#terraform - June 2020

Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

👉️ Register for Webinar

#office-hours (our channel)

transit_encryption_enabled   = "false"
at_rest_encryption_enabled   = "false"

Error: module.eu-aws-nft-main-redis.aws_elasticache_replication_group.default: "auth_token" must contain from 16 to 128 alphanumeric characters or symbols (excluding @, ", and /)



Error: module.eu-aws-nft-main-redis.aws_elasticache_replication_group.default: "replication_group_id" must contain from 1 to 20 alphanumeric characters or hyphens



Error: module.eu-aws-nft-main-redis.aws_elasticache_replication_group.default: only alphanumeric characters or symbols (excluding @, ", and /) allowed in "auth_token"

* aws_elasticache_replication_group.default: Error creating Elasticache Replication Group: InvalidParameterValue: The AUTH token is only supported when encryption-in-transit is enabled
	status code: 400, request id: ec8aa5fa-f5d6-48cd-b1fa-2dea064cc8e2

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowOrgAccountsReadOnly",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::123412341234:root"
                ]
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::my-artifacts",
                "arn:aws:s3:::my-artifacts/*"
            ]
        }
    ]
}

data.aws_availability_zones.available: Reading... [id=2020-06-04 22:18:37.236953382 +0000 UTC]
data.aws_availability_zones.available: Read complete after 0s [id=2020-06-04 22:18:57.193921254 +0000 UTC]

-detailed-exitcode - Return a detailed exit code when the command exits. When provided, this argument changes the exit codes and their meanings to provide more granular information about what the resulting plan contains:

0 = Succeeded with empty diff (no changes)
1 = Error
2 = Succeeded with non-empty diff (changes present)

data "aws_availability_zones" "available" {
  state = "available"
}

v0.13 beta

provider[\"<http://registry.terraform.io/hashicorp/aws\|registry.terraform.io/hashicorp/aws\>"]

v0.12

provider.aws

Error: Missing required argument

  on main.tf line 64, in module "eks_cluster":
  64: module "eks_cluster" {

The argument "cluster_certificate_authority_data" is required, but no
definition was found.


Error: Missing required argument

  on main.tf line 64, in module "eks_cluster":
  64: module "eks_cluster" {

The argument "cluster_endpoint" is required, but no definition was found.


Error: Missing required argument

  on main.tf line 64, in module "eks_cluster":
  64: module "eks_cluster" {

The argument "cluster_security_group_id" is required, but no definition was
found.

resource aws_.... {
  tags {
    CreationDate = creation_date()
  }
}

Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

👉️ Register for Webinar

#office-hours (our channel)

[for s in var.list : upper(s)]

Error: the server has asked for the client to provide credentials (post configmaps)

  on .terraform/modules/eks.eks/terraform-aws-eks-12.0.0/aws_auth.tf line 62, in resource "kubernetes_config_map" "aws_auth":
  62: resource "kubernetes_config_map" "aws_auth" {

Below are the supported resources 

resource "aws_db_instance" "rds_postgres" {
  identifier                   = "${var.environment}-postgres-database"
  allocated_storage            = "${var.allocated_storage}"
  engine                       = "postgres"
  engine_version               = "${var.db_version}"
  instance_class               = "${var.database_instance_class}"
  multi_az                     = "${var.multi_az}"
  name                         = "${var.database_name}"
  username                     = "${var.database_username}"
  password                     = "${var.database_password}"
  db_subnet_group_name         = "${aws_db_subnet_group.rds_subnet_group.id}"
  vpc_security_group_ids       = ["${aws_security_group.rds_sg.id}"]
  skip_final_snapshot          = true
  backup_retention_period      = 30
  performance_insights_enabled = true
  storage_encrypted            = true

  tags {
    Environment = "${var.environment}"
    Application = "company-api-postgres"
  }
}

