#terraform (2018-10)

hi

so with your beanstalk module… How can I add user data?

.ebextensions is not enough?

I need to get add swap to instances as they are created. someone before me had created ebextensions to add script to add swap, but when instances are refreshed or whatever it doesnt work. also he didn’t add it to fstab so on restart no swap.

we did it that way for swap

also turns out ebextensions are only executed once on environment creation (i think), and any changes later are ignored.

it’s been a couple years since i looked at it

but i think there were sections that run on every build

and some that only ran on creation

hmm i’ll have to research into it more. couldn’t find any details about that yet

i found our old code for that

yep thats essentially what i have

minus the command part

https://stackoverflow.com/questions/35788499/what-is-difference-between-commands-and-container-commands-in-elasticbean-talk

hmm so in my case the command does run, but it does nothing because swapfile already exists. it just doesn’t actually re-enable it

if instance is rebooted

Just call “swapon /the/swapfile”

So if the instance is rebooted, it checks for the file. If it’s found it calls swapon, else it creates it and calls swap on

yeah i’ll add that. thank you

i do like your ENV for swapsize

i might steal that idea

lol

I just had a second former co-worker independently discover this comment and thank me for it https://github.com/hashicorp/terraform/issues/9368#issuecomment-253950367 </brag>

haha, very nice - like the fix

also, props for using template_file over HEREDOCs - hate those

though in the particular issue, I’d argue the correct fix is to use an iam_policy_document which rather than templated JSON.

https://www.terraform.io/docs/providers/aws/d/iam_policy_document.html

Well, in my defense, I made that comment 2 years ago, when I had 2 years less TF experience, and might predate iam_policy_document

haha very likely!

it’s awesome though.. i have been coming across a lot of members contributions/comments

Where’s TF 0.12, we’re dying here ?

@maarten, @Daren, @jamie just in the past week

expect the announcement at hashiconf probably

end of oct

<—– excited but not excited

we have 100+ modules to update

@Ryan Ryke what do you think about this: https://github.com/cloudposse/terraform-aws-ecs-container-definition/pull/12

by @stephen

hey all. I’m quite confused by the ecr_repository_name variable to the terraform-aws-ecs-alb-service-task module. There are no references to it in the configuration. How does one link an ECR repo to a ECS task?

hey @dan

look here for an example https://github.com/cloudposse/terraform-aws-ecs-web-app/blob/master/main.tf#L66

https://github.com/cloudposse/terraform-aws-ecs-web-app/blob/master/main.tf#L8

@dan i recommend starting with the terraform-aws-ecs-web-app module for a more “turnkey” app

of course, if you need to do something which doesn’t fit the mold, you can always use the terraform-aws-ecs-alb-service-task as a building block.

the web app module will be a good reference implementation for you

man! we have too man dans for me to keep track of…

did you take a look at the gist for the buildspec.yaml?

I have a quick question about https://www.terraform.io/docs/providers/aws/r/autoscaling_group.html#waiting-for-elb-capacity

So I typically use min_elb_capacity and deploy a new LC+ASG together when config/code changes within my ASG instances.

A colleague hit me up today with this observation – “”” Assuming a the old ASG has scaled-out (increased instance-count) due to scaling-rules – and because the terraform value for min_elb_capacity is not dynamic this will cause an unwanted reduction in the instance count when the new ASG is deployed. “”” Has anyone seen a method of propagating the current desired_capacity from the currently active ASG to the newly proposed ASG during the terraform plan phase?

I think the best thing would be to ignore_changes to desired_capacity

OK, I’ll try that.

has anyone touched this module in a while https://github.com/cloudposse/terraform-aws-cloudwatch-flow-logs

looks like kinesis is in there not 100% sure what its needed for

@Ryan Ryke looks like the module was created almost a year ago and never updated. We can take a look at it together if you want to use it

@tamsky regarding desired_capacity:

You may want to omit desired_capacity attribute from attached aws_autoscaling_group when using autoscaling policies. It’s good practice to pick either manual or dynamic (policy-based) scaling

https://www.terraform.io/docs/providers/aws/r/autoscaling_policy.html

that’s what we use here https://github.com/cloudposse/terraform-aws-ec2-autoscale-group/blob/master/autoscaling.tf

@dan we took a look into your specific question with specifying the ECR repo with terraform-aws-ecs-alb-service-task module

What you want to do is use the terraform-aws-ecs-container-definition module to create a JSON task definition.

set the container_image to the canonical “docker” url to the image

then once you have all that, pass the container definition JSON as the value of container_definition_json of the terraform-aws-ecs-alb-service-task

@Andriy Knysh (Cloud Posse) is going to remove that confusing ecr_repository_name which is not used

@dan example added here https://github.com/cloudposse/terraform-aws-ecs-alb-service-task/pull/15/files#r222824398

new version released with usage examples and explanation how to setup the container image https://github.com/cloudposse/terraform-aws-ecs-alb-service-task

@dan ^

@Gabe thanks for the PR https://github.com/cloudposse/terraform-aws-dynamic-subnets/pull/34

going to have @Andriy Knysh (Cloud Posse) review - then we’re good to merge

thank you

@Gabe thanks! merged to master

awesome thank you!

https://sweetops.slack.com/archives/CD0K0G928/p1538975277000100

@Andriy Knysh (Cloud Posse) I’ve been out of the loop on your EKS plugin, but is it production ready?

