#terraform - December 2019

TIL that terraform support list explode notation( the three dot)

merge(local.list_of_maps...)

amazing stuff

hey,

I currently have to split up a terraform project into multipile ones since the providers needs data from a resource.

Does anyone have an idea on how to share the state / resources?
For example I have azure Database and would like to use the terraform postgres provider.
I would use the data source but the name I generate for the database has a random string attached to it.

Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

This is an opportunity to ask us questions on terraform and get to know others in the community on a more personal level. Next one is Dec 11, 2019 11:30AM.

👉️ Register for Webinar

#office-hours (our channel)

Hi Guys, do we really have to tag VPC, to get a EKS cluster created? does the subnet level tagging will do as well?

 tags = {
    "<http://kubernetes.io/cluster/$|kubernetes.io/cluster/$>{local.cluster_name}" = "shared"
  }

asking this because we dont have permissions to add tags at VPC level but we can at Subnet level, Couldn't find much info hence asking this.

i think when i was playing around with stuff it was working without the vpc tags but i have no idea what piece depends on it and i'd be very hesitant to move forward without it

I agree completely with @Chris Fowles. While spinning my EKS cluster with TF, I forgot to tag my VPC appropriately. It seemed to work fine for the tests I carried out (deploy an API with an external ELB). However I fixed it once I caught it since it is indeed recommended by AWS

Hi all! Quick question about TF - is it possible to check in AWS if private IP address in subnet is taken or not?

I’m writing a TF script to deploy Exasol into AWS - it ties to specific IPs where first is for management node and following are for DB nodes. I’m able to get CIDR of VPC subnet and using cirdhost assign address to network interface - the only thing missing is precaution to check whether this address isn’t already taken in the subnet.

Terraform support for the new AWS EKS Fargate feature.

Ah looks like a provider dev put one in just after me: https://github.com/terraform-providers/terraform-provider-aws/issues/11110

Hello all. Forgive me, but I'm new to terraform as well as CloudPasse. I do have an issue that may or may not be a bug.
I tried to use terraform-aws-cloudfront-s3-cdn, but am geting the error:
Error downloading modules: Error loading modules: module cdn: Error parsing .terraform\modules\8b3cb57814301845ecb9970841a29803\main.tf: At 3:16: Unknown token: 3:16 IDENT var.namespace
Looking at the code I see:
module "origin_label" {
source = "git::https://github.com/cloudposse/terraform-terraform-label.git?ref=tags/0.4.0"
namespace = var.namespace
stage = var.stage
name = var.name
delimiter = var.delimiter
attributes = compact(concat(var.attributes, ["origin"]))
tags = var.tags
}
Shouldn't that be
namespace = ${var.namespace}
??

@Wayne Johnson you’re using TF 0.12 version of the module, but with terraform binary 0.11

Either pin a module to a release for 0.11, or use terraform binary 0.12

Thanks. I'll look into upgrading.

Since terraform-docs doesn't support TF 0.12 yet, how are you guys maintaining your module docs?

Hey! Does anyone have a good example of creating dynamic blocks or content for the aws_security_group_rule resource? I need to create an ingress resource that has quite a few rules.

have you thought of using the largest community module for security groups ?

I have in the past but in this instance I am importing an existing security group. I wasn't sure if this fits the use case.

what about creating a new security group and applying next to the old one

and then drop the old one

I think that's what I am going to have to do. Thanks for the help 👍️😁

Hello there, do you know any aws application load balancer terraform module?

usage example: https://github.com/cloudposse/terraform-aws-ecs-web-app/blob/master/examples/complete/main.tf#L42

Terratest for the example: https://github.com/cloudposse/terraform-aws-ecs-web-app/blob/master/test/src/examples_complete_test.go

@Hugo Lesta ^

THanks @Andriy Knysh (Cloud Posse) 😄

On your terraform modules why do you choose to reference resources that have a count for enable/disable using a join() instead of [0]?

join("", aws_ecr_repository.default.*.name)
aws_ecr_repository.default[0].name

resource "aws_ecr_repository" "default" {
  count = var.enabled ? 1 : 0
  name  = var.use_fullname ? module.label.id : module.label.name

  image_scanning_configuration {
    scan_on_push = var.scan_images_on_push
  }

  tags = module.label.tags
}

resource "aws_ecr_lifecycle_policy" "default" {
  count      = var.enabled ? 1 : 0
  repository = join("", aws_ecr_repository.default.*.name)

