#terraform (2018-10)

terraform Discussions related to Terraform or Terraform Modules

Archive: https://archive.sweetops.com/terraform/

2018-10-01

i5okie avatar

hi

wave1
i5okie avatar

so with your beanstalk module… How can I add user data?

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

.ebextensions is not enough?

i5okie avatar

I need to get add swap to instances as they are created. someone before me had created ebextensions to add script to add swap, but when instances are refreshed or whatever it doesnt work. also he didn’t add it to fstab so on restart no swap.

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

we did it that way for swap

i5okie avatar

also turns out ebextensions are only executed once on environment creation (i think), and any changes later are ignored.

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

it’s been a couple years since i looked at it

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

but i think there were sections that run on every build

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

and some that only ran on creation

i5okie avatar

hmm i’ll have to research into it more. couldn’t find any details about that yet

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

i found our old code for that

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
commands:
  00_add_swap_space:
    command: "/tmp/add-swap-space.sh"

files:
  "/tmp/add-swap-space.sh":
    mode: "000755"
    content: |
      #!/bin/bash

      set -o xtrace
      set -e

      SWAP_SIZE=$(/opt/elasticbeanstalk/bin/get-config environment | jq -r ".SWAP_SIZE")

      if [ "$SWAP_SIZE" == "0" ];
      then
        echo "Swap is not enabled"
        exit 0
      fi

      if grep -E 'SwapTotal:\s+0+\s+kB' /proc/meminfo; then
        echo "Enabling swap space (${SWAP_SIZE} mb)"
        dd if=/dev/zero of=/var/swapfile bs=1M count=$SWAP_SIZE
        /sbin/mkswap /var/swapfile
        chmod 000 /var/swapfile
        /sbin/swapon /var/swapfile
      else
       echo "Not creating additional swap space"
      fi

i5okie avatar

yep thats essentially what i have

i5okie avatar

minus the command part

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
equivalent/scrapbook2

web-development notes and archive of Old articles - equivalent/scrapbook2

i5okie avatar
i5okie
06:29:05 PM
Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
what is difference between commands and container commands in elasticbean talk

In aws elasticbean talk. When we setup extensions in .ebextensions i wonder what is difference between commands and container_commands My command is like this container_commands: 04_insert_a…

i5okie avatar

hmm so in my case the command does run, but it does nothing because swapfile already exists. it just doesn’t actually re-enable it

i5okie avatar

if instance is rebooted

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Just call “swapon /the/swapfile”

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

So if the instance is rebooted, it checks for the file. If it’s found it calls swapon, else it creates it and calls swap on

i5okie avatar

yeah i’ll add that. thank you

i5okie avatar

i do like your ENV for swapsize

i5okie avatar

i might steal that idea

i5okie avatar

lol

2018-10-02

mrwacky avatar
mrwacky

I just had a second former co-worker independently discover this comment and thank me for it https://github.com/hashicorp/terraform/issues/9368#issuecomment-253950367 </brag>

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

haha, very nice - like the fix

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

also, props for using template_file over HEREDOCs - hate those

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

though in the particular issue, I’d argue the correct fix is to use an iam_policy_document which rather than templated JSON.

mrwacky avatar
mrwacky

Well, in my defense, I made that comment 2 years ago, when I had 2 years less TF experience, and might predate iam_policy_document

mrwacky avatar
mrwacky

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

haha very likely!

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

it’s awesome though.. i have been coming across a lot of members contributions/comments

mrwacky avatar
mrwacky

Where’s TF 0.12, we’re dying here ?

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

@maarten, @Daren, @jamie just in the past week

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

expect the announcement at hashiconf probably

2
Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

end of oct

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

<—– excited but not excited

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

we have 100+ modules to update

mrwacky avatar
mrwacky

Just in time for Hacktoberfest!

1
Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
Supporting multiple definitions by stephencoe · Pull Request #12 · cloudposse/terraform-aws-ecs-container-definition

The usage for the module appears to be in a single container context resource &quot;aws_ecs_task_definition&quot; &quot;this&quot; { container_definitions = &quot;${module.container_definition.js…

Ryan Ryke avatar
Ryan Ryke

looks pretty cool, i like the idea.

Supporting multiple definitions by stephencoe · Pull Request #12 · cloudposse/terraform-aws-ecs-container-definition

The usage for the module appears to be in a single container context resource &quot;aws_ecs_task_definition&quot; &quot;this&quot; { container_definitions = &quot;${module.container_definition.js…

Ryan Ryke avatar
Ryan Ryke

im not totally sure about which context this is used in, unless you needed a sidecar or some sort of container to link to

2
Ryan Ryke avatar
Ryan Ryke

other wise you could just call the module twice… i am sure im missing a use case here

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

yea - sidecar use-case i think

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

by @stephen

dan avatar

hey all. I’m quite confused by the ecr_repository_name variable to the terraform-aws-ecs-alb-service-task module. There are no references to it in the configuration. How does one link an ECR repo to a ECS task?

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

This is in the imagedefinition.json

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

which is created as part of the build process

dan avatar

seems like that’s related to codepipeline being enabled? Is it the case that terraform-aws-ecs-web-app can’t be configured with an image in ECR unless it’s used with codepipeline?

Happy to open a PR if that’s the case. Just want to be sure I’m understanding the current setup correctly.

dan avatar

I’ve managed to fix this for myself locally by prepending the ECR registry name to the image name in container_definition:

container_image = "${module.ecr.registry_url}:${var.container_image}"`

Unfortunately, since the image repository is defined within aws-ecs-web-app module, I don’t see a way to apply this fix without modifying aws-ecs-web-app itself. Currently working with a local clone for this reason…

Does anyone know a way to do this just by passing the right var.container_image to aws-ecs-web-app?

dan avatar

if it requires a change to container_definition, it seems like it should be conditioned on codepipeline_enabled. Sound correct?

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

if using CI/CD, which is the use-case we optimized for, the repo is set with the buildspec.yaml which defines how to update the imagedefinitions.json file

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

did you take a look at the gist I sent you above?

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

hey @dan

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-aws-ecs-web-app

Terraform module that implements a web app on ECS and supports autoscaling, CI/CD, monitoring, ALB integration, and much more. - cloudposse/terraform-aws-ecs-web-app

dan avatar

thanks @Andriy Knysh (Cloud Posse)

if you search for ecr_repository_name in that repo, you’ll see that it’s only references in the example. Do you know where it gets used?

cloudposse/terraform-aws-ecs-web-app

Terraform module that implements a web app on ECS and supports autoscaling, CI/CD, monitoring, ALB integration, and much more. - cloudposse/terraform-aws-ecs-web-app

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-aws-ecs-web-app

Terraform module that implements a web app on ECS and supports autoscaling, CI/CD, monitoring, ALB integration, and much more. - cloudposse/terraform-aws-ecs-web-app

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

@dan i recommend starting with the terraform-aws-ecs-web-app module for a more “turnkey” app

dan avatar

thanks @Erik Osterman (Cloud Posse). I am still curious to find where this variable is used. Neither the web app nor the service task wrappers reference it outside of the docs or examples…

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

of course, if you need to do something which doesn’t fit the mold, you can always use the terraform-aws-ecs-alb-service-task as a building block.

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

the web app module will be a good reference implementation for you

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

man! we have too man dans for me to keep track of…

2018-10-03

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

did you take a look at the gist for the buildspec.yaml?

dan avatar

yes. can you confirm it’s only relevant if i’m using codepipeline?

I see that I could prepend the equivalent of

$AWS_ACCOUNT_ID.dkr.ecr.us-west-2.amazonaws.com/$IMAGE_REPO_NAME

to the image name, though the repository name seems to be only accessible from within aws-ecs-web-app.

dan avatar

The docs for codepipeline_enabled say:

“A boolean to enable/disable AWS Codepipeline and ECR”

Which makes me think the current setup doesn’t permit pulling images from ECR without codepipeline_enabled.

Ryan Ryke avatar
Ryan Ryke

i hard coded the ecr uri into the ecs-web-app module

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

@Ryan Ryke ok, so it sounds like we’re missing something?

Ryan Ryke avatar
Ryan Ryke

It’s a little chicken and egg

Ryan Ryke avatar
Ryan Ryke

It needs to know the repo and tag before It can build the container definition

Ryan Ryke avatar
Ryan Ryke

And it can’t get the tag until it runs a container definition from the build spec

Ryan Ryke avatar
Ryan Ryke

In the car atm

tamsky avatar

I have a quick question about https://www.terraform.io/docs/providers/aws/r/autoscaling_group.html#waiting-for-elb-capacity

So I typically use min_elb_capacity and deploy a new LC+ASG together when config/code changes within my ASG instances.

A colleague hit me up today with this observation – “”” Assuming a the old ASG has scaled-out (increased instance-count) due to scaling-rules – and because the terraform value for min_elb_capacity is not dynamic this will cause an unwanted reduction in the instance count when the new ASG is deployed. “”” Has anyone seen a method of propagating the current desired_capacity from the currently active ASG to the newly proposed ASG during the terraform plan phase?

AWS: aws_autoscaling_group - Terraform by HashiCorp

Provides an AutoScaling Group resource.

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

I think the best thing would be to ignore_changes to desired_capacity

tamsky avatar

OK, I’ll try that.

Ryan Ryke avatar
Ryan Ryke
cloudposse/terraform-aws-cloudwatch-flow-logs

Terraform module for enabling flow logs for vpc and subnets. - cloudposse/terraform-aws-cloudwatch-flow-logs

Ryan Ryke avatar
Ryan Ryke

looks like kinesis is in there not 100% sure what its needed for

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

@Ryan Ryke looks like the module was created almost a year ago and never updated. We can take a look at it together if you want to use it

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

@tamsky regarding desired_capacity:

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)


You may want to omit desired_capacity attribute from attached aws_autoscaling_group when using autoscaling policies. It’s good practice to pick either manual or dynamic (policy-based) scaling

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-aws-ec2-autoscale-group

Terraform module to provision Auto Scaling Group and Launch Template on AWS - cloudposse/terraform-aws-ec2-autoscale-group

2018-10-04

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

@dan we took a look into your specific question with specifying the ECR repo with terraform-aws-ecs-alb-service-task module

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

What you want to do is use the terraform-aws-ecs-container-definition module to create a JSON task definition.

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

set the container_image to the canonical “docker” url to the image

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
cloudposse/terraform-aws-ecs-container-definition

Terraform module to generate well-formed JSON documents (container definitions) that are passed to the aws_ecs_task_definition Terraform resource - cloudposse/terraform-aws-ecs-container-definition

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
05:35:31 PM
Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

then once you have all that, pass the container definition JSON as the value of container_definition_json of the terraform-aws-ecs-alb-service-task

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
cloudposse/terraform-aws-ecs-alb-service-task

Terraform module which implements an ECS service which exposes a web service via ALB. - cloudposse/terraform-aws-ecs-alb-service-task

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

@Andriy Knysh (Cloud Posse) is going to remove that confusing ecr_repository_name which is not used

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
Update var and examples by aknysh · Pull Request #15 · cloudposse/terraform-aws-ecs-alb-service-task

what Remove unused vars Update README with examples and descriptions Add usage example why The vars were declared but never used and they are unnecessary Add example for specifying container def…

2018-10-05

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

new version released with usage examples and explanation how to setup the container image https://github.com/cloudposse/terraform-aws-ecs-alb-service-task

cloudposse/terraform-aws-ecs-alb-service-task

Terraform module which implements an ECS service which exposes a web service via ALB. - cloudposse/terraform-aws-ecs-alb-service-task

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

@dan ^

2
Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
Fix tags to use output of label modules by gabel0287 · Pull Request #34 · cloudposse/terraform-aws-dynamic-subnets

what Support use of tags by label modules why Interoperability with all modules

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

going to have @Andriy Knysh (Cloud Posse) review - then we’re good to merge

Gabe avatar

thank you

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

@Gabe thanks! merged to master

1
Gabe avatar

awesome thank you!

2018-10-07

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

for those interested and want to follow along, we’re working on some enhancements for atlantis

1

2018-10-10

Matthew avatar
Matthew

@Andriy Knysh (Cloud Posse) I’ve been out of the loop on your EKS plugin, but is it production ready?

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

yep

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

all modules were tested on AWS

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-aws-eks-cluster

Terraform module for provisioning an EKS cluster. Contribute to cloudposse/terraform-aws-eks-cluster development by creating an account on GitHub.

