#terraform - June 2019

Bogdan
Bogdanover 7 years ago
is there a way to source env vars in https://github.com/cloudposse/terraform-aws-codebuild (v.0.1.6.0) from SSM Parameter store? cc: @Andriy Knysh (Cloud Posse) @Igor Rodionov @Jamie Nelson (BitFlight)? Apparently it’s supported in the native aws_codebuild_project:

    environment_variable {
      "name"  = "SOME_KEY2"
      "value" = "SOME_VALUE2"
      "type"  = "PARAMETER_STORE"
    }
Bogdan
Bogdanover 7 years ago
which I couldn’t find in the main.tf at ln183
C
Cloud Posseover 7 years ago
Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7).

This is an opportunity to ask us questions on terraform and get to know others in the community on a more personal level. Next one is Mar 20, 2019 11:30AM.

👉️ Add it to your calendar

:zoom: https://zoom.us/j/684901853

:slack: #office-hours (our channel)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
(ignore the incorrect date there - need to fix that!)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
office hour this wednesday
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
@Jamie Nelson (BitFlight) thanks! good to see you around 😃
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
@Erik Osterman (Cloud Posse) after all the damn waiting, I'm finally in the States
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
as of 2 weeks ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
was just gonna ask!
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
and now I'm a bit stabilised
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
welcome!!
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
East coast?
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
so I am catching up on my backlog
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
yeah, Connecticut
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
😄
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
cool!
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
I'm doing a pull request for this one in 30 mins https://github.com/cloudposse/terraform-aws-dynamic-subnets/issues/36
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
we're about to kick off 0.12 updates. we started with terraform-null-label (alsmost ready for merge)
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
I can see that activity!
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
Are you doing it in named tags or named branches?
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
so that 0.11 can be maintained too?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
going to keep master for bleeding edge / whatever is "latest" so 0.12
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
creating 0.11/master for bug fixes
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
cool
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago(edited)
going to keep 0.x module tags since interfaces are still subject to change
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
the thinking is no new feature work in 0.11
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
only bug fixes
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
so all updates should be patch releases to the last 0.11 release
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
My clients haven't been switching to 12
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
since they have huge libraries of existing modules
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
to 12 as the release versin?
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
0.12
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
yeah
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
er.. i mean, how are they tagging their modules post-0.12
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
i see some bumping the major version
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
Ah, they haven't yet. 😛
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
(don't really want to do that since not even terraform is 1.x!)
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
Just haven't updated to use 0.12
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
ok
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
I'll brb, i'm gonna finish this module
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
then I can look at what it takes to convert a module to 0.12
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
the main blocker I have right now is that terraform-docs and json2hcl do not support 0.12, which i what we've been using to (a) generate README.md documentation, (b) validate that input and output descriptions have been set
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
ah... annoy
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
I'm getting inventive in this module to maintain backwards compatibility
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
as far as I'm concerned that's not a requirement. if we have to settle for LCD, then we lose the benefits of 0.12 that make it so compelling.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago(edited)
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
Okay @Erik Osterman (Cloud Posse) finished the pull https://github.com/cloudposse/terraform-aws-dynamic-subnets/pull/50
Ayo Bami
Ayo Bamiover 7 years ago
Ayo Bami
Ayo Bamiover 7 years ago
am not sure what am doing wrong.. I did tag the subnet with shared
Ayo Bami
Ayo Bamiover 7 years ago
tags = {
“kubernetes.io/cluster/eks-beemo” = “shared”
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
@Ayo Bami which module are you using?
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
Also, is the subnet public or private?
Rob
Robover 7 years ago
Does anyone have suggestions for the best way to use the terraform-aws-ecs-codepipeline repo (or anythign similar) with more complex pipelines? It is hard coded to a single build and single deploy stage. However most real pipelines have multiple environments to deploy to with additional actions like automated tests and approval gateways. Ideally, we’d like something that is configurable to use the same codepipeline module for different project requirements. Any thoughts?
Vidhi Virmani
Vidhi Virmaniover 7 years ago
hello,

How can I use * in a route53 recordset using terraform for example *.<http://example.com|example.com>?
Shtrull
Shtrullover 7 years ago(edited)
need a little help,
I’m trying to create a bucket
resource “aws_s3_bucket” “blabla” {
bucket = “blabla-terrafom.dev”
acl = “private”
}
i want to make this as smart as possible if I’m in env prod i need it to be blabla-terrafom
but if i am in any other env i need it to be blabla-terrafom.${var.Environment_short}
my problem is how to make the “.” only appear when Environment_short is not prd
Shtrull
Shtrullover 7 years ago
i tried playing with ${var.Environment_short != “prd”: “.${var.Environment_short}“} but with no luck
loren
lorenover 7 years ago(edited)
bucket = “blabla-terrafom${var.Environment_short != "prd" ? ".${var.Environment_short}" : ""}”
loren
lorenover 7 years ago(edited)
or clean it up with a local:

locals {
  env = "${var.Environment_short != "prd" ? ".${var.Environment_short}" : ""}"
}
loren
lorenover 7 years ago(edited)
bucket = "blabla-terrafom${local.env}"
Mike Nock
Mike Nockover 7 years ago
Morning all! Was wondering if anyone has run into this before:
Creating an ECS cluster and service with terraform, have the ALB, cluster, target group, and target group attachment set, task definition and all that gets created as expected - but when TFE goes to create the service it fails because it never associated an ALB with the target group and therefore can't add a target to the group.
Mike Nock
Mike Nockover 7 years ago
Error code:
Error: Error modifying Target Group Attributes: InvalidConfigurationRequest: The provided target group attribute is not supported
status code: 400, request id: ff5c4dd6-870b-11e9-832e-3dd05e9547d1
Suresh
Sureshover 7 years ago
Hey any quick example of how to provide list var with the terraform cli
Suresh
Sureshover 7 years ago(edited)
I am using this
terraform plan -var env_vars={"test" : "value", "test1": "value2"}
Suresh
Sureshover 7 years ago
it failing cause of HCL syntax error
loren
lorenover 7 years ago
wrap it in quotes? env_vars='{"test" : "value", "test1": "value2"}'
loren
lorenover 7 years ago
or maybe -var 'env_vars={"test" : "value", "test1": "value2"}'
loren
lorenover 7 years ago
or even -var=env_vars='{"test" : "value", "test1": "value2"}'?
Suresh
Sureshover 7 years ago
let me try those @loren 🤞
loren
lorenover 7 years ago
that's a map though, question was about a list...
Suresh
Sureshover 7 years ago
Sorry, looking for map var
loren
lorenover 7 years ago