More context

join always works regardless of whether the resource list is empty or not

and it worked in TF 0.11 (.0. or [0] did not)

if enabled=false, this will not work aws_ecr_repository.default[0].name

b/c the list is empty

that makes sense. thanks for explaining!

in TF 0.12, the ternary operator could be used: var name = var.enabled ? aws_ecr_repository.default[0].name : “”

which did not work in TF 0.11 b/c it always evaluated both sides

and got errors on getting the name for an item from the empty list

join works in all cases in 0.11 and 0.12

good to know! thanks again

does anyone know how to transfer state from TFE to s3?

@Brij S you would need to add the configuration in terraform for that https://www.terraform.io/docs/backends/types/s3.html

just make sure the bucket is not public and it has versioning enabled

Hello,
I am new to terraform.
Terraform plan don't catch all issue and often they are discovered during the terraform apply .
How do you validate the terraform apply before pushing in production ? is that the purpose of workspace ?

Hi Pierre, that is usualy because of the api

e.g. the most common thing is when you've policies, plan doesn't have a way to validate a policy in aws

yes, I know
but then should I deploy like this ?
create new workspace -> deploy to test -> validate -> delete all resource in the test workspace -> deploy to prod workspace

hmm that's a good question

I think you'll find this tool useful

ha nice I found a kitchen-terraform module , I'll check this

@Nikola Velkovski if I change the backend to s3, wont it try to destroy the current resources and rebuild them?

nope

it will seamlessy migrate to the new backend

so let me get this straight, I simply switch the backend to s3, run tf init/plan/apply etc and it will not try to destroy the already created resources and say no changes necessary?

yup

you'll see on STDOUT, terraform will ask you if you would like to migrate to the new backend and so on.

beer is on me if that's not the case 😄

just joking

Does anyone know if there is a way to group resource variables in the .tfvars file by the uniquely named resource? An example would be where I have 2 AWS RDS resources that share the same variable names, but I want the variable inputs to be unique for each resource. I know that this can be done with a module:
terraform.tfvars file
module_name = {
engine = “postgres”
engine_version = “11.5"
}
However, I would like to do this without having to create a module.

Has anyone used modules to import existing resources?

Can the RDS module be used for creating a cross region replica?

take a look at https://github.com/cloudposse/terraform-aws-rds-replica

it’s for creating cross-region replicas. PR https://github.com/cloudposse/terraform-aws-rds-replica/pull/4/files added possibility to create replicas in the same region as the master

thanks @Andriy Knysh (Cloud Posse)!

is there some naming convention recommended when naming resources ? ( like in some programming language )
should my resource be named az_vnet_internal or azVnetInternal ? what about the object name ?
how would you rewrite the resource below ?

resource "azurerm_virtual_network" "internal" {
  name                = "az_vnet_internal"
  ...
}

Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

This is an opportunity to ask us questions on terraform and get to know others in the community on a more personal level. Next one is Dec 18, 2019 11:30AM.

👉️ Register for Webinar

#office-hours (our channel)

Thanks to @Andriy Knysh (Cloud Posse) we now have support for AWS-managed EKS node pools: https://github.com/cloudposse/terraform-aws-eks-node-group

support for EKS Fargate node pools coming in a few hours 😃

---

anyone have any prior art for a terraform provider that downloads binary dependencies?

e.g. imagine a terraform provider that wrapped a cli tool

that provider would depend on the cli tool in order to function

@Andriy Knysh (Cloud Posse) has just finished implementing support for EKS Fargate node pools!

Do you guys see any problems of adding

lifecycle {
    create_before_destroy = true
  }

to :
https://github.com/cloudposse/terraform-aws-rds-cluster/blob/master/main.tf#L90

any objections if I send a PR?

Hey guys,
Please advise on what is the structure of this value so that I could provide additional S3 bucket policy?
https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn/blob/a05cffd71b6b5ea8d9a881e20c8b41d038dc9167/variables.tf#L66
Whatever I provide it blames on this or that character somewhere. Can’t find example of what it actually expects.