yep

all modules were tested on AWS

https://github.com/cloudposse/terraform-aws-eks-cluster

Thank you I am going to use it today

https://github.com/cloudposse/terraform-aws-eks-workers

and here is a complete working example (the one we tested)

https://github.com/cloudposse/terraform-root-modules/tree/master/aws/eks

Thank you good sir

@bober2000 https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment/blob/master/main.tf

Under resource "aws_elastic_beanstalk_environment" "default" { you’ll see similar settings

@Andy so just insert my settings to resource “aws_elastic_beanstalk_environment” “default” {

ok, thanks

will try this

yup or set a variable for value = "8.6.4" part so you can easily switch between versions for other apps

sorta depends on your use cases and if you’ll have multiple apps or environments

just used this module from git directly source = “git://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment.git?ref=master>”

so I need to clone repo to localhost and change it there

got it

yup

hey @bober2000, welcome

@Andy thanks for answering the questions

@bober2000 if you want to open a PR to add the settings to the module, we’ll review it

@Andriy Knysh (Cloud Posse) sure! Will do this as fast as understood how

ok

here are the steps that should help you:

1. Fork the repo into your GitHub account

2. Create a new branch

3. Modify the code in your branch

Add this

setting {
    namespace = "aws:elasticbeanstalk:container:nodejs"
    name      = "NodeVersion"
    value     = "8.6.4"
  }
 

1. Test on AWS (terraform plan/apply)

2. Open a Pull Request against our repo

3. We review and merge your changes into our repo

8.6.4 should be a new variable, e.g. nodejs_version

Oh, thanks - I know how to contribute using GitHub - I mean I’m still only newbie in terraform syntax

Will add this - thanks for a guide

Don’t forget to add to variables.tf as well

yep

and then rebuild README by executing the following commands in the module folder:

Anyone know if there is a terraform module(+lambda) out there for AWS service limit monitoring ?

That would be a great one!

Haven’t seen though…

I want a module for billing alerts too

https://s3.amazonaws.com/solutions-reference/limit-monitor/latest/limit-monitor.pdf there is a CF template https://s3.amazonaws.com/solutions-reference/limit-monitor/latest/limit-monitor.template Easiest to just TF around it

My requirement is to not to delete and not even trying to delete, since S3 is the backend. Currently it’s trying to delete and failing since versioning is enabled. Was trying to set a deletion policy to “retain” (S3) running terraform. (moot) Was wondering if there is option to tell terraform not to delete backend S3 ??

@GFox)(AWSDevSecOps can you add some additional context? sounds like you might be talking about the terraform-aws-tfstate-backend module?

Thank you @Erik Osterman (Cloud Posse), working on it, I’m not an aws guy yet, more azure and openstack, but helping a friend right now, while l’m reading up looking into it, and, when I get a better picture, will def ping you back

Aha then yes there are a few options

Sorry, I see now more clear what you are asking

So when you create the bucket resource you will want to add a lifecycle block that says prevent destroy

@GFox)(AWSDevSecOps you need to put tfstate-backend into a separate folder, provision it using TF local state, then import the state into the tfstate-backend bucket

as we do here https://github.com/cloudposse/terraform-root-modules/tree/master/aws/tfstate-backend

all other modules are in different folders, so when you run terraform destroy on them, TF will not attemp to destroy the state bucket

wow, quick responses, great help and great stuff

also take a look at our docs where we describe the process https://docs.cloudposse.com/reference-architectures/cold-start/#provision-tfstate-backend-project-for-root

@Andriy Knysh (Cloud Posse) PR for adding NodeJS version select https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment/pull/50

Thanks for the help here on the terraform-aws-ecs-web-app ECR issue a few days ago!

I’m now wondering if I’ve misunderstood the use-case for the module. Is it ok to have the instances it defines live on a public subnet? The only way to specify the subnets is via ecs_private_subnet_ids, which leads me to believe it should only be used on private subnets. In my use-case, the containers need internet access. When I look under the hood, I don’t see any reason for the “private” qualifier. Is it just a poorly-named variable?

it was designed with the expectation that the tasks are on a private subnet

which means your VPC needs a NAT gateway to reach the internet

have you seen our VPC and subnet modules? Those will take care of it

Ah, thanks. Will look now.

(though I suppose it will just work if you give it public subnet IDs)

even though it’s called private_... (just a hunch)

that’s what I was hoping for. Will report back.

if not, and you want to submit a PR, will review it promptly

Hi again. When trying to

terraform destroy

I’m getting several errors: module.elastic_beanstalk_environment.aws_s3_bucket.elb_logs (destroy): 1 error(s) occurred: aws_s3_bucket.elb_logs: error deleting S3 Bucket (develop-dev-vitaliimorvaniukdev-logs): BucketNotEmpty: The bucket you tried to delete is not empty status code: 409 module.dev_front_end.module.logs.aws_s3_bucket.default (destroy): 1 error(s) occurred: aws_s3_bucket.default: error deleting S3 Bucket (develop-dev-front-dev-vitalii.morvaniuk-dev-logs): BucketNotEmpty: The bucket you tried to delete is not empty. You must delete all versions in the bucket. status code: 409

force_destroy = true 

is setted

what should I check ?

was force_destroy = true set from the very beginning?

oh, this is a tricky thing i discovered a few months ago.

if you change force_destroy = true but do not terraform apply, it doesn’t register

@bober2000 and if the rest has been deleted already, best is to do a terraform apply_target on module.elastic_beanstalk_environment.aws_s3_bucket.elb_logs with the force_destroy = true option. And then the destroy again.