Matthew avatar
Matthew

Thank you I am going to use it today

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-aws-eks-workers

Terraform module to provision an AWS AutoScaling Group, IAM Role, and Security Group for EKS Workers - cloudposse/terraform-aws-eks-workers

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

and here is a complete working example (the one we tested)

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-root-modules

Collection of Terraform root module invocations for provisioning reference architectures - cloudposse/terraform-root-modules

Matthew avatar
Matthew

Thank you good sir

2018-10-11

Andy avatar
cloudposse/terraform-aws-elastic-beanstalk-environment

Terraform module to provision an AWS Elastic Beanstalk Environment - cloudposse/terraform-aws-elastic-beanstalk-environment

Andy avatar

Under resource "aws_elastic_beanstalk_environment" "default" { you’ll see similar settings

bober2000 avatar
bober2000

@Andy so just insert my settings to resource “aws_elastic_beanstalk_environment” “default” {

bober2000 avatar
bober2000

ok, thanks

bober2000 avatar
bober2000

will try this

Andy avatar

yup or set a variable for value = "8.6.4" part so you can easily switch between versions for other apps

Andy avatar

sorta depends on your use cases and if you’ll have multiple apps or environments

bober2000 avatar
bober2000

just used this module from git directly source = “git://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment.git?ref=master>”

cloudposse/terraform-aws-elastic-beanstalk-environment

Terraform module to provision an AWS Elastic Beanstalk Environment - cloudposse/terraform-aws-elastic-beanstalk-environment

bober2000 avatar
bober2000

so I need to clone repo to localhost and change it there

bober2000 avatar
bober2000

got it

Andy avatar

yup

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

hey @bober2000, welcome

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

@Andy thanks for answering the questions

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

@bober2000 if you want to open a PR to add the settings to the module, we’ll review it

bober2000 avatar
bober2000

@Andriy Knysh (Cloud Posse) sure! Will do this as fast as understood how

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

ok

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

here are the steps that should help you:

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
  1. Fork the repo into your GitHub account

  2. Create a new branch

  3. Modify the code in your branch

Add this

setting {
    namespace = "aws:elasticbeanstalk:container:nodejs"
    name      = "NodeVersion"
    value     = "8.6.4"
  }
 
  1. Test on AWS (terraform plan/apply)

  2. Open a Pull Request against our repo

  3. We review and merge your changes into our repo

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

8.6.4 should be a new variable, e.g. nodejs_version

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
setting {
    namespace = "aws:elasticbeanstalk:container:nodejs"
    name      = "NodeVersion"
    value     = "${var.nodejs_version}"
  }
bober2000 avatar
bober2000

Oh, thanks - I know how to contribute using GitHub - I mean I’m still only newbie in terraform syntax

bober2000 avatar
bober2000

Will add this - thanks for a guide

Andy avatar

Don’t forget to add to variables.tf as well

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

yep

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

and then rebuild README by executing the following commands in the module folder:

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
make init
make readme/deps
make readme
maarten avatar
maarten

Anyone know if there is a terraform module(+lambda) out there for AWS service limit monitoring ?

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

That would be a great one!

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Haven’t seen though…

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

I want a module for billing alerts too

GFox (someTXcloudGuy) avatar
GFox (someTXcloudGuy)

My requirement is to not to delete and not even trying to delete, since S3 is the backend. Currently it’s trying to delete and failing since versioning is enabled. Was trying to set a deletion policy to “retain” (S3) running terraform. (moot) Was wondering if there is option to tell terraform not to delete backend S3 ??

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

@GFox (someTXcloudGuy) can you add some additional context? sounds like you might be talking about the terraform-aws-tfstate-backend module?

GFox (someTXcloudGuy) avatar
GFox (someTXcloudGuy)

Thank you @Erik Osterman (Cloud Posse), working on it, I’m not an aws guy yet, more azure and openstack, but helping a friend right now, while l’m reading up looking into it, and, when I get a better picture, will def ping you back

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Aha then yes there are a few options

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Sorry, I see now more clear what you are asking

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

So when you create the bucket resource you will want to add a lifecycle block that says prevent destroy

1
Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

@GFox (someTXcloudGuy) you need to put tfstate-backend into a separate folder, provision it using TF local state, then import the state into the tfstate-backend bucket

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-root-modules

Collection of Terraform root module invocations for provisioning reference architectures - cloudposse/terraform-root-modules

1
Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

all other modules are in different folders, so when you run terraform destroy on them, TF will not attemp to destroy the state bucket

GFox (someTXcloudGuy) avatar
GFox (someTXcloudGuy)

wow, quick responses, great help and great stuff

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
1
bober2000 avatar
bober2000

@Andriy Knysh (Cloud Posse) PR for adding NodeJS version select https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment/pull/50

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Left 1 comment

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

@bober2000 LGTM thanks. Just rebuild README

bober2000 avatar
bober2000

@Erik Osterman (Cloud Posse) @Andriy Knysh (Cloud Posse) README ready, linting too

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

thanks! waiting on @Andriy Knysh (Cloud Posse) for final approval

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

@bober2000 merged to master. Thanks for the PR!

dan avatar

Thanks for the help here on the terraform-aws-ecs-web-app ECR issue a few days ago!

I’m now wondering if I’ve misunderstood the use-case for the module. Is it ok to have the instances it defines live on a public subnet? The only way to specify the subnets is via ecs_private_subnet_ids, which leads me to believe it should only be used on private subnets. In my use-case, the containers need internet access. When I look under the hood, I don’t see any reason for the “private” qualifier. Is it just a poorly-named variable?

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

it was designed with the expectation that the tasks are on a private subnet

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

which means your VPC needs a NAT gateway to reach the internet

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

have you seen our VPC and subnet modules? Those will take care of it

dan avatar

Ah, thanks. Will look now.

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

(though I suppose it will just work if you give it public subnet IDs)

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

even though it’s called private_... (just a hunch)

dan avatar

that’s what I was hoping for. Will report back.

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

if not, and you want to submit a PR, will review it promptly

2018-10-12

bober2000 avatar
bober2000

Hi again. When trying to

terraform destroy

I’m getting several errors: module.elastic_beanstalk_environment.aws_s3_bucket.elb_logs (destroy): 1 error(s) occurred: aws_s3_bucket.elb_logs: error deleting S3 Bucket (develop-dev-vitaliimorvaniukdev-logs): BucketNotEmpty: The bucket you tried to delete is not empty status code: 409 module.dev_front_end.module.logs.aws_s3_bucket.default (destroy): 1 error(s) occurred: aws_s3_bucket.default: error deleting S3 Bucket (develop-dev-front-dev-vitalii.morvaniuk-dev-logs): BucketNotEmpty: The bucket you tried to delete is not empty. You must delete all versions in the bucket. status code: 409

force_destroy = true 

is setted

bober2000 avatar
bober2000

what should I check ?

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

was force_destroy = true set from the very beginning?

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

oh, this is a tricky thing i discovered a few months ago.

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

if you change force_destroy = true but do not terraform apply, it doesn’t register

1
maarten avatar
maarten

@bober2000 and if the rest has been deleted already, best is to do a terraform apply_target on module.elastic_beanstalk_environment.aws_s3_bucket.elb_logs with the force_destroy = true option. And then the destroy again.

bober2000 avatar
bober2000

Yes force_destroy = true was set from the beginning

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

maarten avatar
maarten

[empty bucket]-button

bober2000 avatar
bober2000
10:10:20 AM

Its what I’m doing now - but I’d like it to be deleted automatically

[empty bucket]-button

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

i’m not quite sure what to look into

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

in older versions of terraform, it was common that versions weren’t force deleted

bober2000 avatar
bober2000

terraform –version Terraform v0.11.7

  • provider.aws v1.40.0
  • provider.null v1.0.0
maarten avatar
maarten
Error deleting S3 Bucket with Versioning Enabled: BucketNotEmpty · Issue #208 · terraform-providers/terraform-provider-aws

This issue was originally opened by @osterman as hashicorp/terraform#7854. It was migrated here as part of the provider split. The original body of the issue is below. Terraform Version Terraform v…

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

but that’s been working for me as of relatively recently - using our terraform-aws-tfstate-backend module which has versions

maarten avatar
maarten

Erik, you have a long history of tf issues

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

hah, that’s ironic

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

since v0.6.16

maarten avatar
maarten

its more tragic hehe, it’s super old

bober2000 avatar
bober2000

Ok, one more question - I need to add RDS instance to my beanstalk environment - as far as I see there are no option for this - should I do it separatly and after that add something like this:

setting {
    namespace = "aws:elasticbeanstalk:application:environment"
    name = "RDS_USERNAME"
    value = "${aws_db_instance.rds-app-prod.username}"
  }
  setting {
    namespace = "aws:elasticbeanstalk:application:environment"
    name = "RDS_PASSWORD"
    value = "${aws_db_instance.rds-app-prod.password}"
  }
  setting {
    namespace = "aws:elasticbeanstalk:application:environment"
    name = "RDS_DATABASE"
    value = "mydb"
    value = "${aws_db_instance.rds-app-prod.name}"
  }
  setting {
    namespace = "aws:elasticbeanstalk:application:environment"
    name = "RDS_HOSTNAME"
    value = "${aws_db_instance.rds-app-prod.endpoint}"
  }
Andy avatar
Do not associate RDS instance with Beanstalk environment – Un blog sur tout et rien

Discuss about some pros and cons of associating a RDS instance with an Elastic Beanstalk environment

2
Andy avatar

And then just pass RDS Hostname username/password etc as variables to the environment

bober2000 avatar
bober2000

Ok, thanks

Andy avatar

https://github.com/cloudposse/terraform-aws-rds so something like that and then you can use the outputs

cloudposse/terraform-aws-rds

Terraform module to provision AWS RDS instances. Contribute to cloudposse/terraform-aws-rds development by creating an account on GitHub.

2018-10-15

Miguel Mendez avatar
Miguel Mendez

First let me say thanks for contributing great terraform modules. I have a question though. I need a simple redis elastic cache cluster. I have looked at https://github.com/cloudposse/terraform-aws-elasticache-redis but this seems to be geared towards clusters with replication such as https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Replication.Redis.Groups.html#Replication.Redis.Groups.Cluster. Is this correct or my assumptions are wrong? Thanks in advance for any feedback.

cloudposse/terraform-aws-elasticache-redis

Terraform module to provision an ElastiCache Redis Cluster - cloudposse/terraform-aws-elasticache-redis

Understanding Redis Replication - Amazon ElastiCache for Redis

Each shard in a replication group has a single read/write primary node and up to 5 read-only replica nodes.

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

hey @Miguel Mendez

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
AWS: aws_elasticache_cluster - Terraform by HashiCorp

Provides an ElastiCache Cluster resource.

Miguel Mendez avatar
Miguel Mendez

OK, any plans supporting it?

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Most of our modules are driven either by client engagements or community contributions. As of right now, we don’t have any clients asking for it :-)

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

We are really good about promptly reviewing PRs and nearly accept all contributions. If you’re interested, please take a stab at it!

Miguel Mendez avatar
Miguel Mendez

OK great. I will create then a module and submit a PR. Thanks once again for your contributions.

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Awesome @Miguel Mendez ! Thanks for taking a look at it

nicgrayson avatar
nicgrayson

Hey all, I’m trying to get https://github.com/cloudposse/terraform-aws-eks-cluster to work. No nodes are showing up when i do kubectl get nodes. The userdata log on the instance looks fine.

cloudposse/terraform-aws-eks-cluster

Terraform module for provisioning an EKS cluster. Contribute to cloudposse/terraform-aws-eks-cluster development by creating an account on GitHub.

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

@nicgrayson did @Andriy Knysh (Cloud Posse) share the reference implementation?

