#terraform (2018-09)

So I’ve got a weird problem that I’ve never encountered before I have a module that creates a vpc does the usual stuff. public/private subnets, nat gateways etc I then use the data returned from this module with an ec2 module which puts x instances in those subnets/availability zones and evenly spreads them

In this situation I’m creating 4 instances. the first 2 get created fine the 3rd it attempts to create in the correct AZ but the wrong subnet specifically a subnet that terraform hasn’t created or management it’s actually one of the subnets in the default vpc and then the 4th node also fails because it has the correct AZ but is instead using the subnet that the 3rd should which is in a different AZ

I’ve checked the state and the subnet from the default vpc doesn’t show up in there at all

@Andrew Jeffree this is one of the big reasons we have our purpose built modules

are you using our subnet modules and our vpc module?

(basically, it’s easy to mess things up)

No I’m using mine. I wasn’t after you to support these, but I was hoping someone may have encountered this weirdness in the past on the Terraform side.

and I’ve used these modules for quite a while without this problem

are you using any data providers?

nope

just passing the output from one module to another

are you extracting values from maps?

(may lead to different orders)

maybe the order of the subnets and the order of the azs is different

yeah so I considered the ordering issue

ok

but that doesn’t explain where the default vpc subnet is coming into things

that’s the part that’s doing my head in.

I’m aware you can manage the default vpc somewhat in terraform, but I don’t do that. I just leave it be and ignore it.

yea, we never use it

ah I found my bug. It’s a conditional that someone else added to the module.

phew! that’s a relief

by default in our module we put instances in private subnets, but someone wanted to put them in public subnets, so they create a variable and they were merging an empty list with the list of private subnet ids

which means the 3rd item in the list when computed was blank which means AWS tries to put it in the default vpc.

good sleuthing! makes sense

ah also thank you for acting as a sounding board @Erik Osterman (Cloud Posse) much appreciated.

np, sometimes that’s all it takes

Hi Gang,

I’ve just started using your vpc_peering terraform module and have run into an issue during the plan stage. I’m getting

* module.vpc_peering.data.aws_route_table.requestor: data.aws_route_table.requestor: value of 'count' cannot be computed

I checked out the FAQ at https://github.com/cloudposse/docs/blob/master/content/faq/terraform-value-of-count-cannot-be-computed.md and it doesn’t seem to be the same issue.

I am getting it during the plan stage when the requestor_vpc_id is coming from the output of a vpc module, however that vpc hasn’t yet been created and the id is going to be computed at this stage.

Something you’ve seen before and if so is this a supported scenario?

"${var.mc_vpc_id}" is a hard coded id of an existing vpc in the same account.

@Toby The way terraform-aws-vpc-peering currently works is to lookup both requestor and acceptor VPCs and subnets (was implemented that way to use with kops for Kubernetes, e.g. https://github.com/cloudposse/terraform-aws-kops-vpc-peering).

So when you create a VPC in the same project as terraform-aws-vpc-peering, Terraform does not wait for the VPC to be created and tries to look it up from the data sources - that’s why it can’t calculate the count of aws_route_table because it depends on the number of subnets, which in turn depens on the VPC.

This currently can be solved (w/o redesigning the module or creating a new one, which could be done) in two diff ways:

1. Place VPC in a separate folder from ``terraform-aws-vpc-peering` and provision it first

2. Use multi-stage provisioning with -target (that’s how we did it for the module)

terraform plan -target=module.vpc
terraform apply -target=module.vpc

terraform plan
terraform apply

The first plan/apply provisions just the VPC. The second plan/apply provisions evrything else (since the VPC is already provisioned, TF is able to look it up).

Thanks for your prompt reply @Andriy Knysh (Cloud Posse), I was using the -target as a workaround so I’ll carry on doing that

yea, it’s the solution for now

we might add another module to accept the existing VPC IDs (or modify the current one)

thanks for testing btw

Has anyone ever scripted out RDS Cross-region replication using Terraform?

@Matthew that’s what it says about cross-region replication

with Aurora MySQL you can setup a cross-region Aurora Replica from the RDS console. The cross-region replication is based on single threaded MySQL binlog replication and the replication lag will be influenced by the change/apply rate and delays in network communication between the specific regions selected. Aurora PostgreSQL does not currently support cross-region replicas

we did not test it with TF

I don’t even see how it could be done here https://www.terraform.io/docs/providers/aws/r/rds_cluster_instance.html

@Andriy Knysh (Cloud Posse) there is a way to do cross region replication

@Daren does this at gladly with terraform

nice

Thank you @Andriy Knysh (Cloud Posse) that is what i’m trying to do currently and here it has https://www.terraform.io/docs/providers/aws/r/rds_cluster.html#replication_source_identifier

but when you actually specify the DB Arn and try to run the script terraform spits out “ You cannot set up replication between a DB instance and a DB cluster across regions.”

do you use MySQL?