Hi, I have a module that isn’t playing well in 0.12 specifically because it previously referenced private_ip[0] to name an aws_route53_record. I previously used replace() to change the . to -

My question is this… Is there anyway to change a tuple to a string in 0.12? (Interpolation doesn’t seem to do it anymore).

Example below, I get the tuple error for the name, but records is fine.

resource "aws_route53_record" "this" {
  name = "ip-${replace(module.this_mybox.private_ip[0], ".", "-")}"
  type = "A"
  zone_id = "${var.dns_zone_id}"
  records = "${module.this_mybox.private_ip[0]}"
  ttl = "600"
}

Oof, got it resolved. Artburkart got me.

It finally happened... https://github.com/terraform-aws-modules/terraform-aws-eks/issues/635

Hey folks, any guidance on this issue I’m running into with the elasticache-memcached module? https://github.com/cloudposse/terraform-aws-elasticache-memcached/issues/8

Any Terratest users? Tried to find a better channel (maybe #terragrunt would have been better here) - but I'm wondering, how can I manage which Terraform version I would be using for doing the runs...? Tried to read the module's source code also but did not find anything obvious... only TerraformBin variable but I'd guess that does not help crazy much...

I haven’t used Terratest but given these lines of code TerraformBinary and the documentation in their basic terraform example, https://github.com/gruntwork-io/terratest/tree/master/examples/terraform-basic-example “Install Terraform and make sure it’s on your PATH.” that Terratest runs the terraform binary that is in your path.

This is the function that runs the Terraform command https://github.com/gruntwork-io/terratest/blob/9c546f282a74359d7d17697a504268b190bb5e35/modules/terraform/cmd.go#L48-L63

To manage the terraform versions, I would use a tool such as tfenv.

@Joe Presley ok, thanks. I currently plugging our Terratest-orchestrated Terraform tests into GitHub Actions, and I was surprised when I was able to do a Terratest-run with just installing the module-dependencies and running "go test" - no need to install TF in PATH... Hence I starting doubting on what's happening 🙂

@Joe Presley I was also using tfenv before locally, but I found tfswitch more... ux-friendly maybe 🙂

Does the GitHub actions use HashiCorp’s terraform GitHub action? https://www.terraform.io/docs/github-actions/getting-started.html I’ll have to checkout tfswitch.

@Joe Presley I could use those yes... And, I'd need to find a small balance here, as I'd need to pull dependent TF modules from TF Enterprise's Module Registry - meaning, I anyway need to configure ~/.terraformrc somehow...

I might build a fork of the official Terraform Actions which just includes an additional command, "test" (which executes a "make test"... Might be the easiest at the end...

Sent my question to the Terratest team: https://github.com/gruntwork-io/terratest/issues/419 - let's see...

Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

This is an opportunity to ask us questions on terraform and get to know others in the community on a more personal level. Next one is Dec 25, 2019 11:30AM.

👉️ Register for Webinar

#office-hours (our channel)

chatting in general re nodegroups vs separate ASGs per zone for stateful apps/services in eks kube. the convo being more appropriate here. . .

since using TF to manage. I was refactoring to support PVCs and dealing with some very active operators which are running tons of node-shells that I did'nt know use 'nodeSelector' when templatizing the helm chart and applying the manifests.

so also curious how folks are managing stateful apps/services like operators, kafka, etc that set 'nodeSelector', it seems like I need to find a dynamic solution to keeping the 'nodeSelector' s updated as scaling events occur, etc.

btw, I don't know why @Maarten van der Hoef didn't share this yet, but this looks really rad: https://github.com/Flaconi/terraform-aws-bastion-ssm-iam

Bastion server with zero outside ports open 😃

Hi so I’m using this : https://github.com/cloudposse/terraform-aws-rds-cluster/blob/master/main.tf#L163 option to create cluster CNAMES to the cluster endpoint byt my app are not able to resolve the CNAME records, so I’m guessing maybe this is a problem wit the way that aurora cluster endpoint work on route53? If the default cluster endpoints are CNAMEs then my CNAMES will point to a CNAME than then it will point to A record that is the rds instance endpoint so maybe java has an issue with following multiple CNAMES or somesthing?

I never had this problem before but I never pointed CNAMEs to cluster endpoint, I was wondering to maybe switch to custom endpoints

What happens when you dig it?