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-root-modules

Collection of Terraform root module invocations for provisioning reference architectures - cloudposse/terraform-root-modules

nicgrayson avatar
nicgrayson

I’m using tf from the readme

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

^ what we deployed and tested

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

you need to apply the ConfigMap for the worker nodes to join the cluster

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-root-modules

Collection of Terraform root module invocations for provisioning reference architectures - cloudposse/terraform-root-modules

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

(EKS does not do it automatically)

nicgrayson avatar
nicgrayson

ah okay thanks

nicgrayson avatar
nicgrayson

Worked like a charm

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

nice

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

let us know if any issues

2018-10-16

bober2000 avatar
bober2000

Hi all. I’m trying to create RDS instance using https://github.com/cloudposse/terraform-aws-rds

module "elastic_beanstalk_rds" {
  source      = "git::<https://github.com/cloudposse/terraform-aws-rds.git?ref=master>"
  namespace   = "${var.namespace}"
  stage       = "${var.environment}"
  name        = "${var.user_account_name}"
  dns_zone_id = "${var.parent_zone_id}"
  host_name                   = "db"
  security_group_ids          = ["${module.vpc.vpc_default_security_group_id}"]
  database_name               = "app"
  database_user               = "admin"
  database_password           = "password"
  database_port               = 5432
  multi_az                    = "false"
  storage_type                = "gp2"
  allocated_storage           = "5"
  engine                      = "postgresql"
  engine_version              = "9.6.6"
  instance_class              = "db.t2.micro"
  db_parameter_group          = "default.postgres9.6"
  #parameter_group_name        = "default.postgres9.6"
cloudposse/terraform-aws-rds

Terraform module to provision AWS RDS instances. Contribute to cloudposse/terraform-aws-rds development by creating an account on GitHub.

bober2000 avatar
bober2000

But getting

module.elastic_beanstalk_rds.aws_db_instance.default: Resource 'aws_db_parameter_group.default' does not have attribute 'name' for variable 'aws_db_parameter_group.default.*.name'

error

bober2000 avatar
bober2000

what I’m doing wrong ?

jarv avatar

try passing a list instead

jarv avatar

see if that works, unfamiliar with the module but might point you in the right direction if so

jarv avatar

er hm, likely from the commented out parameter_group_name

jarv avatar

looks like it’s checking for the length of that here: https://github.com/cloudposse/terraform-aws-rds/blob/master/main.tf#L54

cloudposse/terraform-aws-rds

Terraform module to provision AWS RDS instances. Contribute to cloudposse/terraform-aws-rds development by creating an account on GitHub.

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

hey @bober2000 and @jarv

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

if parameter_group_name is not provided, the default is "" (empty string)

1
Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

it looks like a race condition

jarv avatar

oh, hm didn’t see that.. ~so guess just a depends_on should prevent that as well~an ignore this suggestion probably, think I need more sleep

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

looks like it’s the ‘famous’ issue with TF counts after the latest release (count expressions have been changed)

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

@bober2000 can you try the previous release source = "git::<https://github.com/cloudposse/terraform-aws-rds.git?ref=tag/0.4.0>"

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

that one was working for a long time

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

and we’ll look into the issue with the latest release 0.4.1

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

also, don’t use master in your code (git::<https://github.com/cloudposse/terraform-aws-rds.git?ref=master>), always pin to a release (for all modules). Modules get changed and there is a possibility of regression

bober2000 avatar
bober2000

thanks for tips - will try

shaiss avatar

does anyone have an example for using the event selector in the cloudtrail module? https://registry.terraform.io/modules/cloudposse/cloudtrail/aws/0.5.0?tab=inputs trying to capture all S3 events https://www.terraform.io/docs/providers/aws/r/cloudtrail.html#event_selector

AWS: cloudtrail - Terraform by HashiCorp

Provides a CloudTrail resource.

markmutti avatar
markmutti

@shaiss That doc references the Terraform “cloudtrail” resource here:

event_selector
Description: Specifies an event selector for enabling data event logging, It needs to be a list of map values. See: <https://www.terraform.io/docs/providers/aws/r/cloudtrail.html> for details on this map variable
Default: []

I happen to be using that Terraform resource and am using the one from this example: https://www.terraform.io/docs/providers/aws/r/cloudtrail.html#logging-all-s3-bucket-object-events

AWS: cloudtrail - Terraform by HashiCorp

Provides a CloudTrail resource.

markmutti avatar
markmutti

@shaiss (It’s possible you already know this and that I’ve been no help at all. Hopefully not the case)

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

thanks @markmutti

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

@shaiss let us know if it’s working for you

shaiss avatar

@markmutti I’ll chk your link. thx @Andriy Knysh (Cloud Posse) I stepped away for lunch. Belly full, I’m now ready to get back to coding

shaiss avatar

@markmutti so I get the example of using the map that’s listed in your link IF I was using the default/built in resource “aws_cloudtrail”. However, I’m trying to use the cloudposse cloudtrail module which wants a list for event_selector, not a map. This is where I’m banging my head

shaiss avatar

ie. event_selector = {[data_resource = “AWS::Object”]}

my syntax is probably wrong

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

@shaiss try this

event_selector = [{
    read_write_type = "All"
    include_management_events = true

    data_resource {
      type   = "AWS::S3::Object"
      values = ["arn:aws:s3:::"]
    }
  }]
Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

i guess it was changed to be a list in the last commit so many event selectors could be specified

shaiss avatar

@Andriy Knysh (Cloud Posse) nope: **

shaiss avatar

Error: module.cloudtrail.aws_cloudtrail.default: event_selector.0.data_resource: should be a list

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
Changed event selector to a list, so that it can be supplied as a list with a map by Jamie-BitFlight · Pull Request #13 · cloudposse/terraform-aws-cloudtrail

what Change the event_selector var from a map to a list type. why It is currently a type map, that then gets put inside a list. Even though it is a null map by default, because it is embedded int…

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

if not working, try the previous release (which was tested)

shaiss avatar

ok, let me try that now

shaiss avatar

0.4.2 of the cloudtrail module still gives the same “should be a list” error

shaiss avatar

same w/ 0.4.1

shaiss avatar
module "cloudtrail" {
  source  = "cloudposse/cloudtrail/aws"
  version = "0.4.2"

  name          = "${var.cloudtrailbucket["name"]}"
  stage         = "${var.cloudtrailbucket["stage"]}"
  namespace     = "${var.cloudtrailbucket["namespace"]}"
  s3_bucket_name    = "${module.cloudtrail-s3-bucket.bucket_id}"
  event_selector = [{
    read_write_type = "All"
    include_management_events = true

    data_resource {
      type   = "AWS::S3::Object"
      values = ["arn:aws:s3:::"]
    }
  }]
}
Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

the code above generates “should be a list” error?

shaiss avatar

yep

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

i’ll try to reproduce and fix the issue when I get some spare time

dan avatar

has anyone here used the terraform-aws-alb and terraform-aws-alb-ingress modules to configure a load balancer to redirect http to https? It’s an obvious option when adding an ingress rule via the AWS UI, but I’m lost finding the equivalent option in the cloudposse modules. I feel like I’m missing something simple…

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

@dan we don’t have this implemented right now. @Ryan Ryke wanted the same thing. Not sure what he ended up doing.

dan avatar

@Erik Osterman (Cloud Posse) good to know - thanks

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Looks like support for this was released in August (after our first look at it)

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
Add support for 'redirect' and 'fixed-response' into lb_listener_rule action type · Issue #5344 · terraform-providers/terraform-provider-aws

Community Note Please vote on this issue by adding a reaction to the original issue to help the community and maintainers prioritize this request Please do not leave &quot;+1&quot; or &quot;me to…

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)


Support for fixed-response and redirect actions has been merged into master via #5430 and will release with version 1.33.0 of the AWS provider, later this week. (August 20)

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

@dan if you get a chance to implemented, we would love a PR

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
resource "aws_lb_listener" "front_end" {
  load_balancer_arn = "${aws_lb.front_end.arn}"
  port              = "80"
  protocol          = "HTTP"

  default_action {
    type = "redirect"
    redirect {
      port = "443"
      protocol = "HTTPS"
      status_code = "HTTP_301"
    }
  }
}
Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

@dan

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

@LeoGmad I think you guys might dig this too….

LeoGmad avatar
LeoGmad
12:46:36 AM

@LeoGmad has joined the channel

Ryan Ryke avatar
Ryan Ryke

yeah, i would be interested in that. i can try and put a pr in this weekend. for now they are handling it inside the container

Ryan Ryke avatar
Ryan Ryke

not totally sure how you would implement it though

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

@Ryan Ryke I think we would add this to the terraform-aws-alb module

resource "aws_lb_listener" "https_redirect" {
  count = "${var.https_redirect_enabled == "true" ? 1 : 0}"
.... # code from above
}

Somewhere here. https://github.com/cloudposse/terraform-aws-alb/blob/master/main.tf#L27

And then a ternary here to select the appropriate ARNs: https://github.com/cloudposse/terraform-aws-alb/blob/master/outputs.tf#L38

cloudposse/terraform-aws-alb

Terraform module to provision a standard ALB for HTTP/HTTP traffic - cloudposse/terraform-aws-alb

cloudposse/terraform-aws-alb

Terraform module to provision a standard ALB for HTTP/HTTP traffic - cloudposse/terraform-aws-alb

Ryan Ryke avatar
Ryan Ryke

ahh right something like that might make sense

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

(or maybe return 0 ARNs for HTTP if redirect enabled)

Ryan Ryke avatar
Ryan Ryke

when is .12 coming out?

Ryan Ryke avatar
Ryan Ryke

maybe hashiconf?

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

yea, that’s my expectation

2018-10-17

ff avatar

quick one

ff avatar

let’s say I want to only deploy your beautiful jenkins terraform solution

ff avatar

what is a good practice to start?

ff avatar

copy the main.tf from the examples folder to the root of the project and run terraform init .. plan .. apply?

ff avatar

I wasnt able to find that skimming the readme

ff avatar
cloudposse/terraform-aws-jenkins

Terraform module to build Docker image with Jenkins, save it to an ECR repo, and deploy to Elastic Beanstalk running Docker stack - cloudposse/terraform-aws-jenkins

ff avatar

for now I created a deploy folder and run terraform init deploy/ etc.

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

hey @ff

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

so I think you already have your project structure similar to this https://github.com/cloudposse/terraform-root-modules/tree/master/aws

cloudposse/terraform-root-modules

Collection of Terraform root module invocations for provisioning reference architectures - cloudposse/terraform-root-modules

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

each app/module should be in a separate folder

ff avatar

got it

ff avatar

ah I see

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

you add for example jenkins folder

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

and copy our example in there

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

then cd to the folder and run terraform plan/apply

ff avatar

thanks that was the hint I was missing

ff avatar

back to work

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

1 sec

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

and pin all modules to a release

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

don’t use master

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-root-modules

Collection of Terraform root module invocations for provisioning reference architectures - cloudposse/terraform-root-modules

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

master can be changed/updated and there is a possibility to introduce regression

ff avatar

got it

ff avatar

this is awesome stuff … how did we infrastructure back in the 2000s

ff avatar

or even further back

markmutti avatar
markmutti

@ff That is terrifying to think about. We did it very badly.

ff avatar

lots of metal and cables

ff avatar

and sometimes even documentation

markmutti avatar
markmutti

Oh man, and SSHing into a million machines to apply patches, config drift, you name it

maarten avatar
maarten

or DRBD

2018-10-18

ff avatar

hey again… making some progress with the jenkins-terraform

ff avatar

ending up here

ff avatar
ff
12:40:56 PM
ff avatar

I already learned about the other issue with the empty value for the github auth token and added a - in the value as described in https://github.com/cloudposse/terraform-aws-jenkins/issues/11

Terraform plan: Asking variables that are not described in the README · Issue #11 · cloudposse/terraform-aws-jenkins

Hi, I&#39;ve just cloned the repo to test it and I&#39;m following the doc, however, it is asking for more variables than it is described. My steps were: git clone terraform init terraform plan It …

ff avatar

but here is a dead end. I don’t see a name tag either. Please advise

ff avatar

I now worked - it was obvious after asking the question here - using another tag name and value (before: Terraform = “true”, after Department = “abc”)

ff avatar

whatever

ff avatar

It only works once. Once the tag has been set, the next run fails.

ff avatar
ff
01:10:16 PM

this is my config - please help, I am at a dead end

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

hey @ff what’s exactly are you seeing? terraform apply first time works, but second time fails?

ff avatar

if I change the tags, it works once again

ff avatar

by the way, just filed a pull request - it only worked with a personal access token instead of “-”

ff avatar
Update Dockerfile by nodomain · Pull Request #14 · cloudposse/jenkins

Updated to latest Jenkins version since there were a lot of notifications regarding security issues etc.

Ryan Ryke avatar
Ryan Ryke

anyone have a good read replica module

Ryan Ryke avatar
Ryan Ryke

rds read replica

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

@Ryan Ryke hrmmm I believe we recently made some fixes to support this use-case

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Trying to remember who here was working in that

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

@Andriy Knysh (Cloud Posse) do you remember who?

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

Gladly?