Yes force_destroy = true was set from the beginning

[empty bucket]-button

Its what I’m doing now - but I’d like it to be deleted automatically

i’m not quite sure what to look into

in older versions of terraform, it was common that versions weren’t force deleted

terraform –version Terraform v0.11.7

• provider.aws v1.40.0
• provider.null v1.0.0

https://github.com/terraform-providers/terraform-provider-aws/issues/208

but that’s been working for me as of relatively recently - using our terraform-aws-tfstate-backend module which has versions

Erik, you have a long history of tf issues

hah, that’s ironic

since v0.6.16

its more tragic hehe, it’s super old

Ok, one more question - I need to add RDS instance to my beanstalk environment - as far as I see there are no option for this - should I do it separatly and after that add something like this:

setting {
    namespace = "aws:elasticbeanstalk:application:environment"
    name = "RDS_USERNAME"
    value = "${aws_db_instance.rds-app-prod.username}"
  }
  setting {
    namespace = "aws:elasticbeanstalk:application:environment"
    name = "RDS_PASSWORD"
    value = "${aws_db_instance.rds-app-prod.password}"
  }
  setting {
    namespace = "aws:elasticbeanstalk:application:environment"
    name = "RDS_DATABASE"
    value = "mydb"
    value = "${aws_db_instance.rds-app-prod.name}"
  }
  setting {
    namespace = "aws:elasticbeanstalk:application:environment"
    name = "RDS_HOSTNAME"
    value = "${aws_db_instance.rds-app-prod.endpoint}"
  }

For prod it’s recommended to do it separately http://www.michaelgallego.fr/blog/2013/10/26/do-not-associate-rds-instance-with-beanstalk-environment/

And then just pass RDS Hostname username/password etc as variables to the environment

Ok, thanks

https://github.com/cloudposse/terraform-aws-rds so something like that and then you can use the outputs

First let me say thanks for contributing great terraform modules. I have a question though. I need a simple redis elastic cache cluster. I have looked at https://github.com/cloudposse/terraform-aws-elasticache-redis but this seems to be geared towards clusters with replication such as https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Replication.Redis.Groups.html#Replication.Redis.Groups.Cluster. Is this correct or my assumptions are wrong? Thanks in advance for any feedback.

hey @Miguel Mendez

yes the module does not support https://www.terraform.io/docs/providers/aws/r/elasticache_cluster.html

only https://www.terraform.io/docs/providers/aws/r/elasticache_replication_group.html

OK, any plans supporting it?

Most of our modules are driven either by client engagements or community contributions. As of right now, we don’t have any clients asking for it :-)

We are really good about promptly reviewing PRs and nearly accept all contributions. If you’re interested, please take a stab at it!

OK great. I will create then a module and submit a PR. Thanks once again for your contributions.

Awesome @Miguel Mendez ! Thanks for taking a look at it

Hey all, I’m trying to get https://github.com/cloudposse/terraform-aws-eks-cluster to work. No nodes are showing up when i do kubectl get nodes. The userdata log on the instance looks fine.

@nicgrayson did @Andriy Knysh (Cloud Posse) share the reference implementation?

https://github.com/cloudposse/terraform-root-modules/tree/master/aws/eks

I’m using tf from the readme

^ what we deployed and tested

you need to apply the ConfigMap for the worker nodes to join the cluster

you can apply it manually, or using https://github.com/cloudposse/terraform-root-modules/blob/master/aws/eks/kubectl.tf

(EKS does not do it automatically)

ah okay thanks

Worked like a charm

nice

let us know if any issues

Hi all. I’m trying to create RDS instance using https://github.com/cloudposse/terraform-aws-rds

module "elastic_beanstalk_rds" {
  source      = "git::<https://github.com/cloudposse/terraform-aws-rds.git?ref=master>"
  namespace   = "${var.namespace}"
  stage       = "${var.environment}"
  name        = "${var.user_account_name}"
  dns_zone_id = "${var.parent_zone_id}"
  host_name                   = "db"
  security_group_ids          = ["${module.vpc.vpc_default_security_group_id}"]
  database_name               = "app"
  database_user               = "admin"
  database_password           = "password"
  database_port               = 5432
  multi_az                    = "false"
  storage_type                = "gp2"
  allocated_storage           = "5"
  engine                      = "postgresql"
  engine_version              = "9.6.6"
  instance_class              = "db.t2.micro"
  db_parameter_group          = "default.postgres9.6"
  #parameter_group_name        = "default.postgres9.6"

But getting

module.elastic_beanstalk_rds.aws_db_instance.default: Resource 'aws_db_parameter_group.default' does not have attribute 'name' for variable 'aws_db_parameter_group.default.*.name'

error

what I’m doing wrong ?

try passing a list instead

see if that works, unfamiliar with the module but might point you in the right direction if so

er hm, likely from the commented out parameter_group_name

looks like it’s checking for the length of that here: https://github.com/cloudposse/terraform-aws-rds/blob/master/main.tf#L54

hey @bober2000 and @jarv

if parameter_group_name is not provided, the default is "" (empty string)

it looks like a race condition

oh, hm didn’t see that.. ~so guess just a depends_on should prevent that as well~an ignore this suggestion probably, think I need more sleep

looks like it’s the ‘famous’ issue with TF counts after the latest release (count expressions have been changed)