Does it resolve correctly?

we use CNAMEs with Aurora clusters all the time with no issues

works with any SQL client. Also works with Metabase, which is Java-based

in your app, try to use the cluster endpoint first to check if it’s working

it could be any other issue (e.g. SSL etc.)

Ya maybe trying to use SSL? That won’t work with the CNAME

@channel, need help with below module for ALB.
This module is a combined one which created ALB, target group, listerner, Listener rule, attaching certificate. However, as you may see, we are passing a list of elements to this module which is causing this module to break.

It breaks if I remove any element from the list and but this, all the element post the one removed gets deleted and recreated.

hei guys, I've started recently with terraform-aws-rds(https://github.com/cloudposse/terraform-aws-rds.git?ref=tags/0.9.3)
) and terraform-aws-vpc (https://github.com/cloudposse/terraform-aws-vpc.git?ref=tags/0.7.0)

yet it seems they are completely incompatible.

As soon as I run terraform plan, it gives me errors like the ones below, which require me to go an tweak the generated .terraform modules files, in order for them to work together.

Error: Unsupported block type

  on .terraform/modules/rds_instance/main.tf line 71, in resource "random_string" "default":
  71:   keepers {

Blocks of type "keepers" are not expected here. Did you mean to define
argument "keepers"? If so, use the equals sign to assign it a value.


Error: Incorrect attribute value type

  on .terraform/modules/rds_instance/main.tf line 104, in resource "aws_db_subnet_group" "default":
 104:   subnet_ids = ["${var.subnet_ids}"]

Inappropriate value for attribute "subnet_ids": element 0: string required.


Error: Incorrect attribute value type

  on .terraform/modules/rds_instance/main.tf line 134, in resource "aws_security_group_rule" "ingress_cidr_blocks":
 134:   cidr_blocks       = ["${var.allowed_cidr_blocks}"]

Inappropriate value for attribute "cidr_blocks": element 0: string required.

Any idea if that is norm ? is there some best practices to avoid having such incompatibilities ?

I don't think its ok for me to tweak the generated .terraform modules, just to make those work

looks like you are mixing up TF 0.11 and 0.12. cidr_blocks = ["${var.allowed_cidr_blocks}"] is 0.11 syntax

take a look at the working example here https://github.com/cloudposse/terraform-aws-rds/blob/master/examples/complete/main.tf

Terratest that deploys the example on AWS https://github.com/cloudposse/terraform-aws-rds/blob/master/test/src/examples_complete_test.go

for TF 0.12, use the latest versions of the modules (that’s what the tests usually do)

for TF 0.11, find the prior releases for 0.11 and use all modules for 0.11

https://github.com/cloudposse/terraform-aws-rds?ref=tags/0.9.3 is 0.11 version

I'm using terraform v.0.12.17 locally now. Is there a way to check for each module release if its on Terraform 12 or 11 ?

there is no automatic way to check it

look into examples/complete of each module

they should use the latest TF 0.12 version (or almost latest)

also, look into release, e.g. https://github.com/cloudposse/terraform-aws-rds/releases/tag/0.10.0

it will say “Convert to TF 0.12”. All tags after that are 0.12

sometimes we make new releases for 0.11, but the tag will be smaller than the first 0.12 release, e.g. https://github.com/cloudposse/terraform-aws-rds/releases/tag/0.9.3 is a bug fix release for 0.11 version

alright, thanks a lot, will check now

I'm curious what CloudPosse uses as a rule of thumb for when to have a module call another module vs defining the terraform resource. For instance the aws-ecs-alb-service-task module doesn't reference the aws-iam-role module for creating its roles.
https://github.com/cloudposse/terraform-aws-ecs-alb-service-task/blob/master/main.tf
https://github.com/cloudposse/terraform-aws-iam-role

I think the iam role module was created much, much later.

In our case, we use the IAM role module to provision roles needed by pods in kubernetes

and use it more in a standalone context

So if the ecs-alb-service-task was written from scratch today, it would likely reference the iam-role module?

So in < 0.12, using modules like this could very often lead to "count of ... could not be computed" https://docs.cloudposse.com/troubleshooting/terraform-value-of-count-cannot-be-computed/

post 0.12, we encounter that much less often, so perhaps.

the main reason we have the iam role module is to enforce consistent names

however, if we're just provisioning some roles in another module, we probably wouldn't use this module because we're already using the null label module for that everywhere else

i don't think this is the "rule of thumb" you were looking for though 🙂

another example: https://github.com/cloudposse/terraform-aws-ssm-parameter-store

We wanted to use this module all over the place, but ended up not being able to because of the count-of problems. Thus, we just ended up using the raw resources everywhere.