Yes Aurora-MySQL

@Erik Osterman (Cloud Posse) or @Andriy Knysh (Cloud Posse) do we have any terraform module for setting up required vpc endpoints, this is useful in escaping some data transfer charges, as explained here https://aws.amazon.com/vpc/pricing/

@rohit.verma you mean this https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints.html?

we don’t have modules for that, but it looks like simple enough https://www.terraform.io/docs/providers/aws/r/vpc_endpoint.html

(we can create module(s) together

@Matthew we talked with @Daren, we’ll show you how to do cross region replication for MySQL (@Daren has a working example)

@Andriy Knysh (Cloud Posse) Appreciate your energy and time looking into that for me

I am open for discussion whenever i’m still currently trying it this moment

Ahh so now when i specify the cluster ARN in replication_source_identifier, it creates the cluster as a replica, but then my instance gets deployed as a WRITER rather than a Reader. Holler when you’re free

@Matthew when @Daren is online, we’ll give you the example

@Andriy Knysh (Cloud Posse) / @Erik Osterman (Cloud Posse) Thanks for response, I will try to create one module which is in sync with with geodesic. I believe mostly Gateway type endpoints are worth using, If I am right there is no cost for them. Also Bit confused about com.amazonaws.ap-south-1.logs endpoint. Since we are using fluentd-cloudwatch log forwarding, will it provide us some cost benefit ?

did you test the latest version? @h20melonman

this example for example https://github.com/cloudposse/terraform-aws-rds-cluster/blob/master/examples/basic/main.tf

was working ok

@Andriy Knysh (Cloud Posse) i did, however it errored. I build some db’s in may and i didn’t lock down to a version and the new version breaks with this error “* module.rds_cluster_aurora_mysql.output.arn: Resource ‘aws_rds_cluster.default’ does not have attribute ‘arn’ for variable ‘aws_rds_cluster.default.*.arn’ “

@rohit.verma I think it will provide a cost benefit since the traffic never exits the AWS internal networks

@h20melonman can you delete and re-create the cluster?

and pin down to a release

so then i thought , well i’ll go back to what i used before and encountered another issue. where if i build something or run plan against something already built it seems to add / remove availability_zones on it’s own. even though i’ve defined only the two i want

what is the suggested way to pin a release ?

so yea, a lot was changed in the module since May

we added the required number of AZs

ah , thats prob why its thrashing around on me : )

maybe yes

try to set the number to the same number of AZs you currently have deployed

ok

what about version pinning , is that ^^ ok

thanks btw !

@Andriy Knysh (Cloud Posse)

ah, sorry, forget about the number of AZs, it’s from a diff module

version pinning, not OK

here’s how to do it:

kk

great.

i’ll give that a shot. thanks for being avail !

remove version = "0.3.5"

got it

add ` cluster_family = “aurora-mysql5.7”`

https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBClusterParameterGroup.html

ok

https://github.com/cloudposse/terraform-aws-rds-cluster/blob/master/examples/with_cluster_parameters/main.tf

@Andriy Knysh (Cloud Posse) I’ve updated to exactly whats in ‘with_cluster_parameters/main.tf’ & outputs.tf , but am getting this error “* module.rds_cluster_aurora_mysql.output.arn: Resource ‘aws_rds_cluster.default’ does not have attribute ‘arn’ for variable ‘aws_rds_cluster.default.*.arn’ “

any ideas? and apoligies if these are basic questions. i truly appreciate your help !

sounds like you are still using some old version of the module (which did not have the arn output)

did you use source = "git::<https://github.com/cloudposse/terraform-aws-rds-cluster.git?ref=tags/0.4.3>"?

and also terraform init

did both. and i had deleted the db i was working on and removed the old state file from s3.

did you do terraform destroy first?

if is switch to 0.4.0 and comment out of the outputs.tf ( used from examples w/c/p ) arn,endpoint,reader_endpoint everything seems fine. and yes i did a terrafrom destroy before starting any of this

well, you can direct message me your code; I can’t answer the question because we did provision the cluster many times in the last few days using the examples from the repo

sure thing.

@Matthew thanks to @Daren, here is a working example for RDS cross-region replication

thanks @Daren

and how to call it

provider "aws" {
  alias  = "remote"
  region = "us-west-2"
}

module "database_remote_replica" {
  source = "..."

  providers = {
    aws = "aws.remote"
  }

  namespace            = "eg"
  stage                = "prod"
  instance_class       = "..."
  source_db_identifier = "<ARN>"
}

this is not for Aurora though, just for RDS

regarding this:

but when you actually specify the DB Arn and try to run the script terraform spits out ” You cannot set up replication between a DB instance and a DB cluster across regions.”

I think it says that you need to create a remote cluster (not just an instance)

so you need to create two clusters in two diff regions

and use the provider pattern above to provision the remote cluster for replication

https://github.com/cloudposse/terraform-aws-cloudtrail-cloudwatch-alarms/pull/7

https://github.com/Mastercard/terraform-provider-restapi

or this one - https://github.com/dikhan/terraform-provider-openapi . They are rather similar in terms of making things for general APIs.

