#terraform-aws-modules (2021-09)

terraform Terraform Modules

Discussions related to https://github.com/terraform-aws-modules Archive: https://archive.sweetops.com/terraform-aws-modules/

2021-09-16

Manuel Morejón avatar
Manuel Morejón

Hi @RB (Ronak) (Cloud Posse)! One question, I’m using terraform-aws-cloudwatch-logs to create a log-group for Opensearch (formerly Elasticsearch) and I get this error:

│ Error: ValidationException: The Resource Access Policy specified for the CloudWatch Logs log group home-dev-es-search does not grant sufficient permissions for Amazon OpenSearch Service to create a log stream. Please check the Resource Access Policy.

this is my tf file

module "home_dev_es_label" {
  source  = "cloudposse/label/null"
  version = "0.25.0"

  namespace = "home"
  stage     = "dev"
  name      = "es"
}

module "cloudwatch_search_log" {
  source  = "cloudposse/cloudwatch-logs/aws"
  version = "0.5.0"

  attributes             = ["search"]
  additional_permissions = ["logs:*"]
  principals             = { "Service" : ["es.amazonaws.com"] }

  context = module.home_dev_es_label.context
}

Could you help me with this error?

2021-09-15

Manuel Morejón avatar
Manuel Morejón
Add permissions_boundary as a variable by mmorejon · Pull Request #23 · cloudposse/terraform-aws-cloudwatch-logs attachment image

what Add permissions_boundary as a parameter Upgrade cloudposse/iam-role/aws module to version 0.13.0 why This parameter is missing in the module as an option. references PR cloudposse/iam-rol…

1
1

2021-09-14

Manuel Morejón avatar
Manuel Morejón

Hi team! Any help needed to merge this PR? https://github.com/cloudposse/terraform-aws-iam-role/pull/30

Add permissions_boundary as a variable by mmorejon · Pull Request #30 · cloudposse/terraform-aws-iam-role attachment image

what Add permissions_boundary as a parameter why This parameter is missing in the module as an option. references iam_role#permissions_boundary Signed-off-by: Manuel Morejon [email protected]

1
1

2021-09-09

caron.wills avatar
caron.wills

Hey folks, wondered if anyone could give me some advice on the aws_backup module, specifically how do I ensure that the resource tags are copied to my recovery tags, this doesn’t seem well documented at all. Any pointers would me most appreciated.

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

You should be provisioning those other resources with the tags

caron.wills avatar
caron.wills

So the resources I’m backing up are provisioned with tags, however the Recovery point tags doesn’t give me details of the resource I’m backing up ?

RB (Ronak) (Cloud Posse) avatar
RB (Ronak) (Cloud Posse)

it might help to look at our aws-backup component that uses the aws-backup module

https://github.com/cloudposse/terraform-aws-components/tree/master/modules/aws-backup

terraform-aws-components/modules/aws-backup at master · cloudposse/terraform-aws-components attachment image

Opinionated, self-contained Terraform root modules that each solve one, specific problem - terraform-aws-components/modules/aws-backup at master · cloudposse/terraform-aws-components

RB (Ronak) (Cloud Posse) avatar
RB (Ronak) (Cloud Posse)

in the readme, you can see the inputs that create a special tag

caron.wills avatar
caron.wills

ah ok let me take a look

caron.wills avatar
caron.wills

@RB (Ronak) (Cloud Posse) hmm not sure this is what I’m looking for, the point is I should be able to set a tag or derive a tag that reflects what I’m backing up ? Can this be done ?

caron.wills avatar
caron.wills

if so how ?

caron.wills avatar
caron.wills

and Ideally in the Recovery point tags

RB (Ronak) (Cloud Posse) avatar
RB (Ronak) (Cloud Posse)

if this is set

        selection_tags:
          - type: "STRINGEQUALS"
            key: "aws-backup/resource_schedule"
            value: "daily-14day-backup"

then you can set a tag on a resource

like aws-backup/resource_schedule = "daily-14day-backup" and aws-backup will manage it

RB (Ronak) (Cloud Posse) avatar
RB (Ronak) (Cloud Posse)
terraform-aws-backup/main.tf at fed541ad66d59bbc0e9707d22d7aaa501df67ede · cloudposse/terraform-aws-backup attachment image

Terraform module to provision AWS Backup, a fully managed backup service that makes it easy to centralize and automate the back up of data across AWS services such as EBS volumes, RDS databases, Dy…

caron.wills avatar
caron.wills

yes indeed thats not the issue, I’m able to back up based on tags, but how do associate the recovery point tags with what I backup especially when the resource is an EC2 instance.

1
RB (Ronak) (Cloud Posse) avatar
RB (Ronak) (Cloud Posse)

are you saying you can and want to tag individual recovery points ?

RB (Ronak) (Cloud Posse) avatar
RB (Ronak) (Cloud Posse)
10:24:48 PM

these are the only resources i can find related to aws_backup

caron.wills avatar
caron.wills

there is an inconsistency about the way AWS names its resources, and as such there is no issue with RDS however there is with EC2 instances and their resource IDs.

1
caron.wills avatar
caron.wills

yes indeed I’m hitting the same brick wall. Perhaps I’m misunderstanding what the recovery point tags are for ?

caron.wills avatar
caron.wills

are you saying you can and want to tag individual recovery points ?

caron.wills avatar
caron.wills

What I want to do is have a tag in that represents what I actually backed up in the case of an EC2 instance.

RB (Ronak) (Cloud Posse) avatar
RB (Ronak) (Cloud Posse)

I’m unsure if that’s possible

caron.wills avatar
caron.wills

I’m beginning to think it isn’t

RB (Ronak) (Cloud Posse) avatar
RB (Ronak) (Cloud Posse)

caron.wills avatar
caron.wills

well at least not for EC2 instances.

caron.wills avatar
caron.wills

Anyone know how the aws backup module works ?

caron.wills avatar
caron.wills

hello anyone ?

2021-09-01

    keyboard_arrow_up