Thanks Erik. I appreciate it. So I guess you could say the rule of thumb is to reference other modules unless it creates more problems than benefits. 😀

That's a good paraphrasing.

Is there a way to release the lock on terraform file in dynamo db through terraform CLI

have you tried terraform force-unlock ?

Just tried it, thanks - it worked

Just need the lock id

But if you give it the wrong one, it will tell you the existing one

Hello all, In the last 24 hours, all of our terraform-null-label modules started failing, with the following error, anyone have any ideas?

Error: Failed to download module

Could not download module "s3_bizrewards_dev_label" (<http://s3_bizrewards.tf:31|s3_bizrewards.tf:31>)
source code from
"<https://api.github.com/repos/cloudposse/terraform-null-label/tarball/0.16.0//*?archive=tar.gz>":
Error opening a gzip reader for
/var/folders/1d/gpvdrwrd0y1_d0jv64w76j645nyvdq/T/getter001152442/archive: EOF.

Hi everyone,

Could you please check the following issue & let me know what's wrong here.

Error: Missing resource instance key

on terraform-aws-codebuild/main.tf line 144, in data "aws_iam_policy_document" "permissions_cache_bucket":
144: "${aws_s3_bucket.cache_bucket.arn}",

Because aws_s3_bucket.cache_bucket has "count" set, its attributes must be
accessed on specific instances.

For example, to correlate with indices of a referring resource, use:
aws_s3_bucket.cache_bucket[count.index]


Error: Missing resource instance key

on terraform-aws-codebuild/main.tf line 144, in data "aws_iam_policy_document" "permissions_cache_bucket":
144: "${aws_s3_bucket.cache_bucket.arn}",

Because aws_s3_bucket.cache_bucket has "count" set, its attributes must be
accessed on specific instances.

For example, to correlate with indices of a referring resource, use:
aws_s3_bucket.cache_bucket[count.index]


Error: Missing resource instance key

on terraform-aws-codebuild/main.tf line 145, in data "aws_iam_policy_document" "permissions_cache_bucket":
145: "${aws_s3_bucket.cache_bucket.arn}/*",

Because aws_s3_bucket.cache_bucket has "count" set, its attributes must be
accessed on specific instances.

For example, to correlate with indices of a referring resource, use:
aws_s3_bucket.cache_bucket[count.index]


Error: Missing resource instance key

Hi @UFC8P2WJG Thanks for the update! Let me take a look into this, basically I would like to achieve the following things, let me know if you can help me out on this:- My stack is: AWS CodePipeline (github integration) + CodeBuild (lambda deploy) packed in terraform. AWS Lambda + API gateway dev environment and a commit in prod branch goes to AWS Lambda + API gateway prod environment

looks like you are using the old TF 0.11 version of the module which has that issue (and newer version of terraform complains about it, but did not do it before)

take a look at the new 0.12 version (where the issue is fixed) https://github.com/cloudposse/terraform-aws-codebuild

example: https://github.com/cloudposse/terraform-aws-cicd/blob/master/examples/complete/main.tf

Hey there!
The iam_access_key doc (https://www.terraform.io/docs/providers/aws/r/iam_access_key.html#secret) says for the secret attribute:

secret - The secret access key. Note that this will be written to the state file. If you use this, please protect your backend state file judiciously. Alternatively, you may supply a pgp_key instead, which will prevent the secret from being stored in plaintext, at the cost of preventing the use of the secret key in automation.

The If you use this part means if you use the resource as a whole? Or just the attribute? Is there a way how to prevent storing secret in the state file? The terraform apply knows it's a sensitive value:

$ terraform apply 

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # module.elasticprop.aws_iam_access_key.elasticprop_access_key will be created
  + resource "aws_iam_access_key" "elasticprop_access_key" {
      + encrypted_secret  = (known after apply)
      + id                = (known after apply)
      + key_fingerprint   = (known after apply)
      + secret            = (sensitive value)
      + ses_smtp_password = (sensitive value)
...