The most photogenic developer vs the company with the priceless slogan, tough one

https://github.com/GoogleCloudPlatform/magic-modules - pretty cool project and reasoning.

https://github.com/GoogleCloudPlatform/magic-modules/blob/master/templates/terraform/resource.erb - so easy to read!

yea, that’s how all code should look like

and then we introduce patterns on top of it

I think there will be some standard for auto-generated code platforms, so that once AWS adopts it we suddenly will not have 1700+ open issues in AWS provider.

1700!? Wow.

no, 1672 actually

Is there a way to use packer

in terraform

i want to create a windows box with some windows roles installed on it

You can either use https://www.terraform.io/docs/providers/null/resource.html or https://www.terraform.io/docs/providers/external/data_source.html to call your packer script

thank you! ill take a look

@jamie has a module that runs packer with lambda

What if it takes more than 5 minutes to run? How does module handles that?

hi there, I’m trying to use cloudposse/terraform-aws-ecr, but I’m getting a ton of error during the plan:

with this TF script

the provider is because I’m trying to set up the ECR in a different account, but the problem also occurs in the same account

I’m using terraform 0.11.8, I noticed that your CI is using TF 0.10.7, could it be the problem?

it seems like aws_iam_role.default fails to be generated automatically if I don’t specify roles

@sylvain.rouquette can you open a GitHub issue for this?

We are actively using this module with 0.11.

Here is our invocation https://github.com/cloudposse/terraform-root-modules/tree/master/aws/ecr

If you haven’t already, be sure to pin down your AWS provider! https://www.terraform.io/docs/providers/aws/guides/version-2-upgrade.html#provider-version-configuration

@Erik Osterman (Cloud Posse) ok I’ll open a bug. Your usage is a bit different though. You use it through terraform-aws-kops-ecr, roles are already created (but even in my case with created roles, it wouldn’t work)

@sylvain.rouquette thanks, we’ll take a look

https://chrislewisdev.github.io/prettyplan/

similar idea: https://github.com/coinbase/terraform-landscape

I like landscape because it diffs the json as well

instead of having to decipher how two big json blobs are different

yep, exactly

anyone know how to pass a terraform variable into packer

such as instance type

Pretty sweet

hey there, i’m having an issue with the Cloud Posse Elastic Beanstalk template. i’m working off this example https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment/blob/master/examples/complete/main.tf

the generated plan has an empty Environment tag:

  solution_stack_name:          "" => "64bit Amazon Linux 2018.03 v2.8.1 running PHP 7.2"
  tags.%:                       "" => "4"
  tags.Environment:             "" => ""

this is resulting in an error on apply:

* module.elastic_beanstalk_environment.aws_elastic_beanstalk_environment.default: 1 error(s) occurred:

* aws_elastic_beanstalk_environment.default: InvalidParameter: 1 validation error(s) found.
- minimum field size of 1, CreateEnvironmentInput.Tags[0].Value.

hi @camurphy, can you show your code how you invoke the module - the example above was tested 13 days ago and was working as it is

do you have keypair = "123" provisioned in AWS?

it will fail if you provide a wrong key name

if you don’t want it, leave it as empty string

oh correct keypair is provisioned, just changed the value for the purpose of sharing

sounds like you might be passing a tag with an empty value

i hadn’t removed anything from your example, perhaps i need to add something?

Can you try setting TF_LOG=DEBUG

then rerun

https://www.terraform.io/docs/internals/debugging.html

maybe some more useful output

i reverted to exactly your example with the exception of changing the region to ap-southeast-2 and adding a profile under the aws provider

I’ll check

thanks guys

@Andriy Knysh (Cloud Posse) any clue?

Environment is empty

no clue where that’s getting injected

Out of curiousity, what happens if you pass

tags = {
  "Environment" = "example"
}

yea, that’s from terraform-null-label

latest changes

Ah crap

we’ll fix that

no good deed goes unpunished

(got the same error)

yep, adding that tags block fixes it

thanks for reporting the issue

no worries, thanks for the templates

we’ll get that fixed. glad there’s an easy workaround for now.

i had one more question about this module @Erik Osterman (Cloud Posse), is there a way to use it without creating a route 53 hosted zone? happy to use the elasticbeanstalk.com domain for staging. the readme says zone_id is not required but when omitted i get module.elastic_beanstalk_environment.module.tld.aws_route53_record.default: zone_id must not be empty

We’ll fix that too :)

anyone know of a way to join a windows AWS instance to the domain using terraform?

I think that is more on the scope of Ansible or some other provisioner

i found this… hoping to try to understand it and have it work

https://aws.amazon.com/blogs/security/how-to-configure-your-ec2-instances-to-automatically-join-a-microsoft-active-directory-domain/

@pericdaniel that should work

also, here is a complete solution in TF http://www.sanjeevnandam.com/blog/aws-microsoft-ad-setup-with-terraform

i think i got it

testing it rightn ow

oooooooooooooooo

let me look

thank you!

@camurphy https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment/pull/48 fixes both issues (empty tags and default DNS zone)

thanks @Andriy Knysh (Cloud Posse)!