terraform apply -var="image_id=ami-abc123"
terraform apply -var='image_id_list=["ami-abc123","ami-def456"]'
terraform apply -var='image_id_map={"us-east-1":"ami-abc123","us-east-2":"ami-def456"}'
Suresh
Sureshover 7 years ago
tried the same, neither of it worked 😞
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
office hours starting now: https://zoom.us/j/684901853
johncblandii
johncblandiiover 7 years ago
anyone know if AWS Aurora is always a cluster or can it be a single instance? Seems like using db_instance is an option, but i’m getting errors with storage type io1
Paul Lupu
Paul Lupuover 7 years ago
hello, can someone help me understand what I'm doing wrong in the elastic-beanstalk-environment module? here's the code / output https://gist.github.com/lupupaulsv/d705e695be36e0ec6c21f1b9e9d70a3b
Mike Nock
Mike Nockover 7 years ago
Hey guys, using this module: https://github.com/cloudposse/terraform-aws-s3-log-storage?ref=master
and running into an issue where the ALBs I'm creating don't have access to the bucket. Is that an attribute input I need to set?
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
it’s a working example of ALB and log storage
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
Mike Nock
Mike Nockover 7 years ago
Ahhh I think that last one is it, I don't think I applied a bucket policy
Mike Nock
Mike Nockover 7 years ago
Seems like the log bucket is pretty similar to the log_storage one that I'm using. Same variables and what not
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
it’s the same + the IAM policy
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
terraform-aws-lb-s3-bucket uses terraform-aws-s3-log-storage and adds the policy
Maeghan Porter
Maeghan Porterover 7 years ago
Hey all! I'm using a couple of your guys' modules to create and peer a vpc. I'm trying to do it all in one tf run so that the state file won't be crazy. But I'm getting these errors on the plan:
* module.peering.module.vpn_peering.data.aws_route_table.requester: data.aws_route_table.requester: value of 'count' cannot be computed
* module.peering.module.monitoring_peering.data.aws_route_table.requester: data.aws_route_table.requester: value of 'count' cannot be computed[0m
Maeghan Porter
Maeghan Porterover 7 years ago
I suspect it's because the route tables will be created by the vpc module, but it doesn't know that and expects them to already exist maybe?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
unfortunatly, any time a data provider is used you cannot do all-in-one run
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
if that data provide depends on something created
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
that's because terraform expects the plan to be entirely deterministic before execution. if you instead inlined all the modules into the same context
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
and got rid of the data provider, you could possibly mitigate it
Maeghan Porter
Maeghan Porterover 7 years ago
damn, I thought that might be true. I was hoping I could do it all in one because we’re trying to automate it and if the pipeline runs again the statefile that created the vpc is like “wtf is this stuff, I’ll just wipe that out for you”
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
also, some new options might be available in 0.12, but we haven't explored that yet
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
Maeghan Porter
Maeghan Porterover 7 years ago
oh ok cool, I will have a look, thank you!
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
we've just kind of "sucked it up" for now hoping that eventually this will all get addressed. then we use a Makefile with an apply target or coldstart target to help us in those coldstart scenarios
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
but it's not ideal... sorry!!
Maeghan Porter
Maeghan Porterover 7 years ago
All good, thank you for the explanation! We will also have to suck it up I guess 🙂
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
There are some workarounds. Like using Makefile like Erik says to run targeted applies in a certain order.
The workaround I use the most is splitting terraform into parts with individual state files, and using terraform_remote_state to look up the values
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
This way it stays native terraform
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
Instead of requiring make
Meb
Mebover 7 years ago
What are your best practises for data importing in TF from another stack (tfstate). Examples showing that.
Bogdan
Bogdanover 7 years ago
also asking here since it’s relevant
Mike Nock
Mike Nockover 7 years ago
Does anyone know what format this module outputs the subnet_ids in?
https://github.com/terraform-community-modules/tf_aws_public_subnet

Trying to import the list of subnets as a string but it keeps saying I'm incorrectly attempting to import a tuple with one element (it should have 2 subnets)
PePe Amengual
PePe Amengualover 7 years ago
I was using the terraform-aws-alb-ingress and I had to fork it but now I’m taking another look and I think I misunderstood the intention , please correct me if I’m wrong but if I was going to use it I should declare a module per target group I have ?
PePe Amengual
PePe Amengualover 7 years ago
basically this module was made for one target group
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
Yes, more or less
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
@PePe Amengual it was design to "kind'a" work like an Ingress rule in kubernetes
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
(since we approached ECS coming from a k8s background)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
That's also why we have a "default backend"
PePe Amengual
PePe Amengualover 7 years ago
I see ok, my problems is that I try to used thinking it could ingest a list
PePe Amengual
PePe Amengualover 7 years ago
but in K8s you declare every ingress
PePe Amengual
PePe Amengualover 7 years ago
so it make sense
PePe Amengual
PePe Amengualover 7 years ago
I will just call it again for my bluegreen target
PePe Amengual
PePe Amengualover 7 years ago
and at some point I will send a PR for the ALB module to support arbitrary targets
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
Good for terraform modules
rj
rjover 7 years ago
Anyone know of a good GUI for terraform, other than Atlas?
C
Cloud Posseover 7 years ago
Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7).

This is an opportunity to ask us questions on terraform and get to know others in the community on a more personal level. Next one is Mar 20, 2019 11:30AM.

👉️ Add it to your calendar

:zoom: https://zoom.us/j/684901853

:slack: #office-hours (our channel)
[Gamifly] Vincent
[Gamifly] Vincentover 7 years ago(edited)
Hi guys, I'm running nuts against this error.
I am using the tutorial to create a beanstalk app ; it seems that the output required to create a related env is not working.
Any idea why ?
I'm running on Windows 10 (yeah, yeah...!):
terraform v0.11.14
+ provider.aws v2.12.0
+ provider.null v2.1.2
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
@[Gamifly] Vincent did you look at the example of using EB application and environment https://github.com/cloudposse/terraform-aws-jenkins/blob/master/main.tf
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago(edited)
[Gamifly] Vincent
[Gamifly] Vincentover 7 years ago(edited)
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
what does your outputs.tf file look like?
[Gamifly] Vincent
[Gamifly] Vincentover 7 years ago
the outputs.tf from elastic_beanstalk_application looks like that
[Gamifly] Vincent
[Gamifly] Vincentover 7 years ago
And the resource is...
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
maybe some concurrency issue, did you try to apply more than once?
[Gamifly] Vincent
[Gamifly] Vincentover 7 years ago
yup, alot 😮
As the application is created, I need to destroy it manually from the aws console between each try
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
why manually?
[Gamifly] Vincent
[Gamifly] Vincentover 7 years ago
why not ?!
[Gamifly] Vincent
[Gamifly] Vincentover 7 years ago
[Gamifly] Vincent
[Gamifly] Vincentover 7 years ago
actually, the app exists within the console ; just the state not up-to-date ?
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
usually happens when one tries to add/delete something manually 🙂
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
but seriously, try to remove everything and apply again
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
what state backend are you using?
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago(edited)
what you see also happens when you apply something using local state, then exit the shell (or whatever you are using to access AWS), and the state gets lost; or you just delete the state file on purpose or accidentally
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
use S3 for TF state backend
[Gamifly] Vincent
[Gamifly] Vincentover 7 years ago
I think I just use the local backend ; I'll try the destroy and apply...see you in some minutes !
johncblandii
johncblandiiover 7 years ago
@wbrown43 hit a problem with two CP modules conflicting with internal SGs.

https://github.com/cloudposse/terraform-aws-rds-cluster/blob/master/main.tf#L12 …and…
https://github.com/cloudposse/terraform-aws-alb/blob/master/main.tf#L11

Because we use the same values the name becomes the same: app-name-dev. So the second one to create fails because the first w/ that same name exists.