@bober2000 can you try the previous release source = "git::<https://github.com/cloudposse/terraform-aws-rds.git?ref=tag/0.4.0>"

that one was working for a long time

and we’ll look into the issue with the latest release 0.4.1

also, don’t use master in your code (git::<https://github.com/cloudposse/terraform-aws-rds.git?ref=master>), always pin to a release (for all modules). Modules get changed and there is a possibility of regression

thanks for tips - will try

does anyone have an example for using the event selector in the cloudtrail module? https://registry.terraform.io/modules/cloudposse/cloudtrail/aws/0.5.0?tab=inputs trying to capture all S3 events https://www.terraform.io/docs/providers/aws/r/cloudtrail.html#event_selector

has anyone here used the terraform-aws-alb and terraform-aws-alb-ingress modules to configure a load balancer to redirect http to https? It’s an obvious option when adding an ingress rule via the AWS UI, but I’m lost finding the equivalent option in the cloudposse modules. I feel like I’m missing something simple…

@dan we don’t have this implemented right now. @Ryan Ryke wanted the same thing. Not sure what he ended up doing.

@Erik Osterman (Cloud Posse) good to know - thanks

Looks like support for this was released in August (after our first look at it)

https://github.com/terraform-providers/terraform-provider-aws/issues/5344

Support for fixed-response and redirect actions has been merged into master via #5430 and will release with version 1.33.0 of the AWS provider, later this week. (August 20)

@dan if you get a chance to implemented, we would love a PR

https://www.terraform.io/docs/providers/aws/r/lb_listener.html#redirect-action

@dan

@LeoGmad I think you guys might dig this too….

@LeoGmad has joined the channel

yeah, i would be interested in that. i can try and put a pr in this weekend. for now they are handling it inside the container

not totally sure how you would implement it though

@Ryan Ryke I think we would add this to the terraform-aws-alb module

resource "aws_lb_listener" "https_redirect" {
  count = "${var.https_redirect_enabled == "true" ? 1 : 0}"
.... # code from above
}

Somewhere here. https://github.com/cloudposse/terraform-aws-alb/blob/master/main.tf#L27

And then a ternary here to select the appropriate ARNs: https://github.com/cloudposse/terraform-aws-alb/blob/master/outputs.tf#L38

ahh right something like that might make sense

(or maybe return 0 ARNs for HTTP if redirect enabled)

when is .12 coming out?

maybe hashiconf?

yea, that’s my expectation

hey

quick one

let’s say I want to only deploy your beautiful jenkins terraform solution

what is a good practice to start?

copy the main.tf from the examples folder to the root of the project and run terraform init .. plan .. apply?

I wasnt able to find that skimming the readme

thx

this one https://github.com/cloudposse/terraform-aws-jenkins

for now I created a deploy folder and run terraform init deploy/ etc.

hey @ff

hey

so I think you already have your project structure similar to this https://github.com/cloudposse/terraform-root-modules/tree/master/aws

each app/module should be in a separate folder

got it

ah I see

you add for example jenkins folder

and copy our example in there

then cd to the folder and run terraform plan/apply

thanks that was the hint I was missing

back to work

1 sec

and pin all modules to a release

don’t use master

e.g. https://github.com/cloudposse/terraform-root-modules/blob/master/aws/cloudtrail/main.tf#L34

master can be changed/updated and there is a possibility to introduce regression

got it

this is awesome stuff … how did we infrastructure back in the 2000s

or even further back

@ff That is terrifying to think about. We did it very badly.

lots of metal and cables

and sometimes even documentation

Oh man, and SSHing into a million machines to apply patches, config drift, you name it

or DRBD

hey again… making some progress with the jenkins-terraform

but

ending up here

I already learned about the other issue with the empty value for the github auth token and added a - in the value as described in https://github.com/cloudposse/terraform-aws-jenkins/issues/11

but here is a dead end. I don’t see a name tag either. Please advise

I now worked - it was obvious after asking the question here - using another tag name and value (before: Terraform = “true”, after Department = “abc”)

whatever

It only works once. Once the tag has been set, the next run fails.

this is my config - please help, I am at a dead end

hey @ff what’s exactly are you seeing? terraform apply first time works, but second time fails?

anyone have a good read replica module

rds read replica

@Ryan Ryke hrmmm I believe we recently made some fixes to support this use-case

Trying to remember who here was working in that

@Andriy Knysh (Cloud Posse) do you remember who?

Gladly?

Daren gave us the example code that they used, but it was to help someone else

Let me check

https://sweetops.slack.com/archives/CB6GHNLG0/p1536204881000100

Here’s the link to the discussion

Maybe some more juice there

right, so no module just a raw resource

@Erik Osterman (Cloud Posse) we helped Gladly with this module terraform-aws-rds-replica-vpc

they have it, but it’s not public

Yea, so IMO not sure it makes sense to have a module for it

This customer created a private module that does this by creating a vpc, subnet and RDS instance configured as a replica

But then that means that vpc should be used basically for nothing else

yes, that was mostly for cross-region replica

so more complex than prob needed

This is good for checking the box on a pci compliance box

@Ryan Ryke can you provide the use-case you are solving?