Hi

@eric_garza i wanted to ask you to open an issue for that, but I see we already have it

https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn/issues/23

we’ll add it

ah, thanks

or you can open a PR for that

Not sure what that is yet

How long until you guys add that, I could just clone this and add for my local use.

so if you know how to add it for your local use, then you know how to implement it

I do!

i mean after you implement it and test, open a PR against our repo and we’ll review and merge it

Sorry, I have not ever contributed to github projects before.

ahh ok

got it

seemed the other person in issue added the PR, would that not cover this?

so you can fork the repo, create a new branch, make the changes (and test), then open a PR against our repo

gotcha

how about the outstanding PR?

he did not do it

ahh, well , I will, bear with me

i like your modules btw, good work

thanks

let us know if you need help with the PR

I submitted the new input param change in PR, think I did it right, but not under the original. Tested locally, works.

thanks @eric_garza

anyone happen to know if terraform 0.12 will interpolate variables and variable files? i would find it very handy to be able to use data sources and pass data source values through a variable…

looks like sortof but not really for the use case i’d want, https://github.com/gruntwork-io/terragrunt/issues/466#issuecomment-385034334

not sure about interpolation in vars, but it says you’d be able to pass resources and modules as inputs and outputs https://www.hashicorp.com/blog/terraform-0-12-rich-value-types

tks, had forgotten about that one. need to noodle it some to understand whether it really gets me there

perhaps a bit of a n00b question but how does one ensure that the terraform_state_backend module is able to run before the terraform block where the bucket and dynamo db tables are referenced? https://github.com/cloudposse/terraform-aws-tfstate-backend

most terraform directory structures i see have a [variables.tf](http://variables.tf), [main.tf](http://main.tf) and [outputs.tf](http://outputs.tf) but perhaps i need a different structure to execute the plan for the creation of the backend … then a separate plan for the rest of the stack that consumes that backend? thanks in advance

@camurphy I believe you are asking a slightly different question: how do we provision terraform-aws-tfstate-backend to store state before we have an S3 backend to store state for terraform-aws-tfstate-backend?

here is how …

i guess i’m asking if terraform-aws-tfstate-backend has to be part of a plan in a separate directory/project to this block:

terraform {
  required_version = ">= 0.11.3"
  
  backend "s3" {
    region         = "us-east-1"
    bucket         = "< the name of the S3 bucket >"
    key            = "terraform.tfstate"
    dynamodb_table = "< the name of the DynamoDB table >"
    encrypt        = true
  }
}

tis is how we use it https://github.com/cloudposse/terraform-root-modules/tree/master/aws/tfstate-backend

but to answer your question - yes we do it in separate project folder

https://github.com/cloudposse/terraform-root-modules/tree/master/aws

ah a bootstrap process, makes sense

thanks guys, sorry should have RFTM

it’s coldstart problem….

take a look at the docs as well https://docs.cloudposse.com/reference-architectures/cold-start/ https://docs.cloudposse.com/reference-architectures/cold-start/#provision-tfstate-backend-project-for-root

Just released our ec2 auto scale module

https://github.com/cloudposse/terraform-aws-ec2-autoscale-group

This will be used for our upcoming EKS modules

(Thanks @Andriy Knysh (Cloud Posse) !)

@Andriy Knysh (Cloud Posse) What do you think of using aws_cloudformation_stack for the AutoScalingGroup creation to have AutoScalingRollingUpdate ?

@maarten yea TF does not support it because AWS API does not support it. Using CloudFormation for that sounds like a good idea

https://medium.com/@endofcake/using-terraform-for-zero-downtime-updates-of-an-auto-scaling-group-in-aws-60faca582664

we used aws_cloudformation_stack in a few modules

https://github.com/cloudposse/terraform-aws-efs-backup/blob/master/cloudformation.tf

i’ve had a lot of trouble with the cfn AutoScalingRollingUpdate feature, and failure modes that cause rollbacks resulting in unexpected states… these days i tend to prefer AutoScalingReplacingUpdate, which is more of a blue/green option. just seems that any failure/rollback is much more reliable this way.

@loren Ah good to know! Have you used cloudformation with create conditions? And if so, do you know how I can conditionally output, something from it. How to use Splat syntax with it is unclear to me so far.

yeah, conditional outputs are pretty straightforward in cfn…

"Outputs": {
  "OutputName": {
    "Condition": //ConditionName,
    // Normal Output Arguments
  }
}

no i mean, something else

oh

Given you have

  resource "aws_cloudformation_stack" "autoscaling_group" {
   count = ".... create t/f
.......
    "Outputs": {
      "AsgName": {
        "Description": "The name of the auto scaling group",
         "Value": {"Ref": "${local.name}"}
      }
    }
  }
  EOF
  }

and you conditionally create this stack, how to conditionally reference the output of it

oh oh oh, conditional outputs on the tf side lolol

one sec

ok, so i don’t have an example where we’re conditionally creating the stack, which is the complicating factor

let’s try this

hehe

if you have this output and no count in the resource:

then with count might look like this:

output “datapipeline_ids2” { value = “${lookup(element(concat(aws_cloudformation_stack.datapipeline.*.outputs, list(map(“DataPipelineId”, “”))), 0), “DataPipelineId”, “”)}” description = “Datapipeline ids” }

getting a value where the output is conditional is easy, otherwise… value = "${lookup(aws_cloudformation_stack.<resource_name>.outputs, "OutputName", "")}"

(not tested )

wow, joining with a map with the key but empty value

hm, doesn’t work

lookup gets a string it says.. unsure why

ok ok I said not tested

i want my money back

let me check

Hi @loren I have a question about AutoScalingReplacingUpdate vs AutoScalingRollingUpdate, at what times did a rollback take place ? And would AutoScalingReplacingUpdate be something that would work for infrastructure that runs many containers ? AutoScalingRollingUpdate would allow a one by one draining and moving of the containers to the new infrastructure.