What is the best approach to handle this conflict? We have our own db SG so don’t really want the rds cluster one, tbh, but it is required by the module.
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago(edited)
you can add diff attributes attributes = "${distinct(compact(concat(var.attributes,list("something", "else"))))}"
johncblandii
johncblandiiover 7 years ago
but it would add those to the cluster too
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
yes it will add
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
need a PR to fix that conflict if you don’t want to add attributes to all the names
[Gamifly] Vincent
[Gamifly] Vincentover 7 years ago
Do you know if there is any nice way to recover from that ?
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
look into why default is nil and if you have it
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
once that is fixed, run plan/apply again (should be nothing to recover here)
[Gamifly] Vincent
[Gamifly] Vincentover 7 years ago
It actually happens during a destroy.
I went through tfstate, to check where it was missing, then refresh/plan/apply to 'refresh' aws_vpc.default
Then destroy again. Same error...I think there is something I'm missing here ; as I reapplyed, should'nt the module be ok ?
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
you need to destroy everything first. If terraform can’t destroy something, you need to go to the AWS console and destroy it manually. Since some things were destroyed (and probably applied) manually before and were missing from the state file, it’s difficult to say anything what is missing or wrong
[Gamifly] Vincent
[Gamifly] Vincentover 7 years ago(edited)
Ok, thanks !
I though there maybe was a way not to do manually again 😛
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
if TF can’t destroy something b/c it’s in the state file, but missing in AWS, you need to taint the resource
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
usually, there are two rules on how to clean up a TF mess:
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago(edited)
1. If something is in AWS, but not in the state file (b/c of lost or broken or deleted state file) -> manually delete the resources from AWS console
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago(edited)
2. If something is in the state file, but not in AWS (was manually deleted/updated/changed) -> terraform taint or state rm the resources
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
there is a third way to clean up the mess, but not sure if you want to do it 🙂
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
3. Delete the state file and then nuke the account https://github.com/gruntwork-io/cloud-nuke or https://github.com/rebuy-de/aws-nuke
[Gamifly] Vincent
[Gamifly] Vincentover 7 years ago
That sounds like a whiter-than-white cleaning 🤣
[Gamifly] Vincent
[Gamifly] Vincentover 7 years ago
Thanks for those advises
[Gamifly] Vincent
[Gamifly] Vincentover 7 years ago(edited)
What about...things that are not in AWS because manually deleted nor in the state ? ( I juste deleted the vpc but the error strikes again 🤔 )
I may sleep on that by now and get back on it on the morrow with a clearer mind. Thanks again !
Tony Thayer
Tony Thayerover 7 years ago
Does anyone have any advice on the elasticsearch module?
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
Tony Thayer
Tony Thayerover 7 years ago
Yes, that's the one I'm using. It builds the cluster just fine but I'm unable to access the consoles it creates.
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
you can’t, at least from the internet
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
it creates the cluster in a VPC
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
so the cluster is not publicly accessible
Tony Thayer
Tony Thayerover 7 years ago
ok
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
a few ways of accessing it:
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
1. Add a bastion server to the VPC
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago(edited)
2. We usually deploy an identity-aware proxy (IAP) in a kubernetes cluster, which allows us to access the Kibana (which is also deployed with the cluster)
Tony Thayer
Tony Thayerover 7 years ago
ok, thanks for the advice.
johncblandii
johncblandiiover 7 years ago
If I have this correct, *-dev-exec from ecs-web-app is supposed to be the role we change to enable SSM read/write, correct?

If so, it seems we cannot access it without it being an output. I’ll PR changes if needed, but I wanted to verify this before doing so. Thoughts?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
for Atlantis
johncblandii
johncblandiiover 7 years ago
yeah, was looking at it, but i don’t see reference to those params
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
hrmmm
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
You don't see reference to module.web_app.task_role_name?
johncblandii
johncblandiiover 7 years ago
and i did use the task_role_name
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
(which params...)
johncblandii
johncblandiiover 7 years ago
that didn’t work, though, since that’s not the exec one
johncblandii
johncblandiiover 7 years ago
we’re using terraform-aws-ecs-alb-service-task
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
are you sure you what that phase?
johncblandii
johncblandiiover 7 years ago
?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
is this something your container needs to do?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
e.g. read from SSM
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
with chamber
johncblandii
johncblandiiover 7 years ago
using task_secrets and it throws access denied
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
ok, haven't tried that yet
johncblandii
johncblandiiover 7 years ago
ah, forgot you have chamber in there
johncblandii
johncblandiiover 7 years ago
Fetching secret data from SSM Parameter Store in us-west-2: AccessDeniedException: User: arn:aws:sts::496386341798:assumed-role/event-horizon-replicator-dev-exec/654fb1ebeef7484c867a885e23ae82a0 is not authorized to perform: ssm:GetParameters on resource: arn:aws:ssm:..........
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
you might need to get back to us on that one! 😃
johncblandii
johncblandiiover 7 years ago
😄
johncblandii
johncblandiiover 7 years ago
ok…i’ll tie things in then get back to you
Bogdan
Bogdanover 7 years ago
I’m using the github.com/cloudposse/terraform-aws-codebuild and get the following error when setting cache_enabled = false and/or cache_bucket_suffix_enabled = false:
${local.cache_def[var.cache_enabled]}
    * module.name.local.cache: local.cache: key "0" does not exist in map local.cache_def in:

${local.cache_def[var.cache_enabled]}
cc: @Erik Osterman (Cloud Posse) @Igor Rodionov @Andriy Knysh (Cloud Posse) @Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
I wrote that bit, ill take a look
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago(edited)
Put quotes around the "true" or "false"
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
and try again
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
its a terraform pain. true and false are binary, but "true" and "false" are strings that terraform converst to binary
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
and in the cache_def map, it uses the string version
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
I can probably make that more stable in the future, especially with 0.12
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
@Bogdan
Bogdan
Bogdanover 7 years ago
@Jamie Nelson (BitFlight) it worked! I can also help with a PR if you’re too busy
Bogdan
Bogdanover 7 years ago
thanks!
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago(edited)
(we'll be slowly fixing the "true"/"false" issue as we upgrade modules to 0.12)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
the latest terraform-null-label now supports boolean
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
130 modules to go
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
🤦
Tony Thayer
Tony Thayerover 7 years ago
let alone having to have both versions of terraform installed next to each other depending on the modules you're using
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
yea...
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
speaking of which, have you seen how we handle that in geodesic?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
you can write use terraform 0.12 in the .envrc for a given project
Tony Thayer
Tony Thayerover 7 years ago
oh thats nice
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
@Bogdan theres an open PR with the fix for it in there https://github.com/cloudposse/terraform-aws-codebuild/pull/43
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
Which I totally don't remember doing
cabrinha
cabrinhaover 7 years ago
anyone have an AWS AppMesh terraform module they're working on?
Julio Tain Sueiras
Julio Tain Sueirasover 7 years ago
@Andriy Knysh (Cloud Posse) I am planning to add support for 0.12 to tfmask if is ok with you guys
Julio Tain Sueiras
Julio Tain Sueirasover 7 years ago
to be honest, I wish there is a way to auto mark vault data source as sensitive
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
thanks @Julio Tain Sueiras, your contribution is welcome
antonbabenko
antonbabenkoover 7 years ago
https://github.com/cloudposse/terraform-aws-ecs-container-definition - I believe this is a blocker for many who wants to use Terraform 0.12, or is it working with 0.12 already?
J
Jover 7 years ago
how do I get tfmask installed / setup as part of a pipeline?
antonbabenko
antonbabenkoover 7 years ago
https://github.com/cloudposse/terraform-aws-ecs-container-definition/pull/36 - @Igor Rodionov you are one of contributor there who is online 🙂 Does it look good for you to get this merged? I also run all examples with Terraform 0.12 and they work as expected.
Igor Rodionov
Igor Rodionovover 7 years ago
yes, but I do not involved now into migration to terraform 0.12
antonbabenko
antonbabenkoover 7 years ago
This is the only change which is needed to get that module to work with both - 0.11 and 0.12. The rest is cosmetic changes which we can do later.
Igor Rodionov
Igor Rodionovover 7 years ago
done
Igor Rodionov
Igor Rodionovover 7 years ago
release created 0.15.0
antonbabenko
antonbabenkoover 7 years ago
Thanks! I really don’t like to maintain my own forks 🙂
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
Is it true to this day you can still not pin providers in modules without supporting all parameters of the provider?!?!?
loren
lorenover 7 years ago
or try this: terraform plan -var <region>?
johncblandii
johncblandiiover 7 years ago
I think I ran the right make commands for docs, but let me know of any changes required: https://github.com/cloudposse/terraform-aws-ecs-alb-service-task/pull/27
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
Public #office-hours starting now! Join us on Zoom if you have any questions. https://zoom.us/j/684901853
PePe Amengual
PePe Amengualover 7 years ago
Hi I was using : https://github.com/cloudposse/terraform-aws-ecs-container-definition and I did not see a way to use docker labels, Is that possible?
marc
marcover 7 years ago
I have a project where someone ran terraform using 0.12 by mistake, since it was a super simple repo it just worked, does anyone know is there a way to make the state file compatible with 0.11.14 again?
marc
marcover 7 years ago
I don't think so, but figured I'd ask
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
If you're using a versioned bucket, you might be able to just pull the previous .tfstate file
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
and restore it
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
(our terraform-aws-tfstate-backend does versioning)
David Nolan
David Nolanover 7 years ago
And then add the terraform version restrictions into your project config to prevent another oops before you're ready.
loren
lorenover 7 years ago

terraform {
  required_version = "0.11.14"

  backend "s3" {}
}
David Nolan
David Nolanover 7 years ago(edited)
I've been using required_version = "<0.12.0, >= 0.11.11" (or pick some preferred minimum for you)
loren
lorenover 7 years ago(edited)
i pin exact versions for terraform in my root config because state is not backwards compatible
loren
lorenover 7 years ago
so if someone runs apply with tf 0.11.14, that's it, everyone has to use that version
Igor
Igorover 7 years ago(edited)
^^ Is that true? How do you upgrade the state files then when you migrate to newer versions, specifically 0.12?
Nikola Velkovski
Nikola Velkovskiover 7 years ago
https://github.com/tfutils/tfenv seems to work quite well
Hasen Ahmad
Hasen Ahmadover 7 years ago
hello all! I'm new here but have been using the sweetops modules in terraform for a little while but have run into an issue. I am trying to use the jenkins module that creates an beanstalk app etc. The issue I am running into is beanstalk has this error Creating Load Balancer listener failed Reason: An SSL policy must be specified for HTTPS listeners. I made a key pair for the jenkins module so im not sure what needs to happen?
Meb
Mebover 7 years ago
Any idea for the error
Initializing modules...
- module.eg_prod_bastion_label
Error downloading modules: Error loading modules: module eg_prod_bastion_label: Error parsing .terraform/modules/3b7de6adc81422f0cdde31b2ae8597c0/main.tf: At 14:25: Unknown token: 14:25 IDENT var.enabled

using
https://github.com/cloudposse/terraform-null-label
The example in copy & paste..
Meb
Mebover 7 years ago
got doubt & found it. Master is 0.12 terraform so I had to force it ot use 0.11.1
Meb
Mebover 7 years ago(edited)
this is gonna be fun
J
Jover 7 years ago
does anyone know how to get an ip address from an address_prefix in terraform and then pass that to ansible ?
Meb
Mebover 7 years ago
terraform output + jq > ansible?
loren
lorenover 7 years ago
TIL terraform output takes an output name as an argument, for when you don't want all the outputs
PePe Amengual
PePe Amengualover 7 years ago
I created a simple codedeploy module for my Fargate task and everything went well but I notice that the target groups were switched so not terraform wants to correct the change :
PePe Amengual
PePe Amengualover 7 years ago
Terraform will perform the following actions:

  ~ module.alb.aws_lb_listener.https
      default_action.0.target_group_arn: "arn:aws:elasticloadbalancing:us-east-1:99999999999:targetgroup/app-green/6cf4c676cb238179" => "arn:aws:elasticloadbalancing:us-east-1:99999999999:targetgroup/app-default/fd2cdc38bdf07078"

PePe Amengual
PePe Amengualover 7 years ago(edited)
PePe Amengual
PePe Amengualover 7 years ago
where they use local-exec provider to do the code deploy part which I found weird but that is me…
PePe Amengual
PePe Amengualover 7 years ago
what do you guys recommend to “solve” this ? maybe this does not need solving and just deal with it, since at some point the arn will go back to the original
PePe Amengual
PePe Amengualover 7 years ago
maybe I could run another TF that access the same state and search using data. resources and switch the target group arns…
PePe Amengual
PePe Amengualover 7 years ago
any ideas are welcome
S
SweetOpsover 7 years ago
Are you using some of our terraform-modules in your projects? Maybe you could leave us a testimonial! It means a lot to us to hear from people like you.
jaydip189
jaydip189over 7 years ago
I want to create nodejs elastic beanstalk resources using terraform template
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
I need some feedback here! Difficult choice and it feels like we are going against what most other modules do, but not sure if that’s reason enough to continue that practice.
C
Cloud Posseover 7 years ago
Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7).