@Ryan Ryke if you use Aurora, you don’t need all of that

they just want a read replica in prod

also true

i dont need a module for it

there really isnt a whole lot of tf theere

i modified @Andriy Knysh (Cloud Posse)’s sample and im done

10 minutes

replica for plain RDS is mostly useful if you need cross-region replication

agreed, they want to hit a separate endpoint for reporting

ok, then you need it

why not Aurora? (historical reasons?)

just comfort level for them

yea, but Aurora is faster

Terraform and encrypted cross-region read replicas used to be a pain IIRC - not sure if still the case

Also Aurora you don’t really have to care about storage space again

probably not anymore https://sweetops.slack.com/archives/CB6GHNLG0/p1536204881000100

is there a cloudposse e2e terraform module that just gets me an ecs cluster I can run some one-off (and scheduled, but not persistent) tasks on? looks like the most plausible public one is https://github.com/arminc/terraform-ecs

(or, ya know, start writing your own terraform :))

yes/no

we’ve taken a more decomposed approach to ECS fargate

do you require CI/CD?

https://github.com/cloudposse/terraform-aws-ecs-web-app

this module does most of the heavy lifting

you give it a vpc and subnets, and it deploys a traditional “webapp”

it takes care of setting up the service task, task definition, codebuild, codepipeline, alb rules, autoscaling,etc

however, if you have something very simple - where you basically just want “heroku” but on AWS - there’s something else to consider

Yeah; I saw that one – it seems to do almost everything besides the cluster, and it’s the cluster I’m really after

the cluster is a 1-liner

OTOH what eventually want is a cron job running a container with some persistent storage, so maybe I should just run k8s instead

the cluster resource itself is a oneliner but the instances in it aren’t, right?

you still need an autoscaling group and a launch configuration etc

oh, we only deal with Fargate

heh that’ll do it – what do you do for persistence in fargate? iirc it doesn’t support docker volumes

just bind mounts

and IIRC you can’t make the bind mount just point at an EBS volume you control

yea, that’s still a drawback. we’re mostly a kubernetes shop.

in an “ideal world” you don’t need the durability in your containers and can offload that to an external backing service ala S3 with object storage

but i realize that’s not right for everything

have you seen this? https://github.com/jpignata/fargate

i mean, I can mostly use goofys I think, but it sounds easier to just use k8s + ebs storage in the pod

I’m using this for simple off off stuff.

none of the apps that I’m currently using reallllly want a POSIX fs

it’s more of a key value store that maybe uses fopen

yea, goofys is a hack

plus it requires elevated capabilities for fuse

not sure if it will work on ECS Fargate

as a security person I don’t want fuse anywhere near my containers tbh

OK: you convinced me, time to deploy some k8s

we’ve only used goofys as a last resort

we have EKS modules too

@jsanchez

@jsanchez has joined the channel

Hey guys, thanks for all the work you’ve put into the modules on github, it’s an awesome collection. I’m trying to build out a pipeline to deploy an ecs cluster, and the target group that is created seems to have no targets - I’m having trouble digging through and finding a reason that might cause it. Has anyone run into similar before? I’m using terraform-aws-alb, terraform-aws-ecs-web-app, and terraform-aws-ecs-alb-service-task

^ (semi) solved it myself - tasks were never working in the ecs cluster (unable to access my ECR to pull the image, unsure why), so there never were any targets to register. Womp.

@George thanks so much!

Sounds like you figured it out

also, did you see our example buildspec.yaml?

https://github.com/cloudposse/terraform-aws-ecs-web-app/issues/16

I did, wasn’t quite sure how I would integrate it into what I was using

(Or if it replaced some or all of the components, aside from the vpc and subnets)

Hrm… I thought we had a full example somewhere

looking

here’s a more complete example that helped @Ryan Ryke get up. We really need to add this to our terraform-root-modules

https://gist.github.com/osterman/15c639a970252c9adee8da09538659e8

I’ll check it when I get back to my machine, thanks for the heads up!

cool - just ping me if you’re stuck

https://www.terraform.io/docs/configuration/outputs.html#sensitive-outputs

TIL:

output "sensitive" {
  sensitive = true
  value     = VALUE
}

Note that this is mostly useful in the CI scenario as anyone with access to the state can always terraform output or read it directly.

yeah i can help if needed

Found some weird behaviour and managed to file a new issue even with the current Github outage. https://github.com/cloudposse/terraform-aws-rds-cluster/issues/37

thanks for looking into it

@ff try without the availability_zones

It does not accept - it’s a mandatory variable

been there

and with availability_zones = []

it’s related to https://github.com/cloudposse/terraform-aws-rds-cluster/issues/35

stupid me

tryin’

nope

availability_zones.#: “3” => “0” (forces new resource) availability_zones.1126047633: “eu-central-1a” => “” (forces new resource) availability_zones.2903539389: “eu-central-1c” => “” (forces new resource) availability_zones.3658960427: “eu-central-1b” => “” (forces new resource)

and in turn the cluster nodes are also forced new resoruces

just remove everything, and create again without az’s

then it should work and keep working

Got ya. Testing.

first w/o terraform destory

let’s see

thanks for the hint

sure np, wanted to do a quick pr, but GH is still suffering it seems

good old single points of failure

will report back in about 15mins when the “apply” has finished

haha

does not work

availability_zones.#: “3” => “0” (forces new resource) availability_zones.1126047633: “eu-central-1a” => “” (forces new resource) availability_zones.2903539389: “eu-central-1c” => “” (forces new resource) availability_zones.3658960427: “eu-central-1b” => “” (forces new resource)

availability_zones = []

shall I use a terraform destroy and rebuild the environment?

but should not make a difference I think

so we should be able to actually drop the variable

because I assume that an empty bracket means something else than a non existing variable

ah sorry man, i think you’re right

@Andriy Knysh (Cloud Posse) do you have thoughts on this

Let me check

for the time being I worked around it by using native terraform aws resources

nevertheless I thought it might be helpful to fix this for the community

Yea, I think we should just drop that variable from the module altogether

@ff if we do that, does it fix your problems?