Honestly, I just got fed up with failures when using AutoScalingRollingUpdate resulting in an failed rollback, or some other condition where the resulting instances were not actually exactly the way they were before the update

Switched to AutoScalingReplacingUpdate and everything started working exactly the way I wanted

rolling updates are subject to the min/max values of your ASG. if you’re already at the max, then an instance will be terminated before launching a new one based on the new LaunchConfig. if the new instance fails, the rollback action is triggered. That’s where it gets tricky, because the instance was terminated, so now new instances must be launched. Depending on what all’s changed in the template and its dependencies, that new launch of the old launch config may also fail

With AutoScalingReplacingUpdate, a whole new ASG is created, with its own min/max values. No instances are terminated. If any resource signal fails, the new ASG is simply deleted

Only if all resource signals are received/successful is the original ASG deleted, at which point it is subject to draining policies and whatnot

@loren nice points

@maarten this worked (for me )

you might be better off with containers and rolling updates, since they ought to be more immutable and less subject to the issues i kept running into

Have you guys worked with clients that actually want API Gateway + Lambda (aka. serverless.com)?

@rms1000watt we use Lambda for some small tasks (e.g. IAM backup, S3 events, etc.), but I think not for deploying a microservice

I guess the issue with that is that you have to start developing with lambda in completely different mindset, but they usually use the standard stuff like Python, Ruby, Java, etc., which is better suited for EC2/ECS/Kubernetes deployments

not easy to break it into pieces for Lambda, and Lambda also has a lot of limitations (starting with a simple one: how to you connect and test all of that locally)

@Andriy Knysh (Cloud Posse) From what I’ve seen with my friends at Lantern (@justin.dynamicd) I think they just have dev accounts for integration tests. Then they rely on unit tests before things get deployed.

Honestly, it’s because I devoted a lot of time to this project and just kind of curious what adoption could look like: https://github.com/rms1000watt/serverless-tf And if I should rewrite it when 0.12 is released

@justin.dynamicd has joined the channel

@rms1000watt https://github.com/rms1000watt/serverless-tf looks very interesting, thanks for sharing

and yea, please rewrite in 0.12 so we all see a real example (somebody needs to be first )

Haha, yeah, the rewrite would be so it could mirror serverless.com serverless.yml as much as possible

interesting idea with generating TF files

Had to do it that way since TF was so strict.. I have to allot all potential lambda slots

like, currently, it has a limit of 10 lambda functions

but it can be regenerated to support X

is there yet a library that reliably writes hcl? or would you just write json (and rely on 0.12’s improved json roundtrip support)?

hmm, not sure off the top of my head. With 0.12 I don’t really want to rely on any libraries or json stuff. I’d prefer to just maintain it as HCL but with nested objects in arrays in objects in arrays, lolol–however serverless.yml does it already

then maaaaaaybe write a tool to convert serverless.yml to this module definition. But that would be an entirely different repo/thing.. just separation of concerns

shrugs

i think converting serverless.yml could be pretty tough, they are very linked to cloudformation

as @rms1000watt mentioned, write everything in Go, problem solved

https://sweetops.slack.com/archives/CB3579ZM3/p1536909968000100

@loren just depends how close the HCL spec matches the serverless.yml

functions:
  index:
    handler: handler.hello
    events:
      - http: GET hello

No clue yet until I start jumping in.. or if anyone even wants it.. haha

yeah, the most basic serverless.yml stuff would be easy, but it gets more complicated pretty quick. such as native CFN in the resources section

and references specific to cfn resource names in the serverless generated template

plus the whole plugin system

hehe yeah, serverless has done a good job with all it’s features and functionality

I mean, some stuff would just be “do it proper in terraform, then reference the role arn in the module input”

not knocking the work so far, i’m pretty excited by a terraform-native project for making serverless-like stuff easier

No worries! Yeah, it’s been fun so far

yea, excited to see someone making serverless easier in terraform

we haven’t done too much serverless at cloudposse. we have a few little helpers here and there.

does the file argument also support directories? or is it assumed that a function is a single file module? or is file just pointing to the file with the handler, and the whole directory with that file is packaged?

file supports modules, and should zip up the entire directory.

gotcha tks

I didn’t write this, but I think I know how Ryan did it

@rms1000watt correct me if wrong

Since this is the source file, if you give it a dir, it’ll zip up the entire dir, and pass the zip file back to the lambda func to create it from the zip.

yea, that’s how we do it here https://github.com/cloudposse/terraform-aws-ses-lambda-forwarder/

Yeah that’s how I do it as well

If Ryan didn’t do it that way FOR SHAMMEEE and should fix.

yeah, was poking around to trace it out, but i do see archive_file takes both source_file and source_dir… https://www.terraform.io/docs/providers/archive/d/archive_file.html#argument-reference

source_file works on directories though?