This is an opportunity to ask us questions on terraform and get to know others in the community on a more personal level. Next one is Mar 20, 2019 11:30AM.

👉️ Add it to your calendar

:zoom: https://zoom.us/j/684901853

:slack: #office-hours (our channel)
PePe Amengual
PePe Amengualover 7 years ago
I should have posted this today instead of late friday….
anyhow, any thoughts on this ?
Mads Hvelplund
Mads Hvelplundover 7 years ago
Hi #terraform

Let's say I have a list keys and I want to transform it into a map, using something like:


locals {
  account = "287985351234"
  names   = ["alpha", "beta", "gamma"]
  region  = "eu-west-1"
}

data "null_data_source" "kms" {
  count = "${length(local.names)}"

  inputs = {
    key   = "${upper(local.names[count.index])}"
    value = "${format("arn:aws:kms:%s:%s:key/%s",local.region, local.account, local.names[count.index])}"
  }
}

output "debug" {
  value = "${data.null_data_source.kms.*.outputs}"
}


The output is a list of maps:


data.null_data_source.kms[2]: Refreshing state...
data.null_data_source.kms[0]: Refreshing state...
data.null_data_source.kms[1]: Refreshing state...

Apply complete! Resources: 0 added, 0 changed, 0 destroyed.

Outputs:

debug = [
    {
        key = ALPHA,
        value = arn:aws:kms:eu-west-1:287985351234:key/alpha
    },
    {
        key = BETA,
        value = arn:aws:kms:eu-west-1:287985351234:key/beta
    },
    {
        key = GAMMA,
        value = arn:aws:kms:eu-west-1:287985351234:key/gamma
    }
]


Is there any way to make it one map with all the keys like this?:


    {
        ALPHA = "arn:aws:kms:eu-west-1:287985351234:key/alpha",
        BETA = "arn:aws:kms:eu-west-1:287985351234:key/beta",
        GAMMA = "arn:aws:kms:eu-west-1:287985351234:key/gamma"
    }
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
you can create two lists and then use zipmap to create a map https://www.terraform.io/docs/configuration-0-11/interpolation.html#zipmap-list-list-
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
Mads Hvelplund
Mads Hvelplundover 7 years ago
the problem is that I want to apply functions to values in the first list (the keys). You can't do that with formatlist.
Mads Hvelplund
Mads Hvelplundover 7 years ago
(I think 😉)
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
just create two lists for names, one in lower-case, the other in upper-case 🙂
Mads Hvelplund
Mads Hvelplundover 7 years ago
umm, no.
Mads Hvelplund
Mads Hvelplundover 7 years ago
look, i can easily write out the last map. i want to reduce the amount of error prone cut and paste in my template.
Mads Hvelplund
Mads Hvelplundover 7 years ago
once there is twenty names in the list it gets very verbose and tedious to scroll through
loren
lorenover 7 years ago
what happens if you do:

data "null_data_source" "kms" {
  count = "${length(local.names)}"

  inputs = {
    "${upper(local.names[count.index])}" = "${format("arn:aws:kms:%s:%s:key/%s",local.region, local.account, local.names[count.index])}"
  }
}
loren
lorenover 7 years ago
oh right, again a list of maps
loren
lorenover 7 years ago
shoot i think i did something like this somewhere, using zipmap
loren
lorenover 7 years ago
goes hunting through old code
loren
lorenover 7 years ago(edited)
ahh yes, you can key into your null data source outputs...

locals {
  its_a_map = "${zipmap(data.null_data_source.kms.*.outputs.key, data.null_data_source.kms.*.outputs.value)}"
}
Mads Hvelplund
Mads Hvelplundover 7 years ago
Perfect! Thanks a million 🙂
Bogdan
Bogdanover 7 years ago
resource "null_resource" "get-ssm-params" {
  provisioner "local-exec" {
    command = "aws ssm get-parameters-by-path --path ${local.ssm_vars_path}--region ${var.region} | jq '.[][].Name' | jq -s . > ${local.ssm_vars}"
  }
}

resource "null_resource" "convert-ssm-vars" {
  count = "${length(local.ssm_vars)}"

  triggers = {
    "name"      = "${element(local.ssm_vars, count.index)}"
    "valueFrom" = "${local.ssm_vars_path}${element(local.ssm_vars, count.index)}"
  }
}

guys do you know a way to get the output of a command that ran in a null_resource local-exec provisioner into an HCL list? I tried the above but didn’t work 😞
Mads Hvelplund
Mads Hvelplundover 7 years ago
do you need to read the ssm params that way? you could probably load the value with a data element, jsondecode it, and get the Name key out with normal interpolation syntax
Bogdan
Bogdanover 7 years ago
@Mads Hvelplund thanks. I’ll use the external provider and data source to execute my script
Bogdan
Bogdanover 7 years ago
sure, there’s a data source for a single ssm param
Bogdan
Bogdanover 7 years ago
but not if you have tens
Bogdan
Bogdanover 7 years ago
if there’s tens, one would like a different way to read them without also generating/creating tens of data sources
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
Hey bogdan, You may want to instead generate a lambda function and call it, to return the list.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
In the same way #airship uses the lambda function to lookup docker labels.
Bogdan
Bogdanover 7 years ago
I hear you @Jamie Nelson (BitFlight) but when would the lambda update the task definition’s container definition to inject any new/updated params? i found that having more control on when the TD/CD gets a new revision (at apply-time) is safer
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
@Bogdan oh I was meaning you can extend the tf functionality by creating a lambda and immediately calling it. And using the results to change the task...
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
If you haven’t done this before have a look at the process the https://airship.tf ecs service module creates and calls the lambda function to get extra ecs task details
PePe Amengual
PePe Amengualover 7 years ago(edited)
I need to create a beanstalk environment and I was going to use the cloudposse modules, but I need a NLB with static ips and SSL termination
PePe Amengual
PePe Amengualover 7 years ago
but I do not know if Beanstalk multicontainer might not be able to use such setup ?
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
@Callum Robertson this channel will help you.
Maarten van der Hoef
Maarten van der Hoefover 7 years ago
Hi Everyone, with https://github.com/hashicorp/terraform/issues/17179 still open ( full reshuffle of resources / recreation happens when the top item of the list gets removed ) , I'm wondering how other Terraformers are doing mass creation of AWS resources, like users.
Julio Tain Sueiras
Julio Tain Sueirasover 7 years ago
@Andriy Knysh (Cloud Posse) 😃 0.12.2 added yaml decoding and encoding, pretty nice(and allow pretty nice but weird conversion from json to yaml)
Julio Tain Sueiras
Julio Tain Sueirasover 7 years ago
(terraform v0.12.2)
Abel Luck
Abel Luckover 7 years ago
I'm using the null-label in a reusable module. I want to pass the user-supplied tags as well as add a new one
Abel Luck
Abel Luckover 7 years ago
tags = "${var.tags}" is what I have now.. the user may or may not have supplied any tags
Abel Luck
Abel Luckover 7 years ago
what's the proper way to add a tag there?
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
in your top-level module, you can merge the tags supplied by the user with some hardcoded tags. Then send the resulting map to the label module
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
Julio Tain Sueiras
Julio Tain Sueirasover 7 years ago
@Andriy Knysh (Cloud Posse) question for ya, do you guys use AzureDevops?
Julio Tain Sueiras
Julio Tain Sueirasover 7 years ago
I mean AzureDevOps as in the CI/CD service
Julio Tain Sueiras
Julio Tain Sueirasover 7 years ago
so me(and my company is going to release terraform provider for azuredevops)
Julio Tain Sueiras
Julio Tain Sueirasover 7 years ago
just need to word the license correctly
Julio Tain Sueiras
Julio Tain Sueirasover 7 years ago
(to avoid any issue)
Julio Tain Sueiras
Julio Tain Sueirasover 7 years ago
(my company as in the company I work in)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
I would follow the lead of what terraform-providers (official hashicorp org) uses
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
it's all MPL-2.0
Julio Tain Sueiras
Julio Tain Sueirasover 7 years ago
true
Julio Tain Sueiras
Julio Tain Sueirasover 7 years ago
P.S. I already implemented the following
Julio Tain Sueiras
Julio Tain Sueirasover 7 years ago