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Daren gave us the example code that they used, but it was to help someone else

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

Let me check

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
resource "aws_db_subnet_group" "replica" {
  name       = "replica"
  subnet_ids = ["xxxxxxx", "xxxxxxx", "xxxxxx"]
}

resource "aws_kms_key" "repica" {
  deletion_window_in_days = 10
  enable_key_rotation     = true
}

resource "aws_db_instance" "replica" {
  identifier                  = "replica"
  replicate_source_db         = "${var.source_db_identifier}"
  instance_class              = "${var.instance_class}"
  db_subnet_group_name        = "${aws_db_subnet_group.replica.name}"
  storage_type                = "io1"
  iops                        = 1000
  monitoring_interval         = "0"
  port                        = 5432
  kms_key_id                  = "${aws_kms_key.repica.arn}"
  storage_encrypted           = true
  publicly_accessible         = false
  auto_minor_version_upgrade  = true
  allow_major_version_upgrade = true
  skip_final_snapshot         = true
}
Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Here’s the link to the discussion

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Maybe some more juice there

Ryan Ryke avatar
Ryan Ryke

right, so no module just a raw resource

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

@Erik Osterman (Cloud Posse) we helped Gladly with this module terraform-aws-rds-replica-vpc

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

they have it, but it’s not public

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Yea, so IMO not sure it makes sense to have a module for it

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

This customer created a private module that does this by creating a vpc, subnet and RDS instance configured as a replica

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

But then that means that vpc should be used basically for nothing else

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

yes, that was mostly for cross-region replica

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

so more complex than prob needed

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

This is good for checking the box on a pci compliance box

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

@Ryan Ryke can you provide the use-case you are solving?

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

@Ryan Ryke if you use Aurora, you don’t need all of that

Ryan Ryke avatar
Ryan Ryke

they just want a read replica in prod

Ryan Ryke avatar
Ryan Ryke

also true

Ryan Ryke avatar
Ryan Ryke

i dont need a module for it

Ryan Ryke avatar
Ryan Ryke

there really isnt a whole lot of tf theere

Ryan Ryke avatar
Ryan Ryke

i modified @Andriy Knysh (Cloud Posse)’s sample and im done

Ryan Ryke avatar
Ryan Ryke

10 minutes

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

replica for plain RDS is mostly useful if you need cross-region replication

Ryan Ryke avatar
Ryan Ryke

agreed, they want to hit a separate endpoint for reporting

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

ok, then you need it

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

why not Aurora? (historical reasons?)

Ryan Ryke avatar
Ryan Ryke

just comfort level for them

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

yea, but Aurora is faster

joshmyers avatar
joshmyers

Terraform and encrypted cross-region read replicas used to be a pain IIRC - not sure if still the case

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

yea, this is much easier now. no jumping through hoops.

joshmyers avatar
joshmyers

Also Aurora you don’t really have to care about storage space again

1
Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
joshmyers avatar
joshmyers
provider/aws: db_instance - Encrypted read-replica in a different region · Issue #518 · terraform-providers/terraform-provider-aws

This issue was originally opened by @gdowmont as hashicorp/terraform#11784. It was migrated here as part of the provider split. The original body of the issue is below. Hi, It would be great if ter…

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

thanks

lvh avatar

is there a cloudposse e2e terraform module that just gets me an ecs cluster I can run some one-off (and scheduled, but not persistent) tasks on? looks like the most plausible public one is https://github.com/arminc/terraform-ecs

arminc/terraform-ecs

AWS ECS terraform module. Contribute to arminc/terraform-ecs development by creating an account on GitHub.

lvh avatar

(or, ya know, start writing your own terraform :))

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

yes/no

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

we’ve taken a more decomposed approach to ECS fargate

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

do you require CI/CD?

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
cloudposse/terraform-aws-ecs-web-app

Terraform module that implements a web app on ECS and supports autoscaling, CI/CD, monitoring, ALB integration, and much more. - cloudposse/terraform-aws-ecs-web-app

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

this module does most of the heavy lifting

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

you give it a vpc and subnets, and it deploys a traditional “webapp”

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

it takes care of setting up the service task, task definition, codebuild, codepipeline, alb rules, autoscaling,etc

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

however, if you have something very simple - where you basically just want “heroku” but on AWS - there’s something else to consider

lvh avatar

Yeah; I saw that one – it seems to do almost everything besides the cluster, and it’s the cluster I’m really after

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

the cluster is a 1-liner

lvh avatar

OTOH what eventually want is a cron job running a container with some persistent storage, so maybe I should just run k8s instead

lvh avatar

the cluster resource itself is a oneliner but the instances in it aren’t, right?

lvh avatar

you still need an autoscaling group and a launch configuration etc

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

oh, we only deal with Fargate

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

lvh avatar

heh that’ll do it – what do you do for persistence in fargate? iirc it doesn’t support docker volumes

lvh avatar

just bind mounts

lvh avatar

and IIRC you can’t make the bind mount just point at an EBS volume you control

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

yea, that’s still a drawback. we’re mostly a kubernetes shop.

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

in an “ideal world” you don’t need the durability in your containers and can offload that to an external backing service ala S3 with object storage

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

but i realize that’s not right for everything

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
lvh avatar

i mean, I can mostly use goofys I think, but it sounds easier to just use k8s + ebs storage in the pod

1
Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

I’m using this for simple off off stuff.

lvh avatar

none of the apps that I’m currently using reallllly want a POSIX fs

lvh avatar

it’s more of a key value store that maybe uses fopen

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

yea, goofys is a hack

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

plus it requires elevated capabilities for fuse

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

not sure if it will work on ECS Fargate

lvh avatar

as a security person I don’t want fuse anywhere near my containers tbh

lvh avatar

OK: you convinced me, time to deploy some k8s

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

we’ve only used goofys as a last resort

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

we have EKS modules too

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

@jsanchez

jsanchez avatar
jsanchez
10:34:03 PM

@jsanchez has joined the channel

2018-10-20

George avatar

Hey guys, thanks for all the work you’ve put into the modules on github, it’s an awesome collection. I’m trying to build out a pipeline to deploy an ecs cluster, and the target group that is created seems to have no targets - I’m having trouble digging through and finding a reason that might cause it. Has anyone run into similar before? I’m using terraform-aws-alb, terraform-aws-ecs-web-app, and terraform-aws-ecs-alb-service-task

George avatar

^ (semi) solved it myself - tasks were never working in the ecs cluster (unable to access my ECR to pull the image, unsure why), so there never were any targets to register. Womp.

2018-10-21

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

@George thanks so much!

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Sounds like you figured it out

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

also, did you see our example buildspec.yaml?

George avatar

I did, wasn’t quite sure how I would integrate it into what I was using

George avatar

(Or if it replaced some or all of the components, aside from the vpc and subnets)

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Hrm… I thought we had a full example somewhere

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

looking

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

here’s a more complete example that helped @Ryan Ryke get up. We really need to add this to our terraform-root-modules

George avatar

I’ll check it when I get back to my machine, thanks for the heads up!

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

cool - just ping me if you’re stuck

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
Configuring Outputs - Terraform by HashiCorp

Outputs define values that will be highlighted to the user when Terraform applies, and can be queried easily using the output command. Output usage is covered in more detail in the getting started guide. This page covers configuration syntax for outputs.

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

TIL:

output "sensitive" {
  sensitive = true
  value     = VALUE
}
Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)


Note that this is mostly useful in the CI scenario as anyone with access to the state can always terraform output or read it directly.

Ryan Ryke avatar
Ryan Ryke

yeah i can help if needed

2018-10-22

ff avatar

Found some weird behaviour and managed to file a new issue even with the current Github outage. https://github.com/cloudposse/terraform-aws-rds-cluster/issues/37

ff avatar

thanks for looking into it

maarten avatar
maarten

@ff try without the availability_zones

ff avatar

It does not accept - it’s a mandatory variable

ff avatar

been there

maarten avatar
maarten

and with availability_zones = []

maarten avatar
maarten
Dropping variable availability_zones ? · Issue #35 · cloudposse/terraform-aws-rds-cluster

Hi, availability_zones is EC2 classic, I believe that the module and the examples will get better if EC2 classic support is dropped. The current examples are mixing EC2 Classic params with VPC para…

ff avatar

stupid me

ff avatar

tryin’

ff avatar

availability_zones.#: “3” => “0” (forces new resource) availability_zones.1126047633: “eu-central-1a” => “” (forces new resource) availability_zones.2903539389: “eu-central-1c” => “” (forces new resource) availability_zones.3658960427: “eu-central-1b” => “” (forces new resource)

ff avatar

and in turn the cluster nodes are also forced new resoruces

maarten avatar
maarten

just remove everything, and create again without az’s

maarten avatar
maarten

then it should work and keep working

ff avatar

Got ya. Testing.

maarten avatar
maarten

ff avatar

first w/o terraform destory

ff avatar

let’s see

ff avatar

thanks for the hint

maarten avatar
maarten

sure np, wanted to do a quick pr, but GH is still suffering it seems

ff avatar

good old single points of failure

ff avatar

will report back in about 15mins when the “apply” has finished

maarten avatar
maarten

haha

ff avatar

does not work

ff avatar

availability_zones.#: “3” => “0” (forces new resource) availability_zones.1126047633: “eu-central-1a” => “” (forces new resource) availability_zones.2903539389: “eu-central-1c” => “” (forces new resource) availability_zones.3658960427: “eu-central-1b” => “” (forces new resource)

ff avatar

availability_zones = []

ff avatar

shall I use a terraform destroy and rebuild the environment?

ff avatar

but should not make a difference I think

ff avatar

so we should be able to actually drop the variable

ff avatar

because I assume that an empty bracket means something else than a non existing variable

maarten avatar
maarten

ah sorry man, i think you’re right

maarten avatar
maarten

@Andriy Knysh (Cloud Posse) do you have thoughts on this

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

Let me check

ff avatar

for the time being I worked around it by using native terraform aws resources

ff avatar

nevertheless I thought it might be helpful to fix this for the community

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Yea, I think we should just drop that variable from the module altogether

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

@ff if we do that, does it fix your problems?

ff avatar

I think so

George avatar

We currently use 0.6 in prod (from before my time) and I’ve been tasked with upgrading to current. State files stored in s3. Anyone got any general guides or info sources on how to go about upgrading? I see projects like terraforming etc, and/or regeneration of state files.

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

terraform 0.6.x -> 0.11.x?

George avatar

(I’ve been tasked with can be read as “hey I wanna do some terraform” “ok here” “no wait wha-“

George avatar

@Erik Osterman (Cloud Posse) yes

George avatar

*0.7 actually, my bad

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

hrm… haven’t had to do that big of a jump

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

most important thing is to backup the state files so you have recourse

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

typically, terraform cli is great about upgrading (never downgrading) tf state

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

there maybe some syntax change, but you’ll be warned by terraform of those

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

objective should be to run a terraform plan and see no changes; however, sometimes terraform changes default values for things in which case you will see changes.

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

i think in the CHANGELOG for every release they publish an upgrade path (if necessary)

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

i would put together some notes after combing though those release notes that can be you run book

George avatar

Hmm, so back up the state files, upgrade terraform binary, and terraform plan until it shows no errors?

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

yea, that’s all I can think of off the top of my head

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

@maarten @jamie any tips?

jamie avatar

yo

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

@George is upgrading some legacy infra from 0.7.x -> 0.11.x; any words of wisdom?

jamie avatar

Wait for 12?

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

HA

George avatar

Lol

jamie avatar

It comes with an upgrade script

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

good point

George avatar

Oh, seriously?

jamie avatar

ya

George avatar

Lemme go investigate

jamie avatar

the jump to 11 breaks a lot of “sloppy” code practices of older versions

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
hashicorp/terraform

Terraform is a tool for building, changing, and combining infrastructure safely and efficiently. - hashicorp/terraform

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

pre-release available!

jamie avatar

11 stopped allowing things like output references that are lists when the lists are empty

jamie avatar

and we spend half of our time working around that with ugly interpolations

jamie avatar

11 also broke ‘count’, so that calculated count values arent allowed in modules

jamie avatar

These things will likely still break in 12, but the fixes are much more elegant

jamie avatar

in terraform 10 you can do

output "the_alb_name" {
value = "${aws_ecs_service.app_with_lb_awsvpc.*.name}"
}
jamie avatar

and if aws_ecs_service.app_with_lb_awsvpc wasn;t created… it calmly shows an empty value

jamie avatar

without crying about it

jamie avatar

in 11, if you want your output to work with an empty list from a resource, then its all:

output "the_alb_name" {
value = "${join("",compact(concat(list(""),aws_ecs_service.app_with_lb_awsvpc.*.name)))}"
}
jamie avatar

to get the same output without an error

George avatar

Hmm, I’ll have to review the erm…state of the current configs we have. Unsure if my predecessor wrote anything that takes advantage of those features. Thanks for the explanation and heads up about 0.12!

jamie avatar

Your predesessor will have taken advantage of them

jamie avatar

since pre 11, that was just how it was done.. in all the terraform examples too

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

thanks @jamie! great summary

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)


11:26 Pacific Daylight TimeWe have resumed webhook delivery and will continue to monitor as we process the backlog of events. <- github

jamie avatar

Ha, thanks Sorry @George I would give you more guidance on upgrade to 0.11, but 0.12 is a breaking change anyway and you might as well just rewrite your code once instead of twice.

jamie avatar

You may also find there is very little to rewrite after the upgrade tool is out as well.

