#terraform - March 2019

# Import the remote module
export TF_CLI_INIT_FROM_MODULE="git::<https://github.com/cloudposse/terraform-root-modules.git//aws/acm?ref=tags/0.35.1>"
export TF_CLI_PLAN_PARALLELISM=2

use terraform
use atlantis
use tfenv

 $ terraform state list | grep aws_subnet.public
module.subnets.aws_subnet.public[0]
module.subnets.aws_subnet.public[1]
module.subnets.aws_subnet.public[2]
module.subnets.aws_subnet.public[3]
 
 $ terraform state show module.subnets.aws_subnet.public[1]
Multiple instances found for the given pattern!

This command requires that the pattern match exactly one instance
of a resource. To view the matched instances, use "terraform state list".
Please modify the pattern to match only a single instance.

resource "aws_iam_role_policy_attachment" "policies" {
  count = "${length(var.role_policies)}"
  policy_arn = "${var.role_policies[count.index]}"
  role = "${aws_iam_role.role.id}"
}

module "remote_role" {
  source = "../modules/aws_cross_account_role"

  aws_external_account_id = "${local.aws_account_id}"
  role_name = "remote_role"
  role_policies = [
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "${aws_iam_policy.invoke_flow_resources_lambda_access.arn}",
    "${aws_iam_policy.create_function_flow_resources_lambda_access.arn}"
  ]
}

module "remote_role" {
  role_policies_count = 3
  role_policies = [
    "arn:aws:iam::aws:policy/ReadOnlyAccess",
    "${aws_iam_policy.invoke_flow_resources_lambda_access.arn}",
    "${aws_iam_policy.create_function_flow_resources_lambda_access.arn}"
  ]
}

resource "aws_iam_role_policy_attachment" "policies" {
  count = "${var.role_policies_count}"
  policy_arn = "${var.role_policies[count.index]}"
  role = "${aws_iam_role.role.id}"
}

curl <https://registry.terraform.io/.well-known/terraform.json>
{"modules.v1":"/v1/modules/","providers.v1":"/v1/providers/"}

data "aws_vpc" "accepter_vpc" {
  provider = "aws.<ALIAS_ACCEPTER>"

  tags = {
    Name = "${var.stage}-vpc"
  }
}

output "db_password" {
  value       = aws_db_instance.db.password
  description = "The password for logging in to the database."
  sensitive   = true
}

  ~ module.assumed_roles.aws_iam_group_membership.admin
      users.#:          "1" => "0"
      users.1070365961: "quang" => ""

  ~ module.quang.aws_iam_user_group_membership.default
      groups.#:          "0" => "1"
      groups.3764225916: "" => "g_ops_users"

* aws_route53_record.dns_zone_soa: 1 error(s) occurred:

• aws_route53_record.dns_zone_soa: [ERR]: Error building changeset: InvalidChangeBatch: [Tried to create resource record set [name='some.example.com.', type='SOA'] but it already exists]
 

[name-of-repository]
    - [username-arn-id-a] - pull
    - [username-arn-id-b] - push
[name-of-repository2]
    - [username-arn-id-d] - pull
    - [username-arn-id-c] - push

oscarsullivan [1:00 PM]

Oh really? A long time ago someone told me “don’t put internal infra on public DNS, it just makes it easier for intruders to map out your kit”

{
   "key1" = "val1"
   "key2" = "val2"
}

variable "public_subnet" {
  default = ["10.20.99.0/24" , "10.20.111.0/24", "10.20.222.0/24"]
}

output "last_element" {
  value = "${element(var.public_subnet, length(var.public_subnet) - 1 )}"
}

MacBook-Pro-5$ vault read  secret/infra_secrets
Key                 Value
---                 -----
refresh_interval    xxh
access_key          xxxxx
secret_key          xxxx

Error: Error refreshing state: 2 error(s) occurred:

* module.peering.data.aws_route_table.acceptor: data.aws_route_table.acceptor: value of 'count' cannot be computed
* module.peering.data.aws_route_table.requestor: data.aws_route_table.requestor: value of 'count' cannot be computed

data "aws_route_table" "requestor" {
  count     = "${var.enabled == "true" ? length(distinct(sort(data.aws_subnet_ids.requestor.ids))) : 0}"
  subnet_id = "${element(distinct(sort(data.aws_subnet_ids.requestor.ids)), count.index)}"
}

10.0.0.0        -   10.255.255.255  (10/8 prefix)
172.16.0.0      -   172.31.255.255  (172.16/12 prefix)
192.168.0.0     -   192.168.255.255 (192.168/16 prefix)

"data.aws_vpc.vpc.tags" does not have homogenous types. found TypeString and then TypeMap in ${data.aws_vpc.vpc.tags["Name"]}

-/+ module.subnets.aws_subnet.public[0] (new resource required)
      id:                                                                                         "subnet-XXX" => <computed> (forces new resource)
      arn:                                                                                        "arn:aws:ec2:us-west-2:XXX:subnet/subnet-XXX" => <computed>
      assign_ipv6_address_on_creation:                                                            "false" => "false"
      availability_zone:                                                                          "us-west-2a" => "us-west-2a"
      availability_zone_id:                                                                       "usw2-az2" => <computed>
      cidr_block:                                                                                 "10.0.96.0/19" => "10.0.128.0/19" (forces new resource)

-/+ module.subnets.aws_subnet.public[1] (new resource required)
      id:                                                                                         "subnet-XXX" => <computed> (forces new resource)
      arn:                                                                                        "arn:aws:ec2:us-west-2:XXX:subnet/subnet-XXX" => <computed>
      assign_ipv6_address_on_creation:                                                            "false" => "false"
      availability_zone:                                                                          "us-west-2b" => "us-west-2b"
      availability_zone_id:                                                                       "usw2-az1" => <computed>
      cidr_block:                                                                                 "10.0.128.0/19" => "10.0.160.0/19" (forces new resource)
    

      - printf '[{"name":"%s","imageUri":"%s"}]' "$CONTAINER_NAME" "$REPO_URI:$IMAGE_TAG" | tee imagedefinitions.json
artifacts:
  files: imagedefinitions.json

                "filters": [
                    {
                        "jsonPath": "$.action", 
                        "matchEquals": "published"
                    }
                ]

{
  "action": "published",
  "release": {