resource "aws_db_instance" "rds_postgres_r1" {
  identifier                   = "${var.environment}-postgres-database-r1"
  allocated_storage            = "${var.allocated_storage}"
  engine                       = "postgres"
  engine_version               = "${var.db_version}"
  instance_class               = "${var.database_instance_class}"
  multi_az                     = "${var.multi_az}"
  name                         = "${var.database_name}"
  username                     = "${var.database_username}"
  vpc_security_group_ids       = ["${aws_security_group.rds_sg.id}"]
  replicate_source_db          = "${aws_db_instance.rds_postgres.identifier}"
  skip_final_snapshot          = true
  performance_insights_enabled = true
  storage_encrypted            = true

  tags {
    Environment = "${var.environment}"
    Application = "company-api-postgres"
  }
}

resource "aws_rds_cluster" "default" {
  cluster_identifier            = "${var.environment}-aurora-cluster"
  database_name                 = "${var.database_name}"
  master_username               = "${var.database_username}"
  master_password               = "${var.database_password}"
  backup_retention_period       = 30
  preferred_backup_window       = "03:00-07:00"
  preferred_maintenance_window  = "sat:04:00-wed:04:30"
  skip_final_snapshot           = true
  storage_encrypted             = true
  kms_key_id                    = "${local.db_kms_key}"
  vpc_security_group_ids        = ["${aws_security_group.rds_sg.id}"]
  db_subnet_group_name          = "${aws_db_subnet_group.rds_subnet_group.id}"
  engine                        = "aurora-postgresql"
  engine_version                = "${var.db_version}"
  replication_source_identifier = "${aws_db_instance.rds_postgres.arn}"
  port                          = 5432

  lifecycle {
    ignore_changes = [
      "id",
      "kms_key_id",
      "cluster_identifier"
    ]
  }

  tags {
    Environment = "${var.environment}"
    Application = "company-api-aurora"
  }
}

resource "aws_rds_cluster_instance" "default" {
  identifier                      = "${var.environment}-aurora-r1"
  cluster_identifier              = "${aws_rds_cluster.default.id}"
  instance_class                  = "${var.aurora_instance_class}"
  db_subnet_group_name            = "${aws_db_subnet_group.rds_subnet_group.id}"
  publicly_accessible             = false
  engine                          = "aurora-postgresql"
  engine_version                  = "11.6"
  performance_insights_enabled    = true

  lifecycle {
    ignore_changes = [
      "identifier",
      "cluster_identifier"
    ]
  }

  tags {
    Environment = "${var.environment}"
    Application = "company-api-aurora"
  }
}

map_additional_iam_users = [
    {
    userarn = "arn:aws:iam::xyz:user/myuser"
    username = "myuser"
    groups   =  ["system:masters"]
 }
 ]

$ terraform plan

No changes. Infrastructure is up-to-date.

This means that Terraform did not detect any differences between your
configuration and real physical resources that exist. As a result, no
actions need to be performed.

Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

👉️ Register for Webinar

#office-hours (our channel)

module "public_node" {
  source                      = "git::<https://github.com/cloudposse/terraform-aws-ec2-instance.git?ref=master>"
  ssh_key_pair                = "id_rsa_test"
  vpc_id                      = module.vpc.vpc_id
  security_groups             = [module.vpc.vpc_default_security_group_id]
  subnet                      = module.subnets.public_subnet_ids[0]
  associate_public_ip_address = true
  name                        = "public"
  namespace                   = var.namespace
  stage                       = var.stage
  ebs_volume_count            = 2
  allowed_ports               = [22, 80, 443]
}

module "public_nodes" {
  source                        = "git::<https://github.com/cloudposse/terraform-aws-ec2-instance-group.git?ref=master>"
  namespace                     = var.namespace
  stage                         = var.stage
  name                          = var.name
  region                        = var.region
  ami                           = var.public_ami
  ami_owner                     = var.owner_id
  vpc_id                        = module.vpc.vpc_id
  subnet                        = module.subnets.public_subnet_ids[0]
  security_groups               = [module.vpc.vpc_default_security_group_id]
  assign_eip_address            = "true"
  associate_public_ip_address   = "true"
  instance_count                = var.public_instances_count
  root_volume_type              = var.root_volume_type
  root_volume_size              = var.root_volume_size
  delete_on_termination         = "false"
  ssh_key_pair                  = "id_rsa_test"
}