Resources: 
 azuredevops_project
 azuredevops_build_definition
 azuredevops_release_definition
 azuredevops_service_endpoint
 azuredevops_service_hook
 azuredevops_variable_group
 azuredevops_task_group

Data Sources:
 azuredevops_project
 azuredevops_service_endpoint
 azuredevops_source_repository
 azuredevops_workflow_task
 azuredevops_group
 azuredevops_user
 azuredevops_build_definition
 azuredevops_agent_queue
 azuredevops_task_group
 azuredevops_variable_group
 azuredevops_variable_groups
Julio Tain Sueiras
Julio Tain Sueirasover 7 years ago
btw with the new yamlencode function
Julio Tain Sueiras
Julio Tain Sueirasover 7 years ago
that mean for helm provider you can do something like this
Julio Tain Sueiras
Julio Tain Sueirasover 7 years ago

values = [
  yamlencode({
     test = {
        test2 = "hi"
     }
  })
]
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
#office-hours starting now! https://zoom.us/j/684901853

Have a demo of using Codefresh for ETL
Callum Robertson
Callum Robertsonover 7 years ago
Thanks for the invite @Jamie Nelson (BitFlight)
Callum Robertson
Callum Robertsonover 7 years ago
Hey all, this slack group looks fantastic, DevOps & Cloud engineer here from New Zealand. Getting big into the Hasicorp stack and from looking around, this place is a treasure chest of good ideas 😄
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
Welcome @Callum Robertson!
jaydip189
jaydip189over 7 years ago
I'm getting Error https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment: Variables not allowed

on <value for var.security_groups> line 1:
(source code not available)

Variables may not be used here.
Ramesh
Rameshover 7 years ago(edited)
Any experts who did implement cloudposse Terraform module for jenkins in aws
Ramesh
Rameshover 7 years ago
Need help with it !
Stephen Lawrence
Stephen Lawrenceover 7 years ago
Ramesh
Rameshover 7 years ago
Any Terraform aws experts ?
Ramesh
Rameshover 7 years ago
Will pay you guys for cloudpose Jenkins setup
PePe Amengual
PePe Amengualover 7 years ago
simple pull request to allow for custom default target group port : https://github.com/cloudposse/terraform-aws-alb/pull/19
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
@Ramesh are you seeing issues with jenkins? Have you seen the examples here https://github.com/cloudposse/terraform-aws-jenkins/tree/master/examples? (they were 100% tested, but it was some time ago)
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
@PePe Amengual will check the PR, thanks
Meb
Mebover 7 years ago
any one using localstack to test TF here? I mean at least for simple projects as it doesn't have 100% coverage
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
@antonbabenko got your issue on tfstate backend. I am afk, but will address’s when back
vishnu.shukla
vishnu.shuklaover 7 years ago
Hi can someone help me in using connection below is the error
vishnu.shukla
vishnu.shuklaover 7 years ago
Error: Missing required argument

on main.tf line 26, in resource "aws_instance" "example":
26: connection {

The argument "host" is required, but no definition was found.
vishnu.shukla
vishnu.shuklaover 7 years ago
and here is my code
vishnu.shukla
vishnu.shuklaover 7 years ago
provider "aws" {
profile = "default"
region = "us-east-1"
}

resource "aws_key_pair" "mykey" {
key_name = "mykey"
public_key = "${file("${var.PATH_TO_PUBLIC_KEY}")}"
}

resource "aws_instance" "example" {
ami = "ami-2757f631"
instance_type = "t2.micro"
key_name = "${aws_key_pair.mykey.key_name}"

provisioner "file" {
source = "script.sh"
destination = "/tmp/script.sh"
}
provisioner "remote-exec" {
inline = [
"chmod +x /tmp/script.sh",
"sudo /tmp/script.sh"
]
}
connection {
user = "${var.INSTANCE_USERNAME}"
private_key = "${file("${var.PATH_TO_PRIVATE_KEY}")}"
}
}
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
@vishnu.shukla can you test by moving the connection block into the provisioner block?
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago

 provisioner "file" {
   source = "script.sh"
   destination = "/tmp/script.sh"

  connection {
   user = "${var.INSTANCE_USERNAME}"
   private_key = "${file("${var.PATH_TO_PRIVATE_KEY}")}"
   }
 }
 provisioner "remote-exec" {
   inline = [
   "chmod +x /tmp/script.sh",
   "sudo /tmp/script.sh"
   ]