We currently use 0.6 in prod (from before my time) and I’ve been tasked with upgrading to current. State files stored in s3. Anyone got any general guides or info sources on how to go about upgrading? I see projects like terraforming etc, and/or regeneration of state files.

terraform 0.6.x -> 0.11.x?

(I’ve been tasked with can be read as “hey I wanna do some terraform” “ok here” “no wait wha-“

@Erik Osterman (Cloud Posse) yes

*0.7 actually, my bad

hrm… haven’t had to do that big of a jump

most important thing is to backup the state files so you have recourse

typically, terraform cli is great about upgrading (never downgrading) tf state

there maybe some syntax change, but you’ll be warned by terraform of those

objective should be to run a terraform plan and see no changes; however, sometimes terraform changes default values for things in which case you will see changes.

i think in the CHANGELOG for every release they publish an upgrade path (if necessary)

i would put together some notes after combing though those release notes that can be you run book

Hmm, so back up the state files, upgrade terraform binary, and terraform plan until it shows no errors?

yea, that’s all I can think of off the top of my head

@maarten @jamie any tips?

yo

@George is upgrading some legacy infra from 0.7.x -> 0.11.x; any words of wisdom?

Wait for 12?

HA

Lol

It comes with an upgrade script

good point

Oh, seriously?

ya

Lemme go investigate

the jump to 11 breaks a lot of “sloppy” code practices of older versions

https://github.com/hashicorp/terraform/releases/tag/v0.12.0-alpha1

pre-release available!

11 stopped allowing things like output references that are lists when the lists are empty

and we spend half of our time working around that with ugly interpolations

11 also broke ‘count’, so that calculated count values arent allowed in modules

These things will likely still break in 12, but the fixes are much more elegant

in terraform 10 you can do

output "the_alb_name" {
value = "${aws_ecs_service.app_with_lb_awsvpc.*.name}"
}

and if aws_ecs_service.app_with_lb_awsvpc wasn;t created… it calmly shows an empty value

without crying about it

in 11, if you want your output to work with an empty list from a resource, then its all:

output "the_alb_name" {
value = "${join("",compact(concat(list(""),aws_ecs_service.app_with_lb_awsvpc.*.name)))}"
}

to get the same output without an error

Hmm, I’ll have to review the erm…state of the current configs we have. Unsure if my predecessor wrote anything that takes advantage of those features. Thanks for the explanation and heads up about 0.12!

Your predesessor will have taken advantage of them

since pre 11, that was just how it was done.. in all the terraform examples too

thanks @jamie! great summary

11:26 Pacific Daylight TimeWe have resumed webhook delivery and will continue to monitor as we process the backlog of events. <- github

Ha, thanks Sorry @George I would give you more guidance on upgrade to 0.11, but 0.12 is a breaking change anyway and you might as well just rewrite your code once instead of twice.

You may also find there is very little to rewrite after the upgrade tool is out as well.

I added a #atlantis channel since we’re doing a lot more with it these days (related to runatlantis.io).

https://github.com/cloudposse/terraform-null-smtp-mail

hot off the press!

Any plans to include that emailcli into packages?

Nvm @Erik Osterman (Cloud Posse) just seen https://github.com/cloudposse/packages/pull/95

thanks @joshmyers!

actually, we have a PR for it already - checking status

Yea, we’ll get that merged tomorrow probably

Given you can’t invoke modules with counts and TF isn’t an ideal language as yet, how do you see using/invoking that module? The example mentions creation of users, which I’d imagine is done as a list of vars. A module per user? I see other use cases but was interested in that as I have run into similar use case before.

i think we’re going to move away from the list-of-users model

and instead do one tf file per user

Agreed that would be more flexible at the moment although I’d hope 0.12 with hcl2 would improve that with rich data structures…

https://github.com/cloudposse/terraform-aws-iam-user/pull/1

i’m getting this setup for our demo on thursday

IAM user account management with #atlantis

Ahh, nice.

so, in this case, would invoke with each user.

I see how that all fits together now

Nice way of doing it

what i don’t like is all the vars I have to pass related to smtp

Modules all the way down

You could infer some of them if not otherwise provided, then again…HCL :(

Also, I’m on mobile right now.

heads up, v0.11.10 was just released and the download urls are different… they no longer have the v in the version token… works:

• https://releases.hashicorp.com/terraform/0.11.10/terraform_0.11.10_linux_amd64.zip doesn’t work:

• https://releases.hashicorp.com/terraform/v0.11.10/terraform_v0.11.10_linux_amd64.zip

@loren ugh, thanks for the heads up

sucks for our packaging system

wonder if that was deliberate on their behalf

luke - maintainer of #atlantis is joining HashiCorp to work fulltime on the project (announced at HashiConf)

btw! if any of you are at hashiconf, reach out here! I know @antonbabenko is there

Yes, I am inside the keynote room now

https://www.hashiconf.com/live

Hey Anton, how many people are there compared to Amsterdam ?

https://app.terraform.io/signup

Terraform collaboration for everyone.