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

I added a #atlantis channel since we’re doing a lot more with it these days (related to runatlantis.io).

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
cloudposse/terraform-null-smtp-mail

Terraform module to send transactional emails via an SMTP server (e.g. mailgun) - cloudposse/terraform-null-smtp-mail

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

hot off the press!

joshmyers avatar
joshmyers

Any plans to include that emailcli into packages?

joshmyers avatar
joshmyers

Nvm @Erik Osterman (Cloud Posse) just seen https://github.com/cloudposse/packages/pull/95

Add emailcli by osterman · Pull Request #95 · cloudposse/packages

what Add 12-factor style email cli why Easily send emails from command line or geodesic shell

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

@vadzim can you review?

Add emailcli by osterman · Pull Request #95 · cloudposse/packages

what Add 12-factor style email cli why Easily send emails from command line or geodesic shell

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

thanks @joshmyers!

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

actually, we have a PR for it already - checking status

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Yea, we’ll get that merged tomorrow probably

2018-10-23

joshmyers avatar
joshmyers

Given you can’t invoke modules with counts and TF isn’t an ideal language as yet, how do you see using/invoking that module? The example mentions creation of users, which I’d imagine is done as a list of vars. A module per user? I see other use cases but was interested in that as I have run into similar use case before.

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

i think we’re going to move away from the list-of-users model

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

and instead do one tf file per user

joshmyers avatar
joshmyers

Agreed that would be more flexible at the moment although I’d hope 0.12 with hcl2 would improve that with rich data structures…

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
Initial implementation by osterman · Pull Request #1 · cloudposse/terraform-aws-iam-user

what Implement a terraform module that provisions an IAM user for humans with a login profile and encrypted password why Support operations by pull request to add users to AWS

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

i’m getting this setup for our demo on thursday

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

IAM user account management with #atlantis

joshmyers avatar
joshmyers

Ahh, nice.

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

so, in this case, would invoke with each user.

joshmyers avatar
joshmyers

I see how that all fits together now

joshmyers avatar
joshmyers

Nice way of doing it

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

what i don’t like is all the vars I have to pass related to smtp

joshmyers avatar
joshmyers

Modules all the way down

joshmyers avatar
joshmyers

You could infer some of them if not otherwise provided, then again…HCL :(

joshmyers avatar
joshmyers

Also, I’m on mobile right now.

loren avatar

heads up, v0.11.10 was just released and the download urls are different… they no longer have the v in the version token… works:

https://releases.hashicorp.com/terraform/0.11.10/terraform_0.11.10_linux_amd64.zip doesn’t work:

https://releases.hashicorp.com/terraform/v0.11.10/terraform_v0.11.10_linux_amd64.zip

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

@loren ugh, thanks for the heads up

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

sucks for our packaging system

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

wonder if that was deliberate on their behalf

loren avatar

Seems like they’re saying that the prior working URLs were an accident? https://github.com/hashicorp/terraform/issues/19163#issuecomment-432310297

Terraform 0.11.9 does not take in account any more the .auto.tfvars · Issue #19163 · hashicorp/terraform

Terraform Version Terraform v0.11.9 + provider.archive v1.1.0 + provider.aws v1.41.0 + provider.null v1.0.0 + provider.random v2.0.0 + provider.template v1.0.0 + provider.tls v1.2.0 Expected Behavi…

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Looks like we dodged the bullet on this one

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
cloudposse/packages

Cloud Posse installer and distribution of native apps, binaries and alpine packages - cloudposse/packages

loren avatar

Nice. I don’t know how I managed to get the other URL into my configs. Blergh.

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

luke - maintainer of #atlantis is joining HashiCorp to work fulltime on the project (announced at HashiConf)

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

btw! if any of you are at hashiconf, reach out here! I know @antonbabenko is there

antonbabenko avatar
antonbabenko

Yes, I am inside the keynote room now

maarten avatar
maarten
Watch Live | HashiConf 2018

We will be live streaming Mitchell Hashimoto and Armon Dadgar’s opening morning keynote on Tuesday, October 23rd. The live stream will start at 9:30am PST and end at 11:00am PST.

maarten avatar
maarten

Hey Anton, how many people are there compared to Amsterdam ?

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)


Terraform collaboration for everyone.

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)


State Storage, Locking, and History. No more state files! Automatically store and access state remotely whenever and wherever you run Terraform. State access is automatically locked during Terraform operations. In the UI, view a history of changes to the state, who made them, and when.

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
HashiCorp Product Announcements at HashiConf 2018

Today at HashiConf 2018 in San Francisco, we are announcing major updates across our entire suite of open source and enterprise products. Our mission…

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
Provider: Helm - Terraform by HashiCorp

The Helm provider is used to deploy software packages in Kubernetes. The provider needs to be configured with the proper credentials before it can be used.

sarkis avatar

I just discovered tfenv - any good/bad experiences with this here? Seems like it is going to be useful with the new 0.12.x version coming up and working with “legacy” terraform.

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

isn’t that in ruby?

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

hate to install that runtime just to switch envs in terraform

sarkis avatar

bash

sarkis avatar
Zordrak/tfenv

Terraform version manager. Contribute to Zordrak/tfenv development by creating an account on GitHub.

sarkis avatar

I think this is less of an issue when doing this all The Right Way™ (using container via geodesic)

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

haha

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

i think tfenv might be helpful initially

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

though i think there’s some way to specify the version compatibility

1
sarkis avatar

in fact things like this just reminds me I need to use geodesic everywhere

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

to support hcl 1 and 2

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

i guess only one or the other will be supported

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

they recommend adding a version constraint on terraform

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

just released https://github.com/cloudposse/terraform-aws-iam-user to manage IAM user account for humans

cloudposse/terraform-aws-iam-user

Terraform Module to provision a basic IAM user suitable for humans. - cloudposse/terraform-aws-iam-user

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

it supports automatically associating the user with a list of groups as well as password generation using pgp+keybase

sarkis avatar

yea so the problem that led me to tfenv - was working with multiple repos/modules with different terraform version constraints

sarkis avatar

also - i was used to the rbenv style of .terraform-version in the root

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

yea

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

yea, given that - i think it’s probably the best alternative

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

i can see where in long-lived environments that managing the terraform versions will be essential and risk to keep everything up to date perhaps

jarv avatar

any project open on the new hcl migration? can probably help out with that if there’s a burn down list. (haven’t been following tf updates just know that was likely going to be released soonish)

1
1
jarv avatar

or maybe just beta.. might try a couple just to dig into the new stuff. haven’t been deep in tf dev in a bit

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

@jarv that would be HUGE

jarv avatar

heh yeah you guy’s have a ton of modules.. was managing 50+ (over time) private repos at previous employer, didn’t have a lot of breaking tf changes during that time but can’t imagine it’s easy

jarv avatar

was very close to going with cloudformation instead after hearing so many 0.6/0.7 horror stories

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

yea, understand the temptation…

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

in the end, would have just been trading pros/cons

jarv avatar

yeah still do a fair bit of cloudformation when it makes sense, don’t mind it. service catalog support is pretty interesting, also if I can reuse any of the aws supported projects without tweaking much that’s a good tradeoff in a tf shop imo

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

i think it’s still too early, but when the time comes, I’ll create a “Terraform Module Upgrade” project and add everything there.

1
Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

will announce that as soon as it’s there.

maarten avatar
maarten

I can also help out, but have a few modules of my own to do first.. but happy to join forces for problem solving ofc.

1
2
Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Thanks guys! we’re going to need the help

sarkis avatar

whoaaaa … @Erik Osterman (Cloud Posse) you see Atlantis team is joining Hashicorp?

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

yea! that’s both scary and exciting

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
sarkis avatar

ah thanks

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

but yea, relevant here too

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

i want to use atlantis for more than terraform

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

but this doesn’t bode well for that roadmap

sarkis avatar

well now there’s github actions

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

yea

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

waiting on invite

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

anyone already have access to github actions?

sarkis avatar

not yet - waiting as well

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

GitHub Actions vs. HashiCorp/Atlantis

jarv avatar

~(possibly) Somewhat related:~oticed systems manager added a wait for user input action. unfamiliar with ssm but was curious if something like terraform ci was one of the use cases for adding thateh not sure that makes sense.. unsure why I was thinking about that now

jarv avatar

guess I was probably thinking ssm because it manages (just?) os state.

maarten avatar
maarten

Shall we create a 0.12 channel so problems & solutions don’t get lost in other talks ?

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

I think it’s a good suggestion

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
Jeremy avatar

Does anyone know of a way to provide multiple SSLCertificateArns for a beanstalk environment that is using an ALB? The name is called SSLCertificatesArns which implies that you can specify multiple arns but I have tried:

setting {
    namespace = "aws:elbv2:listener:443"
    name = "SSLCertificateArns"
    value = "<someArnForFirstCert>"
  }

  setting {
    namespace = "aws:elbv2:listener:443"
    name = "SSLCertificateArns"
    value = "<someArnForSecondCert>"
  }

And also tried:

setting {
    namespace = "aws:elbv2:listener:443"
    name = "SSLCertificateArns"
    value = "<someArnForFirstCert>,<someArnForSecondCert>"
  }

And:

setting {
    namespace = "aws:elbv2:listener:443"
    name = "SSLCertificateArns"
    value = ["<someArnForFirstCert>", "<someArnForSecondCert>"]
  }

Neither of these approaches seems to work correctly and cannot find any other documentation on it other than: https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/command-options-general.html#command-options-general-elbv2-listener

General Options for All Environments - AWS Elastic Beanstalk

Configure globally available options for your Elastic Beanstalk environment.

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Sorry - not sure how to do it, but if you figure it out and need to make some changes - we accept nearly all PRs

maarten avatar
maarten

@Jeremy Looking at the Elastic Beanstalk Documentation it seems that Arns actually refer to just one ARN, maybe they wanted to be prepared future wise. Could you actually add multiple in the AWS Console ? As alternative you could create a new Certificate in ACM with support for multiple domain names, and have just one ARN.

1
Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
Yelp/terraform-provider-gitfile

Terraform provider for checking out git repositories and making changes - Yelp/terraform-provider-gitfile

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

cool idea - too bad not maintained

2018-10-24

praveen avatar
praveen

Hi, I am looking for information on how to source passwords from azure keyvault using remote-exec(terraform). Basically I will have to copy a property file to the server which I will source it from git. I do not want the properties file to have sensitive information like secrets/ passwords. so I would want to append the file to password/secret’s from keyvault in azure platform

praveen avatar
praveen

or either using cloud-init

can I use variable which will query keyvault?

praveen avatar
praveen

@Mark, yes I use key vault. But my question is if I can query keyvault by passing query keyvault variable in remote-exec or cloud-init

maarten avatar
maarten

@praveen what about giving the server access to that keyvault, and retrieve those values at boot ?

praveen avatar
praveen

how can I do that. can I have any example if already done. I mean if there is any ref to git code

maarten avatar
maarten
sozercan/terraform-vm-keyvault

Microsoft Azure Linux VM created with Terraform that uses Azure Key Vault - sozercan/terraform-vm-keyvault

praveen avatar
praveen

I will try this and let you know the result

johncblandii avatar
johncblandii

Could I get some reviews on this PR? https://github.com/EasterSealsBayArea/terraform-aws-elastic-beanstalk-environment/pull/1

It is a fork not going to our master yet (using gitflow; will test/validate it internally from the develop branch with our projects then commit back). I didn’t want to go straight to the official yet without giving it some solid testing.

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

@johncblandii don’t see anything controversial with the PR

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

to rebuild the readme run

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
make init
make readme
johncblandii avatar
johncblandii

i did the readme part but not init. will do that now. thx

johncblandii avatar
johncblandii

oh, that’s the easier way to install everything.

johncblandii avatar
johncblandii

oh…maybe this is needed to be resolved for a full rebuild?