Error: Error in function call

  on .terraform/modules/public_nodes.ssh_key_pair/main.tf line 30, in resource "aws_key_pair" "imported":
  30:   public_key = file(local.public_key_filename)
    |----------------
    | local.public_key_filename is "/Users/rogierd/Git/platform/terraform/infrastructure/eu-c1-core-test-cluster.pub"

Call to function "file" failed: no file exists at
/Users/rogierd/Git/platform/terraform/infrastructure/eu-c1-core-test-cluster.pub.

  key_name                    = var.ssh_key_pair

  key_name                    = signum(length(var.ssh_key_pair)) == 1 ? var.ssh_key_pair : module.ssh_key_pair.key_name

resource "aws_instance" "openrmf" {
  ami           = var.ami
  ... details ...
  # this provisioner waits for the instance to accept SSH.
  provisioner "remote-exec" {
    inline = [
      "sudo yum install -y python3"
    ]  
  }
  # this provisioner runs the ansible script. however, the eip is not available yet?
  provisioner "local-exec" {
    command = "ansible-playbook --extra-vars \"rmf_admin_password=${var.rmf_admin_password}\" -u ${var.ssh_user} -i '${self.public_ip},' --private-key ${var.pki_private_key} playbook.openrmf.yml"
    environment = {
      ANSIBLE_HOST_KEY_CHECKING = "False"
    }
  }

# here is the eip creation and association.
resource "aws_eip" "openrmf" {
  instance = aws_instance.openrmf.id
  vpc      = true
  tags = {
    Name = "openrmf"
  }
}

variable restrict_to_az {
  type        = list
  description = "Optional list of Availability Zone IDs (not names) to restrict the deployment to."
  default     = []
}

locals {
  subnet_az = length(var.restrict_to_az) > 0 ? var.restrict_to_az : []
}

data aws_subnet_ids public {
  vpc_id = var.vpc_id
  tags   = {
    Visibility = "public"
  }

  # Optionally filter the subnets we deploy to by a list of availability zone IDs
  dynamic "filter" {
    for_each = local.subnet_az

    name     = "availabilityZoneId"
    values   = [filter.value]
  }
}

Error: Unsupported argument

on .terraform/modules/…/subnets.tf line 31, in data “aws_subnet_ids” “public”:

31: name = “availabilityZoneId”

An argument named “name” is not expected here.

Error: Unsupported argument

on .terraform/modules/…/subnets.tf line 32, in data “aws_subnet_ids” “public”:

32: values = [filter.value]

An argument named “values” is not expected here.

content {}

Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

👉️ Register for Webinar

#office-hours (our channel)

aws iam list-roles --path-prefix /aws-service-role/ecs.amazonaws.com/

inputs = {
  foo = path.cwd()
}

variable "tag_name" {
  default = "centos-${formatdate("YYYYMMDDhhmmss", timestamp())}"
}

tags = { Name = "centos-${formatdate("YYYYMMDDhhmmss", timestamp())}" }

resource "random_password" "centos_user_password" {
  length = 16
  special = true
  override_special = "_%@"
}

data "template_file" "tf_ansible_vars_file" {
    template = "${file("./tr_ansible_vars_file.yml.tpl")}"
    vars = {
        centos_password = random_password.centos_user_password.result
    }
}

The given value is not suitable for child module variable "event_selector"
defined at ../modules/terraform-aws-cloudtrail/variables.tf:90,1-26: list of
object required.

event_selector = {
    read_write_type = "All"
    include_management_events = true
    data_resource = {
      type   = "AWS::S3::Object"
      values = ["arn:aws:s3:::"]
    }
  }

Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

👉️ Register for Webinar

#office-hours (our channel)

Morning! I'm using this module: https://github.com/cloudposse/terraform-aws-ec2-autoscale-group and it's working great except I'm trying to figure out how to lifecycle ignore latest_version because it increases every time I do a terraform apply  and I'd like to prevent doing an update in-place on every run.

Anyone know how to get around this?