State Storage, Locking, and History. No more state files! Automatically store and access state remotely whenever and wherever you run Terraform. State access is automatically locked during Terraform operations. In the UI, view a history of changes to the state, who made them, and when.

https://www.hashicorp.com/blog/hashicorp-product-announcements-at-hashiconf-2018

https://sweetops.slack.com/archives/CBW699XE0/p1540313027000200

I just discovered tfenv - any good/bad experiences with this here? Seems like it is going to be useful with the new 0.12.x version coming up and working with “legacy” terraform.

isn’t that in ruby?

hate to install that runtime just to switch envs in terraform

bash

https://github.com/Zordrak/tfenv

I think this is less of an issue when doing this all The Right Way™ (using container via geodesic)

haha

i think tfenv might be helpful initially

though i think there’s some way to specify the version compatibility

in fact things like this just reminds me I need to use geodesic everywhere

to support hcl 1 and 2

https://www.terraform.io/upgrade-guides/0-12.html

i guess only one or the other will be supported

they recommend adding a version constraint on terraform

just released https://github.com/cloudposse/terraform-aws-iam-user to manage IAM user account for humans

it supports automatically associating the user with a list of groups as well as password generation using pgp+keybase

yea so the problem that led me to tfenv - was working with multiple repos/modules with different terraform version constraints

also - i was used to the rbenv style of .terraform-version in the root

yea

yea, given that - i think it’s probably the best alternative

i can see where in long-lived environments that managing the terraform versions will be essential and risk to keep everything up to date perhaps

any project open on the new hcl migration? can probably help out with that if there’s a burn down list. (haven’t been following tf updates just know that was likely going to be released soonish)

or maybe just beta.. might try a couple just to dig into the new stuff. haven’t been deep in tf dev in a bit

@jarv that would be HUGE

i think it’s still too early, but when the time comes, I’ll create a “Terraform Module Upgrade” project and add everything there.

will announce that as soon as it’s there.

I can also help out, but have a few modules of my own to do first.. but happy to join forces for problem solving ofc.

Thanks guys! we’re going to need the help

whoaaaa … @Erik Osterman (Cloud Posse) you see Atlantis team is joining Hashicorp?

yea! that’s both scary and exciting

https://medium.com/runatlantis/joining-hashicorp-200ee9572dc5

#atlantis

ah thanks

but yea, relevant here too

i want to use atlantis for more than terraform

but this doesn’t bode well for that roadmap

well now there’s github actions

yea

waiting on invite

anyone already have access to github actions?

not yet - waiting as well

GitHub Actions vs. HashiCorp/Atlantis

~(possibly) Somewhat related:~oticed systems manager added a wait for user input action. unfamiliar with ssm but was curious if something like terraform ci was one of the use cases for adding thateh not sure that makes sense.. unsure why I was thinking about that now

Shall we create a 0.12 channel so problems & solutions don’t get lost in other talks ?

I think it’s a good suggestion

#terraform-0_12

Does anyone know of a way to provide multiple SSLCertificateArns for a beanstalk environment that is using an ALB? The name is called SSLCertificatesArns which implies that you can specify multiple arns but I have tried:

setting {
    namespace = "aws:elbv2:listener:443"
    name = "SSLCertificateArns"
    value = "<someArnForFirstCert>"
  }

  setting {
    namespace = "aws:elbv2:listener:443"
    name = "SSLCertificateArns"
    value = "<someArnForSecondCert>"
  }

And also tried:

setting {
    namespace = "aws:elbv2:listener:443"
    name = "SSLCertificateArns"
    value = "<someArnForFirstCert>,<someArnForSecondCert>"
  }

And:

setting {
    namespace = "aws:elbv2:listener:443"
    name = "SSLCertificateArns"
    value = ["<someArnForFirstCert>", "<someArnForSecondCert>"]
  }

Neither of these approaches seems to work correctly and cannot find any other documentation on it other than: https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/command-options-general.html#command-options-general-elbv2-listener

Sorry - not sure how to do it, but if you figure it out and need to make some changes - we accept nearly all PRs

@Jeremy Looking at the Elastic Beanstalk Documentation it seems that Arns actually refer to just one ARN, maybe they wanted to be prepared future wise. Could you actually add multiple in the AWS Console ? As alternative you could create a new Certificate in ACM with support for multiple domain names, and have just one ARN.

https://github.com/Yelp/terraform-provider-gitfile

cool idea - too bad not maintained

Hi, I am looking for information on how to source passwords from azure keyvault using remote-exec(terraform). Basically I will have to copy a property file to the server which I will source it from git. I do not want the properties file to have sensitive information like secrets/ passwords. so I would want to append the file to password/secret’s from keyvault in azure platform

or either using cloud-init

can I use variable which will query keyvault?

@praveen Not able to use the native resource (https://www.terraform.io/docs/providers/azurerm/r/key_vault.html)?

@Mark, yes I use key vault. But my question is if I can query keyvault by passing query keyvault variable in remote-exec or cloud-init

@praveen what about giving the server access to that keyvault, and retrieve those values at boot ?

how can I do that. can I have any example if already done. I mean if there is any ref to git code

I’m not an Azure expert, but maybe this can help you. https://github.com/sozercan/terraform-vm-keyvault/tree/ea67b8ca5eac82fd92bfe27f40bcf4ada565d93e

I will try this and let you know the result

Could I get some reviews on this PR? https://github.com/EasterSealsBayArea/terraform-aws-elastic-beanstalk-environment/pull/1

It is a fork not going to our master yet (using gitflow; will test/validate it internally from the develop branch with our projects then commit back). I didn’t want to go straight to the official yet without giving it some solid testing.

@johncblandii don’t see anything controversial with the PR

to rebuild the readme run

i did the readme part but not init. will do that now. thx

oh, that’s the easier way to install everything.

oh…maybe this is needed to be resolved for a full rebuild?