Ah yea, but if you do the archive file bit

You want the archive bit to ensure it catches hashed changes.

so it takes a dir, zips it up, and get’s a hash of it it persists to state, for later comparison

This picks up code changes and updates lambda

So as it relates to our modules, I don’t like that the zip creation is done by the user. More advanced lambdas will require deps. For example, the SES module uses npm. Having npm installed shouldn’t be a requirement. Thus, here’s how I’m proposing we change it for our ses module: https://github.com/cloudposse/terraform-aws-ses-lambda-forwarder/issues/2

heh, and i’m ok with requiring that our users have npm… i like the vendor_cmd approach that Ryan took… the user specifies the command, they kinda ought to know that they’ll actually need that command

i’d wrap the execution in a script or make target anyway, and test/install whatever command was actually needed

Random thought, would it be possible to use codebuild inside the module, and use it’s artifact in the same cycle ?

@loren the problem is also ensuring that different users have the same versions of dependencies. also, for example, sometimes building deps locally (e.g. on a mac) will lead to binary artifacts which are CPU architecture specific. safer to build in a uniform environment.

lololololol sorry, was on a call

@loren it handles relative paths: https://github.com/rms1000watt/serverless-tf/blob/master/local.tf#L40

some examples use relatives paths

https://github.com/rms1000watt/serverless-tf/blob/master/examples/http-authorizer-go/main.tf

@maarten you question was about if we can build an artifact with CodeBuild and then use it in other TF resources?

it says you can store the build artifact in an S3 bucket https://www.terraform.io/docs/providers/aws/r/codebuild_project.html#location

and then use this to read it https://www.terraform.io/docs/providers/aws/d/s3_bucket_object.html

@Andriy Knysh (Cloud Posse) yeah but related to lambda deployments. So instead of npm locally, using codebuild to create the actual artifact, which after is used again by the module to deploy to aws lambda.

was more a hypothetical question..

https://github.com/rms1000watt/notejam/blob/master/buildspec.yml https://github.com/rms1000watt/notejam/blob/master/testspec.yml

You can define whatever steps you need in the *.yml that’s used in the CodeBuild + CodePipeline

i have a codepipeline thats Source > Codebuild (build) > Deploy (ecs) > Codebuild (Integration test)

so it could be like Source > Codebuild (compile?) > Codebuild (deploy to lambda?) > Codebuild (integration test)

https://github.com/rms1000watt/terraform-aws-codepipeline-ecs inspired by https://github.com/cloudposse/terraform-aws-ecs-codepipeline

yea you can run any commands in buildpec.yml

https://github.com/cloudposse/jenkins/blob/master/buildspec.yml

hello everyone

hey @Ryan Ryke

actually if you guys have a second… ive been playing with the ecs-web-app module… looks like its needs listener arns, i used the aws-alb module to build the alb, then took the outputs listener_arns from there and fed them into the web-app module. but its erroring while trying to create the target group, says that its missing an elb

is the web-app known to be working?

@Andriy Knysh (Cloud Posse) can probably find a reference architecture

i can

1 sec

it looks like the alb module creates a target group with default at the end of it

this is how we used it

i need to go now, will be back in a few hours and will be able to answer qs if you have any

hmm im setup almost the exact same, will make it exact

worked, must be something in there that is required for the apply to work. ill have to dig in a little bit more, ty for the full sample

Thanks @Andriy Knysh (Cloud Posse)

yes thanks so much @Andriy Knysh (Cloud Posse)

no problem, glad it worked for you

we need to add the example to https://github.com/cloudposse/terraform-root-modules

hi guys, it looks like the host_port variable is unused in [main.tf](http://main.tf). https://github.com/cloudposse/terraform-aws-ecs-web-app/blob/master/variables.tf#L76 am i missing something?

@Ryan Ryke I’m working on another ECS module. the empty string host_port will be rendered as null. When using ECS together with an ALB the host port will be dynamically allocated. It’s explained here :

https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_PortMapping.html

If using containers in a task with the bridge network mode, you can specify a non-reserved host port for your container port mapping, or you can omit the hostPort (or set it to 0) while specifying a containerPort and your container automatically receives a port in the ephemeral port range for your container instance operating system and Docker version.

@Ryan Ryke ^^^ meant for you

Fixed

@maarten @jamie @antonbabenko I might be coming around to using Atlantis as I’ve resolved in my mind how we would do it within the “geodesic” model of operations. The current blocker for us is running it in different accounts. I’d prefer to run one instance per account to limit blast radius.

