalbackend.aws_ecs_service.default
task_definition                                    = hiab-qa2-regattaportal-bend:2
Samuli
Samuliover 7 years ago
so task definition has revision=3 in state but ecs_service uses revision 2 for some reason
Samuli
Samuliover 7 years ago

lifecycle {
    ignore_changes = ["task_definition"]
}
Samuli
Samuliover 7 years ago
so this explains the behavior and found also the issue about why it was added. So the question after this is: Can I some how get terraform to ignore the ignore_changes 🙂 or do I have to update the ecs_service via some other means?
joshmyers
joshmyersover 7 years ago
@Samuli terraform is not a good tool for code deployments. The ECS module deploy a default backend, then ignore changes to task definition and you should be deploying to ECS via an out of band method
Samuli
Samuliover 7 years ago
OK, thanks for clarification 👍️
Nikola Velkovski
Nikola Velkovskiover 7 years ago(edited)
Otherwise there will be a state to manage per ecs service/task which is pretty ugly 🙂
sirhopcount
sirhopcountover 7 years ago
Hi, I'm trying to create EFS backups using the cloudposse/terraform-aws-efs-backup module (https://github.com/cloudposse/terraform-aws-efs-backup). And it was wondering how to specify the efs_mount_target_id.

Because the the type is specified as a string but the output of our EFS module (and that of the cloudposse/terraform-aws-efs) is a list (https://github.com/cloudposse/terraform-aws-efs/blob/f4c8c735a9d4d042928229b56e754eea400fb5c3/outputs.tf#L26).

And since there is no way to specify an availability zone how do I specify the "correct" efs_mount_target_id? I seem to missing something.
sirhopcount
sirhopcountover 7 years ago
Fixed it by using the first element of the list, don't know if that's the correct way to do it but it seems to work. I do however run into the following error:

* module.efs_backup.output.sns_topic_arn: Resource 'aws_cloudformation_stack.sns' does not have attribute 'outputs.TopicArn' for variable 'aws_cloudformation_stack.sns.outputs.TopicArn'
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
@sirhopcount we tested terraform-aws-efs-backup many months ago, maybe something changed already that throws the error
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
btw, AWS now has a Backup service which does EFS backup as well https://aws.amazon.com/backup/
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
should start using it (we don’t have a module for it)
sirhopcount
sirhopcountover 7 years ago
@Andriy Knysh (Cloud Posse) Already found that example 😉 my configuration doesn't differ that much (my configuration is in the issue I created: https://github.com/cloudposse/terraform-aws-efs-backup/issues/36). Thanks for tip, didn't know about AWS backup.
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
@sirhopcount if you find/fix any issues, PRs are welcome 🙂
sirhopcount
sirhopcountover 7 years ago
Unfortunately I'm not that familiar with AWS Cloudformation. I think it has to do with the output of the template (https://github.com/cloudposse/terraform-aws-efs-backup/blob/master/templates/sns.yml) as that's where the TopicArn output is set. I checked the terraform docs and it seems aws_cloudformation_stack does output a map on based on the template but I have no clue as to why TopicArn isn't in that map.
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
(don’t use master branch anyway, pin to a release)
sirhopcount
sirhopcountover 7 years ago
I pinned it to 0.8.0 but might try an older version and see if that works. But AWS Backup also seems very promising.
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
looks like 0.8.0 changed the topic ARN logic, try 0.6.0
Mark Grube
Mark Grubeover 7 years ago
How do you guys arrange components of your system in terraform? We started building out logical components that had their own remote state files, with those remote state files being pulled in as data for components that relied on it, but it feels a little bad because that it relies on the state file to be present instead of terraform building a dependency graph for you. Not sure if we should go back to components and all dependents sharing the same state file.
joshmyers
joshmyersover 7 years ago
https://github.com/cloudposse/terraform-root-modules/tree/master/aws is all different state files, doing the same thing as you mentioned above
joshmyers
joshmyersover 7 years ago
and other mechanisms other than pulling in the remote state directly e.g. lookup via tag
joshmyers
joshmyersover 7 years ago
there is no silver bullet in terms of dependencies between your top level modules (different TF state)
joshmyers
joshmyersover 7 years ago
There are some good reasons to split states across logical boundaries of resources
joshmyers
joshmyersover 7 years ago
also because of Terraform “fun”
Mark Grube
Mark Grubeover 7 years ago
I was originally splitting it up since I wanted our team to manage the underlying vpc while devs could create whatever infrastructure they wanted to and just reference my state file
Mark Grube
Mark Grubeover 7 years ago
have you guys ran into any issues with using this approach?
Mark Grube
Mark Grubeover 7 years ago
It does force you to know which piece of infra needs to be built first
Mark Grube
Mark Grubeover 7 years ago
and in the case of DR, might cause some confusion
joshmyers
joshmyersover 7 years ago
I’ve seen it done that way
joshmyers
joshmyersover 7 years ago
Make sure all resources folks are creating contain a set of consistent tags or something
joshmyers
joshmyersover 7 years ago
so you know why your AWS bill is so high 🙂
joshmyers
joshmyersover 7 years ago
where do your vanity domains point to? what dev1 created or dev2?
joshmyers
joshmyersover 7 years ago(edited)
or is this just in dev? across an org?
Mark Grube
Mark Grubeover 7 years ago
yeah its dev1, dev2, etc. Each team gets its own test environment complete with vpc, domain, etc
Mark Grube
Mark Grubeover 7 years ago
We build the modules, and have requirements for tags enforced by module variables
J
Jover 7 years ago
Hiya, terraforming a vm, and using a remote-exec to install ansible on the VM and then running your cloudposse/terraform-null-ansible - keep geting ansible-playbooks command not found - (how do you resolve this ??) we want to use vanilla images
Samuli
Samuliover 7 years ago
AFAIK the module uses local-exec to run ansible so you should have it installed locally not on the remote vm.
J
Jover 7 years ago
Thank you
Maarten van der Hoef
Maarten van der Hoefover 7 years ago
you have something already ?
Nikola Velkovski
Nikola Velkovskiover 7 years ago(edited)
Is there a place where a man can rant about terraform acceptance tests ? 🙂
Nikola Velkovski
Nikola Velkovskiover 7 years ago(edited)
on a more serious note do we have some hashicorpers here, I've a weird error when doing acceptance tests.
frednotet
frednotetover 7 years ago
hi everyone, Could someone direct me on how to import data (bucket) from other state ?
frednotet
frednotetover 7 years ago
Right now, I assume that if I apply my terraform; it will fails 'cause the bucket already exists. I want to keep it and the old state could be removed… how do I need to proceed ?
joshmyers
joshmyersover 7 years ago
So you have two different terraform configs (states) that create the same bucket?
joshmyers
joshmyersover 7 years ago
Want to move it from one state file to another? Is this bucket being used and cannot be destroyed/recreated?
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
👍️
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
has anyone used terraform with the AWS App Mesh yet? https://www.terraform.io/docs/providers/aws/r/appmesh_virtual_node.html#
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
Erik Weber
Erik Weberover 7 years ago
Anyone got a good and up to date best practice for how to structure terraform files?
Erik Weber
Erik Weberover 7 years ago
Thank you :-)
Mohit
Mohitover 7 years ago
Mohit
Mohitover 7 years ago
And I wanted to pass map variable via a file. I have tried to use template but it converts map into string and causing error.
Mohit
Mohitover 7 years ago
any advice ?
aaratn
aaratnover 7 years ago
@Mohit - One option that I can see is to use tfvars directly. -var-file=foo.tfvar and put your map variable there
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
@aaratn has a good suggestion
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago(edited)
@Mohit can you use tfvars files?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
there’s also the file(...) interpolation
aaratn
aaratnover 7 years ago
export TF_VAR_amap='{ foo = "bar", baz = "qux" }'
aaratn
aaratnover 7 years ago
This can be used aswell if you want to leverage environment variables
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
also, parameter store only supports strings; it has no concept of terraform data structures
Mohit
Mohitover 7 years ago
tfvars seems okay for me. It seems template_file only supports string.
Maarten van der Hoef
Maarten van der Hoefover 7 years ago
Anyone who uses Dependabot with tf modules in subfolders?
Steven
Stevenover 7 years ago
Nope, using it, but all mine are top level that it monitors
nutellinoit
nutellinoitover 7 years ago
@oscarsullivan_old i had the same problem
nutellinoit
nutellinoitover 7 years ago
you have subnets not assigned to a default route table
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
hey @oscarsullivan_old, @nutellinoit thanks for pointing that out
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
@oscarsullivan_old just an example, if you use this VPC module https://github.com/cloudposse/terraform-aws-eks-cluster/blob/master/examples/complete/main.tf#L36 with this subnets module https://github.com/cloudposse/terraform-aws-eks-cluster/blob/master/examples/complete/main.tf#L46, the route tables will be assigned correctly
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
although you can you any VPC modules for sure
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
and any subnets module that suits your needs, for example https://github.com/cloudposse?utf8=%E2%9C%93&q=subnets&type=&language=
nutellinoit
nutellinoitover 7 years ago
i think his problem is the acceptor vpc on the other account
nutellinoit
nutellinoitover 7 years ago
perhaps created manually
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
@oscarsullivan_old here is another example where we create a backing service VPC https://github.com/cloudposse/terraform-root-modules/blob/master/aws/backing-services/vpc.tf
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
(although they are in the same account so uses a diff peering module)
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
yea, that’s not easy first time
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
we spent a lot of time thinking about diff approaches
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
i’ll send you some links to get you started
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
yea, it’s a lot of stuff with no easy to follow steps
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
so, we tried two different approaches setting up multi-account architectures
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
all of those repos use the module catalog https://github.com/cloudposse/terraform-root-modules (it’s just an example, you will need to fork the repo and update it for your own needs)
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
but then we have a new approach of setting it up https://github.com/cloudposse/reference-architectures
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
where we generate everything (repos, Dockerfiles, etc.) from templates
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago

For my goal, as per above, do I need to re-do my architecture for accounts or use cloudposse’s module for VPC and subnets?
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
so you can try using the modules and setup two VPCs with subnets in two diff account, and test it
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
without using the old (prob manually created) resources
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
once it’s working for you, you can adjust for the existing resources, or even import them if they were created manually
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
you can, as long as the subnets and route tables are setup correctly as @nutellinoit mentioned
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
(unless there are other issues)
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
yes, using the TF modules will create everything, which is good for testing
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
then you can try the existing one. But I see you already tried and got the count error 🙂 which could be related to the route table not setup correctly (or to some other issues since the count error pops up everywhere)
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
yea that’s might be better, because if you do VPN -> VPC1 -> peering -> VPC2, you have to carefully allocate all CIDRs on all sides for them not to overlap
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
would be nice to see it, thanks 🙂
Erik Weber
Erik Weberover 7 years ago
Is there something like dependbot for terraform modules?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
dependabot 😛
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
it supports terraform modules
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
Erik Weber
Erik Weberover 7 years ago
oh, didn't know. Thanks 😄
xluffy
xluffyover 7 years ago
Hi everybody. I have a question about chicken-or-egg problem.

After register AWS, I have a root account. So I want to prepare some resources for remote backend state (a IAM user, KMS for encrypting S3 bucket, S3 bucket and DynamoDB table for locking). I can use root access_key, but IAM best practice doesn’t recommend that. Should I do? create a new IAM user (manually) or another solutions?
Lakshmi
Lakshmiover 7 years ago
Hi Guys. I am using this module https://github.com/cloudposse/terraform-aws-vpc-peering-multi-account and it works like a charm for the VPC's between the same account. However am struggling a bit setting it up across multiple accounts, especially around specifying the owner_id. Could you please point me to an example which has the correct parameters. Couldn't find anything related to this in the chat archives or the documentation. Apologies if this question is very basic, I am terraform newbie, have been checking it out only since yesterday (edited)