/bin/bash: gomplate: command not found
make: *** [readme/build] Error 127
johncblandii avatar
johncblandii

1 sec

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

oh, looks like we’re missing a dep

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

you can run:

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
make packages/install/gomplate
johncblandii avatar
johncblandii

ahh

johncblandii avatar
johncblandii

pushed

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

make readme/deps

johncblandii avatar
johncblandii

i mistook docs/terraform.md for the readme without even checking the filename

johncblandii avatar
johncblandii

good to know @Andriy Knysh (Cloud Posse)

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

PR looks good to me

johncblandii avatar
johncblandii

cool

johncblandii avatar
johncblandii

will get it tested on our stuff then PR it to your upstream

johncblandii avatar
johncblandii

a few other things will come soon too

johncblandii avatar
johncblandii

sidebar: this .12 stuff in TF will clean up the env vars (for/foreach loops) and settings (null values) tremendously

1
Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

Yea looks like it will be very cool

1
Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

yea, we’re anxiously awaiting #terraform-0_12

1
Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

@johncblandii if you want to help us update the beanstalk module (when the time comes), we’d be grateful

johncblandii avatar
johncblandii

absolutely, @Erik Osterman (Cloud Posse). going to do more updates to help out

johncblandii avatar
johncblandii

we use it heavily (3 envs done and about 20 more; between all stages)

1
Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

@johncblandii any reason you’re not using ECS or Kubernetes?

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

(we found beanstalk deployments to be more flakey in the long run, which is why we have moved to the other systems)

johncblandii avatar
johncblandii

moving there. devops is a small team here so it comes down to time and we have the beanstalk stuff down

johncblandii avatar
johncblandii

and yes…beanstalk deployments……(sigh)

1
Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

LGTM

1

2018-10-25

dan avatar

a bit confused about what to expect of Terraform when using terraform-aws-ecs-web-app. If a new task definition is created, should Terraform automatically redeploy the service with the new definition? I’m currently seeing the new definition show up, but just the old tasks remain running. I guess the question is, should aws ecs update-service be necessary if my terraform-aws-ecs-web-app is configured correctly?

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

the terraform-aws-ecs-web-app module is designed to work with CodeBuild/CodePipeline to automatically deploy changes merged to master.

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

this only works if you add a buildspec.yaml to your projects

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

so, to answer your quesiton, calling aws ecs update-service is not needed if configured correctly

dan avatar

awesome, thanks for the quick help!

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

hope it helps!

johncblandii avatar
johncblandii

How do you guys manage your multi-env settings? Currently we use terragrunt, but that’s going away.

I know we can do tfvar files, but is that the best way? I don’t want to end up doing tf plan -var-file=prod.tfvars and tf plan -var-file=prod.tfvars -var-file=uswest2.tfvars and so on and so forth to separate the vars for reuse across a lot of configs (4 app stages, multi-region, multi-account).

Thoughts?

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

hey @johncblandii, maybe you already saw that, but here is what we do:

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

Although there are many possible ways of doing that, we use containers + ENV vars pattern. As you mentioned, template rendering is another pattern (as implemented in terragrunt).

We store the ENV vars in either AWS SSM (secrets) or in Dockerfiles (not secrets).

Here are more details:

  1. We have a collection of reusable TF modules https://github.com/cloudposse/terraform-root-modules. The modules have no identity, everything is configurable via ENV vars. (In other words, they don’t care where they will be deployed and how).

  2. We deploy each stage (root, prod, staging, dev, testing) in a separate AWS account for security and better management

  3. For each AWS account/stage (root, prod, staging, dev, testing), we have a GitHub repo which is a container (for which we use geodesic https://github.com/cloudposse/geodesic):

https://github.com/cloudposse/root.cloudposse.co https://github.com/cloudposse/prod.cloudposse.co https://github.com/cloudposse/staging.cloudposse.co https://github.com/cloudposse/dev.cloudposse.co https://github.com/cloudposse/testing.cloudposse.co

Not secret ENV vars are defined in the Dockerfiles, e.g. https://github.com/cloudposse/prod.cloudposse.co/blob/master/Dockerfile#L17 In other words, the account containers have identity defined via the ENV vars.

  1. https://github.com/cloudposse/terraform-root-modules is added to the containers https://github.com/cloudposse/prod.cloudposse.co/blob/master/Dockerfile#L36

  2. Inside the containers, users assume IAM roles ro access the corresponding AWS account and then provision TF modules.

  3. Inside the containers we use chamber (https://github.com/segmentio/chamber) to read secrets from SSM (per AWS account)

So when we run a container (e.g. prod), we already have all ENV vars setup, and we read all the secrets from the account SSM store. An account/stage can be in any region (also specified via ENV var, e.g. https://github.com/cloudposse/prod.cloudposse.co/blob/master/Dockerfile#L14)

Take a look at our docs for more details: https://docs.cloudposse.com/reference-architectures/ https://docs.cloudposse.com/reference-architectures/cold-start/ https://docs.cloudposse.com/reference-architectures/notes-on-multiple-aws-accounts/ https://docs.cloudposse.com/geodesic/

johncblandii avatar
johncblandii

going to digest that a bit more but those *.cp repos are containers you run on prod or containers that deploy prod?

johncblandii avatar
johncblandii

thx for the docs. i’ll digest those as well

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

containers that you run on your local computer or on CI/CD

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

inside the containers you run diff commands to deploy TF, Helm, Helmfiles etc.

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

the containers have all ENV vars setup for a particular env (account/stage)

johncblandii avatar
johncblandii

ok, i thought that’s what I was reading. interesting approach

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

so to add new account/stage/env, you create a new GitHub repo with new container specific to that env

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

and define specific ENV vars, and in the Dockerfile copy specific TF modules and helmfiles etc.

johncblandii avatar
johncblandii

good deal. hadn’t thought of that approach

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

this is ideal, but there are no local dev dependencies

1
Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

(other than docker)

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

plus you have an immutable artifact that contains all the tools you need for that version of the infrastructure.

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

so we can use the same tools, processes we use to manage regular apps (e.g. nodejs apps, go apis, etc) with managing the infrastructure as code (terraform).

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

if you don’t mind me asking, why is terragrunt going away?

johncblandii avatar
johncblandii

it is quite verbose when attempting to duplicate a project to another account or region

johncblandii avatar
johncblandii

it is decent for the simple setup and useful for cascading tfvar values, but our directory structure is getting long in the tooth for 4 accounts and 1 region. if we go to 2 regions it’ll be unwieldy. I’m trying to get ahead of that curve

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Okay - would be happy to jump on a zoom screen share and show you how we do it.

johncblandii avatar
johncblandii

you use tg?

johncblandii avatar
johncblandii

i’d love to do that, btw.

johncblandii avatar
johncblandii

or you mean show the above stuff?

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Both actually :-)

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)
johncblandii avatar
johncblandii

good deal. how much time should I select?

johncblandii avatar
johncblandii

went w/ 60. we may not need it but just in case

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Yea that’s perfect

1

2018-10-26

bober2000 avatar
bober2000

Hi all. I still trying to create/destroy beanstalk using

 source    = "git::<https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment.git?ref=tag/0.5.0>"

Option

force_destroy         = true

But getting this

1 error(s) occurred:

* module.dev_front_end.module.logs.aws_s3_bucket.default (destroy): 1 error(s) occurred:

* aws_s3_bucket.default: error deleting S3 Bucket (develop-dev-front-dev-vitalii-logs): BucketNotEmpty: The bucket you tried to delete is not empty. You must delete all versions in the bucket.
        status code: 409, request id: 01B995B9AA71BAC0, host id: KwxTu/DhRRig0CtYmdq0qokvgEgCGDeiUAUB2b4yQna9hmnzWieVdtcSi8aGzg6oF4mk5JRff2s=
bober2000 avatar
bober2000

What is wrong ?

George avatar

Was the bucket created with force destroy set to true?

George avatar
Error deleting S3 Bucket with Versioning Enabled: BucketNotEmpty · Issue #7854 · hashicorp/terraform

Terraform Version Terraform v0.6.16 Affected Resource(s) aws_s3_bucket Terraform Configuration Files resource &quot;aws_s3_bucket&quot; &quot;storage&quot; { bucket = &quot;storage.${var.dns_zone}&…

George avatar

(Also https://stackoverflow.com/questions/49611774/aws-s3-bucket-delete-issue ) last comment mentions lifecycle policy, maybe check that too

aws s3 bucket delete issue

I am deleting bucket from AWS S3 and versioning is enabled, but it’s showing this error: aws_s3_bucket.bucket: Error deleting S3 Bucket: BucketNotEmpty: The bucket you tried to delete is not emp…

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

yea if the bucket was created without force_destroy = true and it was added later, it will not be force destroyed

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

try to apply again and then destroy

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

or destroy manually and then apply with force destroy

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

but looks like the issue is still not solved or just does not work in some cases https://github.com/terraform-providers/terraform-provider-aws/issues/208

Error deleting S3 Bucket with Versioning Enabled: BucketNotEmpty · Issue #208 · terraform-providers/terraform-provider-aws

This issue was originally opened by @osterman as hashicorp/terraform#7854. It was migrated here as part of the provider split. The original body of the issue is below. Terraform Version Terraform v…

bober2000 avatar
bober2000

Yes bucket was created with force_destroy

bober2000 avatar
bober2000

Can I prevent creating bucket for logs ?

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

not in the current version. If you open a PR, we’ll review it

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-aws-elastic-beanstalk-environment

Terraform module to provision an AWS Elastic Beanstalk Environment - cloudposse/terraform-aws-elastic-beanstalk-environment

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
resource "aws_s3_bucket" "elb_logs" {
  count         = "${var.elb_logs_ebnabled == "true" ? 1: 0}"
  bucket        = "${module.label.id}-logs"
  acl           = "private"
  force_destroy = "${var.force_destroy}"
  policy        = "${data.aws_iam_policy_document.elb_logs.json}"
}
Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-aws-elastic-beanstalk-environment

Terraform module to provision an AWS Elastic Beanstalk Environment - cloudposse/terraform-aws-elastic-beanstalk-environment

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-aws-elastic-beanstalk-environment

Terraform module to provision an AWS Elastic Beanstalk Environment - cloudposse/terraform-aws-elastic-beanstalk-environment

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
General Options for All Environments - AWS Elastic Beanstalk

Configure globally available options for your Elastic Beanstalk environment.

johncblandii avatar
johncblandii

I’m fighting the beanstalk env with a silly error about the label. I passed in tags, didn’t pass tags, etc and it keeps giving me fits.

module.sc-api-env-active.module.elastic_beanstalk_environment.module.label.data.null_data_source.tags_as_list_of_maps: data.null_data_source.tags_as_list_of_maps: value of 'count' cannot be computed

Version:

  source = "[email protected]:cloudposse/terraform-aws-elastic-beanstalk-environment.git?ref=0.5.0"
johncblandii avatar
johncblandii

any thoughts?

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-aws-elastic-beanstalk-environment

Terraform module to provision an AWS Elastic Beanstalk Environment - cloudposse/terraform-aws-elastic-beanstalk-environment

johncblandii avatar
johncblandii

yeah

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

the latest versions of null-label added a lot of stuff, but it breaks in complex configurations

johncblandii avatar
johncblandii

i saw the new stuff in there

johncblandii avatar
johncblandii

it got complex pretty quickly

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

so we need to change it to ref=tags/0.3.3 which does not have all that stuff and was working

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-terraform-label

Terraform Module to define a consistent naming convention by (namespace, stage, name, [attributes]) - cloudposse/terraform-terraform-label

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

want to open a PR?

johncblandii avatar
johncblandii

sure. which do you prefer? moving the version back or changing the source?

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

let’s use the latest of git://github.com/cloudposse/terraform-terraform-label.git?ref=tags/0.1.6>

cloudposse/terraform-terraform-label

Terraform Module to define a consistent naming convention by (namespace, stage, name, [attributes]) - cloudposse/terraform-terraform-label

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

we’ll fix the null-label

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

(simplify it)

johncblandii avatar
johncblandii

cool. PR incoming in a sec

johncblandii avatar
johncblandii

testing

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

thanks

johncblandii avatar
johncblandii
Use terraform-terraform-label 0.1.6 for module.label by johncblandii · Pull Request #55 · cloudposse/terraform-aws-elastic-beanstalk-environment

Problem The terraform-null-label grew a bit complex and is throwing errors when used: * module.sc-api-env-active.module.elastic_beanstalk_environment.module.label.data.null_data_source.tags_as_list…

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

tested?

johncblandii avatar
johncblandii

about to test on my module

johncblandii avatar
johncblandii

i tested in the example

johncblandii avatar
johncblandii

Switched to source = "[email protected]:eastersealsbayarea/terraform-aws-elastic-beanstalk-environment.git?ref=53c5aa8"

Plan: 48 to add, 0 to change, 0 to destroy.