I put my 2c here: https://github.com/runatlantis/atlantis/issues/249#issuecomment-422240279

Hi guys. First, thanks for your awesome modules ! I am using this one https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment . I have a question. This module creates a load balancer which has a default security group. Am I correct ? This ELB security group allow ingress 443/tcp or 80/tcp from 0.0.0.0 . I would like change 0.0.0.0 to a custom cidr. Is it possible ?

@Pierre good question

looks like we don’t support it at this time

The fix would be to add a section like this:

https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment/blob/master/main.tf

and pass the SecurityGroups parameter

If you want to open a PR, we’ll promptly review it

thanks @Erik Osterman (Cloud Posse). I will look at it

do you guys know of or have any tools to test terraform modules? I was thinking something along the lines of it imports the module, you specify the input variables you want to test, and you make sure the plan is as you expect

i saw this https://github.com/gruntwork-io/terratest but it actually creates resources and you have to then write api calls to validate and destroy resources which takes time

@Gabe we’ve been thinking about testing and CI/CD for terraform modules and even have some POCs, but all of that is in initial stage. @Erik Osterman (Cloud Posse) can give you more info on that

yea, we’re taking a different, perhaps “easier” approach. while terratest is awesome for writing tests at that level of complexity, we’re currently content with testing that modules create/destroy and are idempotent.

Here is some very early work: https://github.com/cloudposse/test-harness/tree/master/tests/terraform

and here is a small example on using that https://github.com/cloudposse/terraform-null-label/blob/add-tests/codefresh.yml

using https://github.com/bats-core/bats-core

oh cool i’ll check it out

i guess as pretty simple example of something i would like to be able to test is if the module has a flag to turn on/off certain resources ensuring it works as expected

one consideration for that is to create multiple terraform.tfvars files with all the different permutations

so in addition to testing successful create/destroy/idempotency for each permutation, you would also test that a specific state is achieved

i know some are using test kitchen for terraform. we’re holding off on introducing the ruby dependency as long as possible

it’s amazing what can be accomplished just using jq

https://github.com/cloudposse/test-harness/blob/master/tests/terraform/00.input-descriptions.bats#L5

so since the entire terraform state is json, jq will address a lot

i found this https://github.com/palantir/tfjson so you can output the plan in json… so theoretically you wouldn’t even have to create the resources

is that necessary?

maybe it’s a more concise representation

there is an -out parameter which will emit the plan in json

oh, i guess the .tfplan is not json

i thought it was

https://github.com/hashicorp/terraform/issues/11883

doesn’t look like it’s coming out in terraform 0.12 either

bummed there’s no binary release

i’d add it to our packages distro

https://github.com/cloudposse/packages

Hi everyone!

I have a Jenkins deployment that I did a few months ago using https://github.com/cloudposse/terraform-aws-jenkins , and since last week my automated backup (AWS DataPipeline) started breaking and it is not completing anymore.

It is not throwing any errors, it looks like the backup job simply hangs. Anyone could shed some light on it ?

hi @ivan.pinatti

looks like https://github.com/cloudposse/terraform-aws-jenkins is a popular repo

anyway, since EFS backup is done by a CloudFormation template https://github.com/cloudposse/terraform-aws-efs-backup/blob/master/templates/datapipeline.yml

please make sure the CF stack is green

also, not sure what’s the limits are on S3 bucket versioning. It might has been reached, please check (https://github.com/cloudposse/terraform-aws-efs-backup/blob/master/s3.tf)

On my AWS console it shows like this;

re:testing, we’ve been using kitchen terraform for a customer recently and it seems to fit the bill on a lot of different items

i can chat in greater detail should someone want to hear about it

also still working on the ecs-web-app module… i’ve gotten to the point now where the codepipeline is erroring on s3 permissions :

Insufficient permissions
Unable to access the artifact with Amazon S3 object key 'bv-staging-hw-xxxxx/task/kN9HAdK' located in the Amazon S3 artifact bucket 'bv-staging-hw-xxxxx'. The provided role does not have sufficient permissions.

really odd

no tweaks to the modules?

nope

i had the issue with the module this morning, so this evening i ripped them all into separate modules, still the same issue

@Ryan Ryke are you up and running?

checking now

looks good

ssm_document isn’t applying even though the instance has the correct role? Any ideas why?

@pericdaniel did you implement everything from http://www.sanjeevnandam.com/blog/aws-microsoft-ad-setup-with-terraform ?

yea i followedd that

right now

i notcied that when i go to run command

that I dont see the instances I want in there

i think it has somthing to do with the ami

but not sure

If you can’t see the instances, this may mean that either the ssm agent is not running or is having trouble connecting to the mothership. Easiest to take a look at its logs to see what’s what.