...using terraform 0.12.18

Hello,
can resources be generated from an interpolated variable ?
or may be i should use templates ?
by example will this work :

resource "azurerm_managed_disk" "Disk${var.ServerName}" {}

Rejoice!!!

Pr merged

finally!!!!

I was just wondering what is the best option for supplying secrets to Terraform. For example, when writing secrets to parameter store.

Options I can see are:
1. Create an input variable and supply via cli, prompt or ENV var
2. Create a gitignored tfvars file and store secrets in there for use in input vars
3. Same as (2) but use git-crypt on the tfvars file and keep the encrypted version in git
4. Manually add to Vault (or some other secure place that Terraform can access - SecretHub?) and retrieve value
I guess the best option will partly depend on how many people are running the Terraform modules.

Interested in what people have found is most practical.
Related GitHub issue: https://github.com/hashicorp/terraform/issues/516

Folks, any comments here pls ?
I have created a security group in account x. But later on updated it with a different privider (account Y); with this updated a security group created in an accountY; but then should the old resource be left in accountX; that’s what I see … is that expected ?

Has anyone been able to create a module for creating a lambda to rotate RDS credentials for Postgres in AWS Secrets manager? There is a CloudFormation template for it but I'm finding it a real pain to replicate it.

@Bruce Have you thought of using aws_cloudformation_stack in terraform. It's maybe not the nicest solution, but it will save you time and you can still deploy it with terraform.

I was trying to avoid that but that may be the solution 😁

Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

This is an opportunity to ask us questions on terraform and get to know others in the community on a more personal level. Next one is Jan 01, 2020 11:30AM.

👉️ Register for Webinar

#office-hours (our channel)

Is “aws organisations” the best way to deal with creating and maintaining users across environments (Dev/Stage/Prod) ?
Wondering what will be the differences of creating user base and role access to different environment in terraform versus using “aws organizations” ?
Will there be any specific advantages of using “organizations” as such ?

Many thanks in advance.

Hi i have just used the eks nodegroup module

Great effort

Btw i spent 2 hours to find out an issue

It seems that there is a bug on aws API if you come from ipv6 ip

I have switched to ip4 and it is fixed

Hi I have just started using terraform. I was reading elasticsearch aws terraform module : https://github.com/cloudposse/terraform-aws-elasticsearch

I did not find any precision about if its includes logstash in the stack or not.

I am trying to build an ELK cluster on AWS 🙂

Hi Guys, is there a way to for loop in templatefale through miltiple lists/tuples?
something like this for example:

%{ for name lastname age in names lastnames ages ~}

echo ${name} ${lastname} ${age}

%{ endfor ~}

Are they the same length?

yes

any recommendations for terraform version manager ?

Hello Guys

Stuck in a aws_launch_template user data issue since a long time.

Trying to deploy this template:

data "template_file" "user-data"{

 template = <<EOF
 echo export DB_CONNECTION="${var.rds_endpoint}" >> /etc/profile
 EOF
}

resource "aws_launch_template" "django-launch-template" {

 image_id        = "${data.aws_ami.django-ami.id}"
 instance_type     = "${var.instance_type}"
 name          = "${var.template_name}"
 key_name        = "${var.key_pair}"

 user_data       = "${base64decode(data.template_file.user-data.rendered)}"
}

Ans this is the error I get:

Error: Error in function call

 on main.tf line 41, in resource "aws_launch_template" "django-launch-template":
 41:  user_data       = "${base64decode(data.template_file.user-data.rendered)}"
  |----------------
  | data.template_file.user-data.rendered is " echo export DB_CONNECTION=\"<http://Test.String.com|Test.String.com>\" >> /etc/profile\n"

Call to function "base64decode" failed: failed to decode base64 data ' echo
export DB_CONNECTION="<http://Test.String.com|Test.String.com>" >> /etc/profile

'=

how would we translate

"${var.var1}${var.var2}"

in terraform 12 ?

when upgrading from terraform 0.11.x to 0.12, what is the best practice to deal with state stored in S3?

It should update without problems

If you don't have versioning turned on (which you should), I would make sure to have a backup

i am not sure if versioning is turned on not, how do you enable versioning ?

Haven't had any problems with the state updating automatically. Update to 0.11.14 first, then 0.12.x