  connection {
   user = "${var.INSTANCE_USERNAME}"
   private_key = "${file("${var.PATH_TO_PRIVATE_KEY}")}"
   }
 }
 }
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
It is meant to be fine to use it in either, but it seems like yours isnt inheriting the host address correctly.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 7 years ago
An alternative is to move the provisioners into a null_resource, and pass in the host address like,
host = "${aws_instance.example.public_ip}"
loren
lorenover 7 years ago
I think this was a tf 0.12 change... It no longer has logic to automatically set the host attribute, you have to pass it in the provisioner now
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
-------
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
Our plan (currently in action) is to continue rolling provider pinning. Please speak up if you have any insights.
tobiaswi
tobiaswiover 7 years ago
Hey everyone, im banging my head against the wall on a certain implementation logic with terraform: network modules to create subnets that consume maps or lists
tobiaswi
tobiaswiover 7 years ago(edited)
lets assume i write a module to create a subnet and all routing and firewall resources that are required to be deployed on each and every subnet in the company
tobiaswi
tobiaswiover 7 years ago(edited)
when i call the module and pass a map(or list) with three cidrs everything is great at the start
tobiaswi
tobiaswiover 7 years ago
but what do you do when later on you want to delete subnet #2
tobiaswi
tobiaswiover 7 years ago(edited)
terraform looks at the indexes when iterating. Element #0 is subnet-#1, Element #1 is subnet-#2 etc.
tobiaswi
tobiaswiover 7 years ago(edited)
when i remove subnet-#2, terraform wants to delete element #1 and #2 = deleting subnets-#2 and #3 and than redeploy the previous subnet-#3 at the position of element#2
tobiaswi
tobiaswiover 7 years ago(edited)
thats an issue because the subnet-#3 didnt change at all, just its index in the list. any ideas how to tackle this?
Callum Robertson
Callum Robertsonover 7 years ago
hey @tobiaswi, not sure if this is over simplifying what you're asking
Callum Robertson
Callum Robertsonover 7 years ago
but have you tried just targeting the resource that you're wanting to destroy?
Callum Robertson
Callum Robertsonover 7 years ago
you can also specify the index used for each subnet if you didn't want it to be dynamic
Callum Robertson
Callum Robertsonover 7 years ago
can you share the code snippet of your config?
loren
lorenover 7 years ago
yeah, terraform doesn't do that well (yet), https://github.com/hashicorp/terraform/issues/14275
loren
lorenover 7 years ago
here's the issue to track for the eventual solution, https://github.com/hashicorp/terraform/issues/17179
Ayo Bami
Ayo Bamiover 7 years ago
HI, Is anyone familiar with this module https://github.com/terraform-aws-modules/terraform-aws-vpc
Ayo Bami
Ayo Bamiover 7 years ago
I am trying to get a VPN created to connect to our environment
Ayo Bami
Ayo Bamiover 7 years ago
I am currently using that module for the VPC setup
Callum Robertson
Callum Robertsonover 7 years ago
Hey Ayo
Callum Robertson
Callum Robertsonover 7 years ago
Callum Robertson
Callum Robertsonover 7 years ago
Gives a great example of using this module in conjunction with what you've got
Callum Robertson
Callum Robertsonover 7 years ago
@Ayo Bami ^
Ayo Bami
Ayo Bamiover 7 years ago
oh nice, I had a quick look at it earlier, I Just didn’t understand.. How does my laptop connect to it
Ayo Bami
Ayo Bamiover 7 years ago
@Callum Robertson Pretty much sure thats all I need I just don’t understand the concept of how to connect to it and how is that IP generated
tobiaswi
tobiaswiover 7 years ago
@Callum Robertson terraform is run in ci/cd so destroy isnt a option. a change has to occur in the variable that defines the input. What do you mean with specific index? got an example for that with count and a module? Sorry cant share, its internal code but its very generic, nothing specially fancy
tobiaswi
tobiaswiover 7 years ago
@loren yes thats exactly my issue. thank you for the issues. i'll be watching these
C
Cloud Posseover 7 years ago
Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7).

This is an opportunity to ask us questions on terraform and get to know others in the community on a more personal level. Next one is Jul 03, 2019 11:30AM.

👉️ Add it to your calendar

:zoom: https://zoom.us/j/684901853

:slack: #office-hours (our channel)
antonbabenko
antonbabenkoover 7 years ago
Bogdan
Bogdanover 7 years ago
@antonbabenko did you know about https://github.com/dtan4/terraforming ?
What’s different in terracognita?
antonbabenko
antonbabenkoover 7 years ago
terracognita scans the whole account, while terraforming creates resources one-by-one. Also, terracognita is very new. Time will show.
David Nolan
David Nolanover 7 years ago
I'd argue that makes terracognita an antipattern. You almost never want a single monolithic terraform configuration for everything.
PePe Amengual
PePe Amengualover 7 years ago
I need help : so I was using
module "terraform_state_backend" {
  source     = "git::<https://github.com/cloudposse/terraform-aws-tfstate-backend.git?ref=tags/0.7.0>"
  name       = "${var.name}"
  namespace  = "${var.namespace}"
  stage      = "${var.stage}"
  attributes = "${var.attributes}"
  region     = "${var.region}"
}
PePe Amengual
PePe Amengualover 7 years ago
created the state all that, added the provider config to my main.tf and then I created another s3 bucket resource BUT with the same name, so now my state is in the same bucket than my ALB logs
PePe Amengual
PePe Amengualover 7 years ago
how can I move this out ?
PePe Amengual
PePe Amengualover 7 years ago
if I change the bucket name for the ALB logs is trying to delete the other bucket but since is not empty it can’t
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
how many resources did you already create? can you just manually delete everything in the AWS console and start with new state?
PePe Amengual
PePe Amengualover 7 years ago
like 5 resources
PePe Amengual
PePe Amengualover 7 years ago
I can’t delete it
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
can’t delete it manually? or not allowed to delete it?
PePe Amengual
PePe Amengualover 7 years ago
you mean the resources ?
PePe Amengual
PePe Amengualover 7 years ago
that where created by terraform ?
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
yes
PePe Amengual
PePe Amengualover 7 years ago
I’m asking if we already gave the static ips to the clients
PePe Amengual
PePe Amengualover 7 years ago
can I just create a new “state bucket” wit the module and copy the content over ?
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
you can, but you will have to give it a different name, which since you are using the module will require giving it diff var.name or adding some attributes to create a unique name
PePe Amengual
PePe Amengualover 7 years ago
yes I was thinking to give it another attribute so the name is different
PePe Amengual
PePe Amengualover 7 years ago
I thought by leaving this
module "terraform_state_backend" {
  source     = "git::<https://github.com/cloudposse/terraform-aws-tfstate-backend.git?ref=tags/0.7.0>"
  name       = "${var.name}"
  namespace  = "${var.namespace}"
  stage      = "${var.stage}"
  attributes = "${var.attributes}"
  region     = "${var.region}"
}
PePe Amengual
PePe Amengualover 7 years ago
inside of my main.tf it will not try to delete the bucket
PePe Amengual
PePe Amengualover 7 years ago(edited)
but then I have this :

module "s3_bucket" {
  source                 = "git::<https://github.com/cloudposse/terraform-aws-s3-log-storage.git?ref=tags/0.4.0>"
  namespace              = "${var.namespace}"
  stage                  = "${var.stage}"
  name                   = "${var.name}"
  delimiter              = "${var.delimiter}"
  attributes             = "${var.attributes}"
  tags                   = "${var.tags}"
  region                 = "${var.region}"
  policy                 = "${data.aws_iam_policy_document.default.json}"
  versioning_enabled     = "true"
  lifecycle_rule_enabled = "false"
  sse_algorithm          = "aws:kms"
}
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
module "terraform_state_backend" {
  source     = "git::<https://github.com/cloudposse/terraform-aws-tfstate-backend.git?ref=tags/0.7.0>"
  name       = "${var.name}"
  namespace  = "${var.namespace}"
  stage      = "${var.stage}"
  attributes = ["${compact(concat(var.attributes, list("2")))}"]
  region     = "${var.region}"
}
PePe Amengual
PePe Amengualover 7 years ago
so let me see if I understand this correctly :
1.- I create a new state bucket with the module
2.- then I copy the state file to the new bucket
3.- Then I manually edit the state file to use the new bucket
4. - cross fingers
PePe Amengual
PePe Amengualover 7 years ago
in reality the only bucket I need to change is the state bucket not the logs bucket
PePe Amengual
PePe Amengualover 7 years ago
but I guess when the state was copied from the local state file to the s3 bucket then it keep the name of the bucket there
PePe Amengual
PePe Amengualover 7 years ago(edited)
somehow I manage to do it
C
Cloud Posseover 7 years ago
:zoom: Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