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

ok thanks, will merge

johncblandii avatar
johncblandii

coolio

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-aws-elastic-beanstalk-environment

Terraform module to provision an AWS Elastic Beanstalk Environment - cloudposse/terraform-aws-elastic-beanstalk-environment

johncblandii avatar
johncblandii

sweet. thx

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-aws-elastic-beanstalk-environment

Terraform module to provision an AWS Elastic Beanstalk Environment - cloudposse/terraform-aws-elastic-beanstalk-environment

1
johncblandii avatar
johncblandii

have you guys seen an attribute listed in docs but error as an unavailable attribute?

johncblandii avatar
johncblandii

docs clearly say description is an attribute, but it isn’t working when output: https://www.terraform.io/docs/providers/aws/r/elastic_beanstalk_environment.html#description-1

AWS: aws_elastic_beanstalk_environment - Terraform by HashiCorp

Provides an Elastic Beanstalk Environment Resource

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

hmm, we saw something like that for other modules, but not in EB

johncblandii avatar
johncblandii

testing stuff locally

johncblandii avatar
johncblandii

could be some cache issue. it works when i reference the local module

johncblandii avatar
johncblandii

removed it

johncblandii avatar
johncblandii
Feature releases by johncblandii · Pull Request #57 · cloudposse/terraform-aws-elastic-beanstalk-environment

Features EasterSealsBayArea#3 EasterSealsBayArea#2 EasterSealsBayArea#1 Testing Update examples/complete/main.tf’s source to ../../ Plan it Verify the plan completes successfully

johncblandii avatar
johncblandii

pushed a documentation fix

johncblandii avatar
johncblandii

test results added

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

thanks, will review

1
Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

@johncblandii the PR looks good, thanks, just one comment

johncblandii avatar
johncblandii

cool. checking

johncblandii avatar
johncblandii

pushed

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

terraform fmt

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

please run

johncblandii avatar
johncblandii

ugh…meant to do that

johncblandii avatar
johncblandii

i turned off auto-format in VS

johncblandii avatar
johncblandii

it made me lazy to formatting.

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-aws-elastic-beanstalk-environment

Terraform module to provision an AWS Elastic Beanstalk Environment - cloudposse/terraform-aws-elastic-beanstalk-environment

1
Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

thanks

2018-10-27

sarkis avatar

If any gophers or terraform provider authors are around and have some free time - could use a review: https://github.com/terraform-providers/terraform-provider-pagerduty/pull/99

Instantiate scheduled_actions if incident_urgency_rules with type = "use_support_hours" by sarkis · Pull Request #99 · terraform-providers/terraform-provider-pagerduty

This fixes #97, instantiating scheduled actions if use_support_hours incident urgency type is set. It ensures that the pagerduty API calls will include an empty scheduled_actions in certain cases, …

sarkis avatar
sarkis avatar

/cc @Andriy Knysh (Cloud Posse)

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

Haha, I knew that :). Thanks

sarkis avatar

I keep forgetting this is still closed beta , just checked I don’t have access yet - did you manage to get an invite?

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

No not yet

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

@sarkis the PR looks OK to me (as far as I can tel w/o testing anything )

sarkis avatar

Thanks for looking @Andriy Knysh (Cloud Posse)

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

2018-10-29

bober2000 avatar
bober2000

Hi again. I’m still fighting with getting beanstalk and rds work together. Need some help here please:

module "elastic_beanstalk_environment" {
  source    = "git::<https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment.git?ref=tag/0.6.2>"
  namespace = "${var.namespace}"
  stage     = "${var.environment}"
  name      = "${var.user_account_name}"
  zone_id   = "${var.parent_zone_id}"
  app       = "${module.elastic_beanstalk_application.app_name}"


  # associate_public_ip_address = false
  
  instance_type           = "${var.instance_type}"
  autoscale_min           = 1
  autoscale_max           = 4
  updating_min_in_service = 0
  updating_max_batch      = 1
  autoscale_lower_bound   = 20 
  autoscale_upper_bound   = 80 

  updating_max_batch = 1
  updating_min_in_service = 1
  wait_for_ready_timeout = "20m"


 loadbalancer_type      = "application"
  vpc_id                = "${module.vpc.vpc_id}"
  public_subnets        = "${module.subnets.public_subnet_ids}"
  private_subnets       = "${module.subnets.private_subnet_ids}"
  security_groups       = ["${module.vpc.vpc_default_security_group_id}"]
  solution_stack_name   = "64bit Amazon Linux 2018.03 v4.5.3 running Node.js"
  tier                  = "WebServer"
  force_destroy         = true
  keypair               = "${aws_key_pair.dev_ssh_key.key_name}"
  ssh_listener_enabled  = true 
  ssh_listener_port     = "22"
  ssh_source_restriction = "0.0.0.0/0"

  http_listener_enabled = true  ## Enable port 80 (http)
  # instance_refresh_enabled = true ## Enable weekly instance replacement.
  update_level = "minor" ## The highest level of update to apply with managed platform updates
   
  preferred_start_time = "Sun:10:00"
  rolling_update_type = "Health"
  root_volume_size = "10"
  root_volume_type = "gp2"

  setting {
    namespace = "aws:elasticbeanstalk:application:environment"
    name = "RDS_USERNAME"
    value = "${rds_instance.default.database_user}"
  }
  setting {
    namespace = "aws:elasticbeanstalk:application:environment"
    name = "RDS_PASSWORD"
    value = "${rds_instance.default.database_password}"
  }
  setting {
    namespace = "aws:elasticbeanstalk:application:environment"
    name = "RDS_DATABASE"
    value = "${rds_instance.default.name}"
  }
  setting {
    namespace = "aws:elasticbeanstalk:application:environment"
    name = "RDS_HOSTNAME"
    value = "${rds_instance.default.instance_endpoint}"
  }
bober2000 avatar
bober2000

and RDS

module "rds_instance" {
      source                      = "git::<https://github.com/cloudposse/terraform-aws-rds.git?ref=tag/0.4.1>"
      namespace                   = "${var.namespace}"
      stage                       = "${var.environment}"
      name                        = "${var.user_account_name}-db"
      dns_zone_id                 = "${var.parent_zone_id}"
      host_name                   = "db"
      dns_zone_id                 = "${var.parent_zone_id}"
      security_group_ids          = ["${module.vpc.vpc_default_security_group_id}"]
      database_name               = "app_db"
      database_user               = "dbuser"
      database_password           = "password"
      database_port               = 5432
      multi_az                    = "false"
      storage_type                = "gp2"
      allocated_storage           = "5"
      storage_encrypted           = "false"
      engine                      = "postgres"
      engine_version              = "9.6.6"
      instance_class              = "db.t2.micro"
      db_parameter_group          = "postgres9.6"
      #parameter_group_name        = "mysql-5-7"
      publicly_accessible         = "false"
      subnet_ids                  = ["${module.subnets.public_subnet_ids}"]
      vpc_id                      = "${module.vpc.vpc_id}"
      auto_minor_version_upgrade  = "true"
      allow_major_version_upgrade = "false"
      apply_immediately           = "false"
      maintenance_window          = "Mon:03:00-Mon:04:00"
      skip_final_snapshot         = "true"
      copy_tags_to_snapshot       = "true"
      backup_retention_period     = 7
      backup_window               = "22:00-03:00"
bober2000 avatar
bober2000

Getting

Error: module 'elastic_beanstalk_environment': unknown resource 'rds_instance.default' referenced in variable rds_instance.default.database_user
Error: module 'elastic_beanstalk_environment': unknown resource 'rds_instance.default' referenced in variable rds_instance.default.database_password
Error: module 'elastic_beanstalk_environment': unknown resource 'rds_instance.default' referenced in variable rds_instance.default.instance_endpoint
Error: module 'elastic_beanstalk_environment': unknown resource 'rds_instance.default' referenced in variable rds_instance.default.name
Error: module "elastic_beanstalk_environment": "setting" is not a valid argument
bober2000 avatar
bober2000

what I’m doing wrong

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

hey @bober2000

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

so let’s see here

bober2000 avatar
bober2000

I’ve found that I missed value = “${module.rds_instance.database_user}”

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

first, fix the errors in referencing the module value = "${module.rds_instance.default.instance_endpoint}"

bober2000 avatar
bober2000

but now I’m getting only Error: module “elastic_beanstalk_environment”: “setting” is not a valid argument

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

(add module... in front)

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

ok, to provide ENV vars to the elastic beanstalk module, use it like this https://github.com/cloudposse/terraform-aws-jenkins/blob/master/main.tf#L49

cloudposse/terraform-aws-jenkins

Terraform module to build Docker image with Jenkins, save it to an ECR repo, and deploy to Elastic Beanstalk running Docker stack - cloudposse/terraform-aws-jenkins

bober2000 avatar
bober2000

Let me try this

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

(setting is not a valid argument b/c it’s not exposed as var in the current release of the module. We have some PRs and issues opened to do it, we’ll look into that since it would fix some other issues)

bober2000 avatar
bober2000

added

  env_vars = "${
    merge(
      map("RDS_HOSTNAME","${module.rds_instance.instance_endpoint}",
          "RDS_USERNAME","${module.rds_instance.database_user}",
          "RDS_PASSWORD","${module.rds_instance.database_password}",
          "RDS_DATABASE","${module.rds_instance.name}"
          ), env_vars
      )
    }"
bober2000 avatar
bober2000

Now getting Error: module ‘elastic_beanstalk_environment’: “database_user” is not a valid output for module “rds_instance” Error: module ‘elastic_beanstalk_environment’: “name” is not a valid output for module “rds_instance” Error: module ‘elastic_beanstalk_environment’: “database_password” is not a valid output for module “rds_instance

bober2000 avatar
bober2000

Have separate

env_vars

defined previously to set some app staff

bober2000 avatar
bober2000
env_vars = "${
      map(
        "environment", "${var.environment}",
        "namespace", "${var.namespace}",
        "user", "${var.user_account_name}",
        "API_HOST", "${var.api_host}",
 ...
      )
   }"
Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-aws-rds

Terraform module to provision AWS RDS instances. Contribute to cloudposse/terraform-aws-rds development by creating an account on GitHub.

bober2000 avatar
bober2000

HM, than how could I get all staff to connect my app to RDS DB ?

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

database_user and database_password you already know when providing them here https://github.com/cloudposse/terraform-aws-rds/blob/master/variables.tf#L44`

cloudposse/terraform-aws-rds

Terraform module to provision AWS RDS instances. Contribute to cloudposse/terraform-aws-rds development by creating an account on GitHub.

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

so you need user and password (which you know and you provide them to the RDS module and to the EB module as ENV vars)

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-aws-rds

Terraform module to provision AWS RDS instances. Contribute to cloudposse/terraform-aws-rds development by creating an account on GitHub.

bober2000 avatar
bober2000

My fault

bober2000 avatar
bober2000

Thanks for help - all clear now

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

nice

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

then in you app (e.g. NodeJs), you use those ENV vars, like this:

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
function getDbSettings() {
  return (
    {
      host: process.env.DB_HOST,
      database: process.env.DB_NAME,
      user: process.env.DB_USER,
      password: process.env.DB_PASSWORD
    });
}
Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

so you need 4 ENV vars

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
env_vars = "${
      map(
        "DB_HOST", ""${module.rds_instance.instance_endpoint}",
        "DB_NAME", "xxxxxxxx",
        "DB_USER", "xxxxxxxxxx",
        "DB_PASSWORD", "xxxxxxxxx",
      )
   }"
bober2000 avatar
bober2000

Quick question

bober2000 avatar
bober2000

could password be autogenerated ?

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

it could be, it’s outside the module anyway

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

and you can use any script to autogenerate it, even TF like this https://www.terraform.io/docs/providers/random/index.html

Provider: Random - Terraform by HashiCorp

The Random provider is used to generate randomness.

bober2000 avatar
bober2000

How could I incert it in DB_PASSWORD ?

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
Random: random_string - Terraform by HashiCorp

Produces a random string of a length using alphanumeric characters and optionally special characters.

bober2000 avatar
bober2000

Thanks

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
resource "random_string" "password" {
  length = 16
  special = true
  override_special = "/@\" "
}

module "rds_instance" {
      source                      = "git::<https://github.com/cloudposse/terraform-aws-rds.git?ref=tag/0.4.1>"
      namespace                   = "${var.namespace}"
      stage                       = "${var.environment}"
      name                        = "${var.user_account_name}-db"
      dns_zone_id                 = "${var.parent_zone_id}"
      host_name                   = "db"
      dns_zone_id                 = "${var.parent_zone_id}"
      security_group_ids          = ["${module.vpc.vpc_default_security_group_id}"]
      database_name               = "app_db"
      database_user               = "dbuser"
      database_password           = "${random_string.password.result}"
 ....
bober2000 avatar
bober2000

And than use the same

"DB_PASSWORD", "${random_string.password.result}"

in setting envs ?