Thank you Sir

I have built AMIs with packer

So I’m wondering if I’m missing something

When I had problems with instances not showing up in SSM panel, normally I’d go into an instance and check the agent. So, at the very least, it needs to be 1) installed 2) running 3) able to connect to AWS API

it cant hit hte aws api

got it working by setting up NAT GW

ohh, so you deployed it into private subnets w/o a NAT gateway and the instances could not connect to AWS

yes sir

for some reason i figured that it would be able to anyways and that it was all internal

cause it seems like for most services its able to reach it without hitting tghe internet

but not this =[

hmm, what “most services”?

if it’s in a private subnet w/o a NAT gateway, the traffic can’t leave the VPC at all (except for VPC Private Links)

glad you solved the issue @pericdaniel

sorry

anyone set the computername of a windows instance based on instance tags

@pericdaniel take a look at this https://forums.aws.amazon.com/thread.jspa?threadID=181520

https://bam.miranda.org/renaming-an-ec2-windows-instance-and-customizing-its-wallpaper-with-tags-using-powershell/

thank oyu!

https://www.reddit.com/r/aws/comments/8rdkxl/changing_ec2_hostname_on_creation/

do you need to create template files

or can oyu just add user data to the resource you want to use it for

you can use both HEEDOCS and template files, but we prefer to use https://www.terraform.io/docs/providers/template/d/file.html

in that example am I creating a .tpl file that contains what I have above and then referencing that under the resource im crreating or can I just leave it there as a a data type

let me show an example

yay i love examples

https://github.com/cloudposse/terraform-aws-eks-cluster/blob/init/kubeconfig.tpl

https://github.com/cloudposse/terraform-aws-eks-cluster/blob/init/main.tf#L102

cool! so for vars.. the only var I would have is the ${var.tag_box}

Use as many as you need :)

Update them in the template and in the terraform module

is there a way to check if it ran into an error?

i have it looking at the tpl file

but doesnt do a rename or anything

hmm

i suggest you test the renaming PowerShell script locally before deploying to make sure it does actually work

I’m running the vpc peering module and hitting this error continuously:

data.aws_vpc_endpoint_service.dynamodb: Refreshing state...
data.aws_vpc.acceptor: Refreshing state...
data.aws_vpc_endpoint_service.s3: Refreshing state...
data.aws_subnet_ids.acceptor: Refreshing state...
data.aws_route_table.acceptor[2]: Refreshing state...
data.aws_route_table.acceptor[4]: Refreshing state...
data.aws_route_table.acceptor[8]: Refreshing state...
data.aws_route_table.acceptor[5]: Refreshing state...
data.aws_route_table.acceptor[6]: Refreshing state...
data.aws_route_table.acceptor[0]: Refreshing state...
data.aws_route_table.acceptor[7]: Refreshing state...
data.aws_route_table.acceptor[3]: Refreshing state...
data.aws_route_table.acceptor[1]: Refreshing state...

Error: Error refreshing state: 1 error(s) occurred:

* module.vpc_peering.module.vpc_peering.data.aws_route_table.requestor: data.aws_route_table.requestor: value of 'count' cannot be computed

Ahh the count issue again :)

hehe

We’ll take a look

https://docs.cloudposse.com/faq/terraform-value-of-count-cannot-be-computed/

my guess is the subnet count differs or the referenced vpc is different

ahh…checking

Apply in stages using -target

First provision VPC and subnets

yeah, i saw that on https://github.com/hashicorp/terraform/issues/14432#issuecomment-301128718

We saw that issue before

it wasn’t being too kind

In that module

i can try again

Do you know how to use -target?

could’ve been PEBKAC

yes

so how far down the “tree” do I have to plan individually?

to the resource level?

the module does lookup of the requestor VPC https://github.com/cloudposse/terraform-aws-vpc-peering/blob/master/main.tf#L31

so the VPC needs to be provisioned first using terraform apply -target=

after it’s provisioned, run apply on terraform-aws-vpc-peering

if you have the VPC code in a separate folder, no need to use -target, just apply it

terraform-aws-vpc-peering is created in such a way so it does the data source lookup

mostly for kops deployments

ok…let me give that a whirl

could be done differently

i did the plan and not the apply itself

https://github.com/cloudposse/terraform-aws-kops-vpc-peering/blob/master/main.tf

started a custom one for our internal module repo but figure no need to recreate it

saw that one too

you need to apply it

for the VPC to be created first

got it. that’s what i missed

so guess i partially knew how to use -target

yea, need to use it if the VPC code and peering code are in the same folder

they’re not. two modules used in one file

one file is the same as in one folder

i meant the core code was in separate folders, but i gotcha

terraform apply -target=module.vpc.aws_vpc.application-vpc

thx a ton for the help

and for the modules. they’re quite useful.

hey dudes exposed some variables in the terraform-aws-web-app

https://github.com/cloudposse/terraform-aws-ecs-web-app/pull/17

not sure its up to cp standards, but it works

Thanks @Ryan Ryke !

LGTM

cool

glad i could contribute back at least a little bit

GitHub doesn’t let me tag releases on iOS

Even if I request desktop site so we can merge as soon as I get to a desk or @Andriy Knysh (Cloud Posse) online

@Andriy Knysh (Cloud Posse) my issue was that the tag I had set.. had a forward slash in it. And you cant name servers with a / in it lol

another quick, potentially stupid question. the multi-az-subnets. i’m trying to build a 3 tier vpc. public - app - db. the non-public subnets are all building as expected with one exception. only one of the private subnets is mapping to a nat gateway. the other two subnets dont have a nat in their routes in both tiers…