This is an opportunity to ask us questions on terraform and get to know others in the community on a more personal level. Next one is Jun 26, 2019 11:30AM.

👉️ Register for Webinar

:slack: #office-hours (our channel)
PePe Amengual
PePe Amengualover 7 years ago
How do you guys pass variable values to the modules ?
- On the cli like -var foo=bar
- using terraform.tfvars
- ENV variables
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
for not-secrets, using .tfvars
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
for secrets, ENV vars, which we usually read from SSM using chamber
PePe Amengual
PePe Amengualover 7 years ago
chamber…
PePe Amengual
PePe Amengualover 7 years ago
is that an external tool ?
PePe Amengual
PePe Amengualover 7 years ago(edited)
PePe Amengual
PePe Amengualover 7 years ago
found it
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
Yes
PePe Amengual
PePe Amengualover 7 years ago
I really wish we had consul and Vault
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
chamber is just a tool to access SSM param store
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
Not a full blown secret management system
PePe Amengual
PePe Amengualover 7 years ago
I understand
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
Vault is little bit difficult to setup compared to just using SSM
PePe Amengual
PePe Amengualover 7 years ago
Tell me about it, it took me 2 months to setup a full production cluster
PePe Amengual
PePe Amengualover 7 years ago
but it is a pretty good product
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago(edited)
Mike Nock
Mike Nockover 7 years ago
Hey all! Is anyone familiar with creating a workspace and setting multiple tfe variables through an API call?
I've trying to make the post for the tfe vars, but I can't seem to get multiple attributes in one JSON payload. Tried declaring multiple "attributes" sections, tried putting them in a list [{}], tried declaring multiple data payloads.
When declaring multiple attributes, only the last attribute listed takes. Multiple data payloads fails, and setting the attributes as a list fails, due to invalid JSON body.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
Unfortunately, not that many here running TFE (terraform enterprise)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
@johncblandii is running it though
Mike Nock
Mike Nockover 7 years ago
Fair enough 🙂
Callum Robertson
Callum Robertsonover 7 years ago
hey @PePe Amengual if you're on Mac. @Jamie Nelson (BitFlight) told me about aws-vault, it's been fantastic for me, puts all of your access keys, secrets and session tokens into your ENV vars. There's also a container variation of it if you're looking to use outside your local machine
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
And it also ships with #geodesic 😃
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
@Andriy Knysh (Cloud Posse) is hard at work upgrading our modules to 0.12
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
so far, ~10% are updated (but we're focused on the most popular/most referenced modules)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago(edited)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
we are using the hcl2 label on all 0.12 compatible modules
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
also, in the process of upgrading the modules, we're adding tests to each one. checkout the test/ folder.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
-------------
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
Rackspace has started publishing terraform modules
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
what's wierd is they are not following terraform module naming conventions.
Lee Skillen
Lee Skillenover 7 years ago(edited)
@Andriy Knysh (Cloud Posse) How painful (or hopefully, smooth) has the migration been so far? Our entire infrastructure is still on 0.11, but I'd really like to migrate. 🙂
Lee Skillen
Lee Skillenover 7 years ago(edited)
I'll need to evaluate whether we can (and should) step away from the terragrunt-driven pipeline that we have at the moment too. Sensing future pain.
h3in3k3n
h3in3k3nover 7 years ago(edited)
Good day everyone !

Just curious do we have any CloudFront module which is populated for multiple types of origin ?
https://sourcegraph.com/github.com/cloudposse/terraform-aws-cloudfront-s3-cdn/-/blob/main.tf

example now everything on my side is not always intended to use S3_origin_Config

  origin {
    domain_name = "${aws_s3_bucket.mysite.bucket_regional_domain_name}"
    origin_id   = "${module.mysite_label.id}" #  A unique identifier for the origin (used in routes / caching)

    # s3 should not be configured as website endpoint, else must use custom_origin_config
    s3_origin_config {
      origin_access_identity = "${aws_cloudfront_origin_access_identity.mysite.cloudfront_access_identity_path}"
    }
  }


it might intended to use custom origin also. I have plan to rewrite this module to add few more conditions to make enduser can choose custom origin or s3 origin
suleiman ali
suleiman aliover 7 years ago
Hi everyone 🙂 , First of all i would like to thank everyone behind the Cloudposse terraform modules it literally made my life easier , i have used the EKS and the EKS-Worker modules and i have an issue that i cant figure out, basically both the eks and the eks-workers work fine and the nodes can join the cluster but it never becomes Ready as well as they never get assigned secondary ip's which it did the first time i ran terraform, im not sure if its related to the ami or the initialization of the worker nodes even though i haven't changed anything, how should i proceed ? and what might be the cause? the tags !? im using the terraform-aws-modules/vpc/aws for the VPC and subnets with the complete eks example for the eks cluster and worker nodes
suleiman ali
suleiman aliover 7 years ago
thank you 🙂
nutellinoit
nutellinoitover 7 years ago
@suleiman ali your VPC is tagged with <http://kubernetes.io/cluster/yourclustername|kubernetes.io/cluster/yourclustername> shared?
nutellinoit
nutellinoitover 7 years ago
or perhaps you are trying t3a instances with an older eks worker node AMI
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 7 years ago
@cytopia thanks btw for upstreaming all your fixes to terraform-docs.awk to our cloudposse/build-harness. You saved @Andriy Knysh (Cloud Posse) a bunch of time today when he was updating one of our modules and ran into some of the issues you fixed.
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 7 years ago
yes thanks @cytopia, all your changes worked perfectly
Julio Tain Sueiras
Julio Tain Sueirasover 7 years ago
k, lately didn't have a chance to work on terraform-lsp due to a broken computer, just receive my order for a USB monitor, and it work pretty well, so I should able to continue the terraform lsp for rest of the objectives
Ayo Bami
Ayo Bamiover 7 years ago
HI guys, has anyone being able to configure authorize-client-vpn-ingress using terraform. I can’t find it in the documentation. Thanks in advance 🙂