/bin/bash: gomplate: command not found
make: *** [readme/build] Error 127

1 sec

oh, looks like we’re missing a dep

you can run:

ahh

pushed

make readme/deps

i mistook docs/terraform.md for the readme without even checking the filename

good to know @Andriy Knysh (Cloud Posse)

PR looks good to me

cool

will get it tested on our stuff then PR it to your upstream

a few other things will come soon too

sidebar: this .12 stuff in TF will clean up the env vars (for/foreach loops) and settings (null values) tremendously

Yea looks like it will be very cool

yea, we’re anxiously awaiting #terraform-0_12

@johncblandii if you want to help us update the beanstalk module (when the time comes), we’d be grateful

absolutely, @Erik Osterman (Cloud Posse). going to do more updates to help out

we use it heavily (3 envs done and about 20 more; between all stages)

@johncblandii any reason you’re not using ECS or Kubernetes?

(we found beanstalk deployments to be more flakey in the long run, which is why we have moved to the other systems)

moving there. devops is a small team here so it comes down to time and we have the beanstalk stuff down

and yes…beanstalk deployments……(sigh)

another quick and easy one https://github.com/EasterSealsBayArea/terraform-aws-elastic-beanstalk-environment/pull/2

LGTM

a bit confused about what to expect of Terraform when using terraform-aws-ecs-web-app. If a new task definition is created, should Terraform automatically redeploy the service with the new definition? I’m currently seeing the new definition show up, but just the old tasks remain running. I guess the question is, should aws ecs update-service be necessary if my terraform-aws-ecs-web-app is configured correctly?

the terraform-aws-ecs-web-app module is designed to work with CodeBuild/CodePipeline to automatically deploy changes merged to master.

this only works if you add a buildspec.yaml to your projects

here’s an example https://github.com/cloudposse/terraform-aws-ecs-web-app/issues/16

so, to answer your quesiton, calling aws ecs update-service is not needed if configured correctly

awesome, thanks for the quick help!

hope it helps!

How do you guys manage your multi-env settings? Currently we use terragrunt, but that’s going away.

I know we can do tfvar files, but is that the best way? I don’t want to end up doing tf plan -var-file=prod.tfvars and tf plan -var-file=prod.tfvars -var-file=uswest2.tfvars and so on and so forth to separate the vars for reuse across a lot of configs (4 app stages, multi-region, multi-account).

Thoughts?

hey @johncblandii, maybe you already saw that, but here is what we do:

Although there are many possible ways of doing that, we use containers + ENV vars pattern. As you mentioned, template rendering is another pattern (as implemented in terragrunt).

We store the ENV vars in either AWS SSM (secrets) or in Dockerfiles (not secrets).

Here are more details:

1. We have a collection of reusable TF modules https://github.com/cloudposse/terraform-root-modules. The modules have no identity, everything is configurable via ENV vars. (In other words, they don’t care where they will be deployed and how).

2. We deploy each stage (root, prod, staging, dev, testing) in a separate AWS account for security and better management

3. For each AWS account/stage (root, prod, staging, dev, testing), we have a GitHub repo which is a container (for which we use geodesic https://github.com/cloudposse/geodesic):

https://github.com/cloudposse/root.cloudposse.co https://github.com/cloudposse/prod.cloudposse.co https://github.com/cloudposse/staging.cloudposse.co https://github.com/cloudposse/dev.cloudposse.co https://github.com/cloudposse/testing.cloudposse.co

Not secret ENV vars are defined in the Dockerfiles, e.g. https://github.com/cloudposse/prod.cloudposse.co/blob/master/Dockerfile#L17 In other words, the account containers have identity defined via the ENV vars.

1. https://github.com/cloudposse/terraform-root-modules is added to the containers https://github.com/cloudposse/prod.cloudposse.co/blob/master/Dockerfile#L36

2. Inside the containers, users assume IAM roles ro access the corresponding AWS account and then provision TF modules.

3. Inside the containers we use chamber (https://github.com/segmentio/chamber) to read secrets from SSM (per AWS account)

So when we run a container (e.g. prod), we already have all ENV vars setup, and we read all the secrets from the account SSM store. An account/stage can be in any region (also specified via ENV var, e.g. https://github.com/cloudposse/prod.cloudposse.co/blob/master/Dockerfile#L14)

Take a look at our docs for more details: https://docs.cloudposse.com/reference-architectures/ https://docs.cloudposse.com/reference-architectures/cold-start/ https://docs.cloudposse.com/reference-architectures/notes-on-multiple-aws-accounts/ https://docs.cloudposse.com/geodesic/

https://docs.cloudposse.com/secrets-management/

Hi all. I still trying to create/destroy beanstalk using

 source    = "git::<https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment.git?ref=tag/0.5.0>"

Option

force_destroy         = true

But getting this

1 error(s) occurred:

* module.dev_front_end.module.logs.aws_s3_bucket.default (destroy): 1 error(s) occurred:

* aws_s3_bucket.default: error deleting S3 Bucket (develop-dev-front-dev-vitalii-logs): BucketNotEmpty: The bucket you tried to delete is not empty. You must delete all versions in the bucket.
        status code: 409, request id: 01B995B9AA71BAC0, host id: KwxTu/DhRRig0CtYmdq0qokvgEgCGDeiUAUB2b4yQna9hmnzWieVdtcSi8aGzg6oF4mk5JRff2s=