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

Yes

bober2000 avatar
bober2000

Thanks for help. Will try to contribute to code next week

ALI avatar

hi I am a newbie on terraform, and got a good amount of AWS experience.. I want to know how to start scripting in terraform

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

Welcome @ALI

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

Probably take a look at some modules

ALI avatar

thanks @Andriy Knysh (Cloud Posse)

ALI avatar

yea I am looking at some of the modules .

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

What AWS resources do you want to script?

ALI avatar

I want to script on VPC, EC2 ,Dynamo DB

ALI avatar

for now

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

We have that :)

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

Give me a few minutes

ALI avatar

sure!

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-aws-dynamodb

Terraform module that implements AWS DynamoDB with support for AutoScaling - cloudposse/terraform-aws-dynamodb

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-aws-vpc

Terraform Module that defines a VPC with public/private subnets across multiple AZs with Internet Gateways - cloudposse/terraform-aws-vpc

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-aws-ec2-instance

Terraform Module for providing a general EC2 instance provisioned by Ansible - cloudposse/terraform-aws-ec2-instance

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-aws-ec2-admin-server

Terraform Module for providing a EC2 instance capable of running admin tasks and provisioned by Ansible - cloudposse/terraform-aws-ec2-admin-server

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-aws-ec2-instance-group

Terraform Module for provisioning multiple general purpose EC2 hosts for stateful applications. - cloudposse/terraform-aws-ec2-instance-group

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-aws-dynamic-subnets

Terraform module for public and private subnets provisioning in existing VPC - cloudposse/terraform-aws-dynamic-subnets

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

@ALI take a look at these modules

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-root-modules

Collection of Terraform root module invocations for provisioning reference architectures - cloudposse/terraform-root-modules

pericdaniel avatar
pericdaniel

At first it might be daunting but itll get easier

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

let us know if any questions

ALI avatar

thanks @Andriy Knysh (Cloud Posse)

ALI avatar

haha I will take that @pericdaniel

pericdaniel avatar
pericdaniel

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

@ALI you’ve signed up for a master class in terraform

ALI avatar

I bet @Erik Osterman (Cloud Posse), @Andriy Knysh (Cloud Posse) I will if I am stuck anywhere ..

1
Dombo avatar

How do we all handle modelling the infrastructure within accounts in multi-account architectures? Do you have a declarative file that lists all of it? Some of it? Or do you bundle it all per project and just rely on the knowledge of the team to know what’s live?

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

@Dombo are you referring to our reference architectures or asking generally?

Dombo avatar

Generally - but also reference arch if you want to talk in terms of that

Dombo avatar

I’m interested in how others handle this - I don’t see many mature IaC code bases

Dombo avatar

There are some things that are persistent and not tied to apps like management servers, bastions, VPCs, sec groups, IAM roles/policies/users

Dombo avatar

These are genreally per account

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Agreed - this is how we deploy them

Dombo avatar

Then there are application specfiic deployment dependencies

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

We have been deploying this stuff along side the other platform related services in the account repos. However, we’re in the early stages of using #atlantis to enable applications to have their own terraform/ folder, which defines their dependencies.

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

e.g. if a microservice needs an RDS database, it should be able to define it near the app itself, which out defining it in the account repos.

Dombo avatar

I wonder if you treat them the same or differently?

Dombo avatar

Common modules folder + declarative master stack/.tf file per account + .tf file per project? Where do you track state in both cases? Other ways of tackling this?

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

So we publish all of our reference architectures here: https://cpco.io/reference-architectures

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

high-level, we have one repo (terraform-root-modules) which contain the “root level” terraform module invocations

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

then we have one repo per AWS account. This allows us to easily keep stages separately, but also reuse code between stages in the form of modules.

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

(@Andriy Knysh (Cloud Posse) re-share that thread)

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Andriy explained it pretty well in this thread: https://sweetops.slack.com/archives/CB6GHNLG0/p1540514525000100

Although there are many possible ways of doing that, we use containers + ENV vars pattern. As you mentioned, template rendering is another pattern (as implemented in terragrunt).

We store the ENV vars in either AWS SSM (secrets) or in Dockerfiles (not secrets).

Here are more details:

  1. We have a collection of reusable TF modules https://github.com/cloudposse/terraform-root-modules. The modules have no identity, everything is configurable via ENV vars. (In other words, they don’t care where they will be deployed and how).

  2. We deploy each stage (root, prod, staging, dev, testing) in a separate AWS account for security and better management

  3. For each AWS account/stage (root, prod, staging, dev, testing), we have a GitHub repo which is a container (for which we use geodesic https://github.com/cloudposse/geodesic):

https://github.com/cloudposse/root.cloudposse.co https://github.com/cloudposse/prod.cloudposse.co https://github.com/cloudposse/staging.cloudposse.co https://github.com/cloudposse/dev.cloudposse.co https://github.com/cloudposse/testing.cloudposse.co

Not secret ENV vars are defined in the Dockerfiles, e.g. https://github.com/cloudposse/prod.cloudposse.co/blob/master/Dockerfile#L17 In other words, the account containers have identity defined via the ENV vars.

  1. https://github.com/cloudposse/terraform-root-modules is added to the containers https://github.com/cloudposse/prod.cloudposse.co/blob/master/Dockerfile#L36

  2. Inside the containers, users assume IAM roles ro access the corresponding AWS account and then provision TF modules.

  3. Inside the containers we use chamber (https://github.com/segmentio/chamber) to read secrets from SSM (per AWS account)

So when we run a container (e.g. prod), we already have all ENV vars setup, and we read all the secrets from the account SSM store. An account/stage can be in any region (also specified via ENV var, e.g. https://github.com/cloudposse/prod.cloudposse.co/blob/master/Dockerfile#L14)

Take a look at our docs for more details: https://docs.cloudposse.com/reference-architectures/ https://docs.cloudposse.com/reference-architectures/cold-start/ https://docs.cloudposse.com/reference-architectures/notes-on-multiple-aws-accounts/ https://docs.cloudposse.com/geodesic/

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

thanks @Erik Osterman (Cloud Posse)

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

so yea, the main idea is when a user logs into an account from a geodesic module (let’s say staging), they can’t see and do any damage (even accidentally) to other accounts (root, prod, etc.) - completely separated

Dombo avatar

Of course - I also practice account separation iwth about 15-20 accounts implemented in my org.

Some interesting patterns described in that thread. What do you do about provisioning IAM users/tfstate backing resources?

Dombo avatar

Bootstrap 0 if you will

Dombo avatar

If this is documented somewhere feel free to point me there

Dombo avatar

I know you guys aren’t just here to answer q;s

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

we’re not optimizing for the coldstart right now - as in one command to spin up 20 accounts

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

namely the problem is an order of operations that needs to be performed that terraform is not well suited for, especially if there are any cycles in the graph

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

some of it could be optimized using terragrunt, however, customers seldom if ever start over from scratch again from bootstrap 0

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

we also provision one state bucket per account, rather than a centralized state bucket

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

this is just sticking with our “share nothing” approach, which also convolutes the process of bootstrapping

Dombo avatar

Interesting choice regarding one bucket/dynamo table per account - is there a reason why?

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

share nothing

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

so for example, if you share the state bucket, there’s no way to stage changes to the statebucket without if affecting all stages all at once

Dombo avatar

Hmmm good point

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

but by allowing each stage/account to have their own bucket, they are entirely standalone

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

yea, and we do provision accounts and add users to roles

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-root-modules

Collection of Terraform root module invocations for provisioning reference architectures - cloudposse/terraform-root-modules

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-root-modules

Collection of Terraform root module invocations for provisioning reference architectures - cloudposse/terraform-root-modules

Dombo avatar

Powerful way of doing it

Dombo avatar

Impressed - kudos

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

problem with it is terraform seems to be nudging people to a single shared state bucket

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

and using workspaces

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

we don’t use terraform workspaces

Dombo avatar

Yeah neither do I - not a fan for reasons

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

terraform is also coming out with “managed state as a service” free for all

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

curious to see how that works and fits in

Dombo avatar

Yeah that’s off the back of the atlantis acquisition I presume

Dombo avatar

‘acqusition’

1
Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

i don’t think it’s related persay, but to your point atlantis is big on workspaces

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

and aligned therefore with their trajectory.

Dombo avatar

Doesn’t have to be though - pretty sure you can define the lifecycle as you wish with custom workflows and such

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

yea

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

we have it working without it

Dombo avatar

At which point it could compliment your guys system quite nicely

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

are you using terragrunt?

Dombo avatar

Collaborative plan & release to certain stages

Dombo avatar

terragrunt at work

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

cool

Dombo avatar

atlantis + similar system to yours when consulting in Aus

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

have you seen our fork of atlantis?

Dombo avatar

Yeah I did

Dombo avatar

Just so you could add your own name?

Dombo avatar

hahaha

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

haha

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

actually, have zero interest in maintaining it

Dombo avatar

I wish I could hard fork alexa & google assistant for the same reason

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

just it’s very hard to get features accepted into atlantis right now

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

but luke hears our requests loud and clear and is working to incorporate them

Dombo avatar

Yeah I guess that’s them signalling the future of the project?

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

yea

Dombo avatar

My bet is EOL and roll internal to Hashi

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

heh

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

are you excited about GitHub actions?

Dombo avatar

Reasonably - lots of my customers are on Bitbucket/Gitlab/Self hosted stuff

Dombo avatar

I’m curious to see how it plays out in the community

Dombo avatar

Actions are a direct shot at the best monetised section of githubs partner ecosystem

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

yes, to a degree

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

or it could also be seen as a way of allowing them to have tighter integration with GitHub

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

i see actions evolving into something like Salesforce for GitHub

Dombo avatar

Yeah I’d be interested to see how that integration goes down

Dombo avatar

Good to meet some other people pushing the limits of the modern IAC toolchain

Dombo avatar

Even if you are on the other side of the world

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

thanks!! you’re among friends

Dombo avatar

Anyway it’s the middle of the day over here

Dombo avatar

Gotta get back to work

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

ttyl

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

@Dombo I forgot where you are located?

Dombo avatar

AEST - East Coast Australia

1

2018-10-30

bober2000 avatar
bober2000

Hi, if using terraform-aws-dynamic-subnets what Actions should I allow in policy to make it work? Creating separate user for terraform now and trying to limit access

bober2000 avatar
bober2000

Now getting

module.subnets.aws_eip.default[0]: aws_eip.default.0: UnauthorizedOperation: You are not authorized to perform this operation.

on apply

maarten avatar
maarten

@bober2000 The same logic to Terraform applies to general AWS usage. Limiting the Terraform user is generally not making things easier.

bober2000 avatar
bober2000

@maarten is there any kind of recommendations to read? Idea is to give developers terraform files so they could spin up envs for usage - so I don’t want them to create or destroy something with admin access

maarten avatar
maarten

sure, one moment

maarten avatar
maarten
AWS Multiple Account Security Strategy – AWS Answers

Account-level considerations, best practices, and high-level strategic guidance to help structure and manage multiple AWS accounts for security purposes

maarten avatar
maarten

Most companies do this adding AWS accounts for different purposes like testing.

bober2000 avatar
bober2000

Thanks a lot.

maarten avatar
maarten

Sure man, good luck

bober2000 avatar
bober2000

After reading those article I see that I really need it…

shaiss avatar

this isn’t sweetops specific, but hoping someone here can give me some insight. I’m using resource “aws_iam_user_policy” and getting a limit error “Error putting IAM user policy CloudCheckr_RO: LimitExceeded: Maximum policy size of 2048” when running terraform apply. But I can create this policy just fine in the console

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

hey @shaiss

shaiss avatar

Hi @Andriy Knysh (Cloud Posse) looks like it’s an AWS limit https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html. odd that it works in the console though

Limitations on IAM Entities and Objects - AWS Identity and Access Management

Describes the maximum number, size, and name limits of entities such as users, groups, roles, policies, keys, certificates, and MFA devices in AWS Identity and Access Management (IAM).

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

you create exactly the same policy in the console?

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

it’s better not to attach policies to individual users

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

use groups instead

shaiss avatar

yes, I’m aware, this a requirment of a customer

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

the limit for a group is higher

maarten avatar
maarten

Or create a customer managed policy and attach that one.

shaiss avatar

yes, that will be my suggestion to them again, but they claim they don’t need to b/c they can create that policy in the console

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

yea, we can create everything in the console

maarten avatar
maarten

Maybe Terraform has pre-flight checks which aren’t valid, or calculates differently from AWS.

maarten avatar
maarten

Like AWS does not count spaces of the document and Terraform does.

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)


IAM does not count white space when calculating the size of a policy against these limitations

shaiss avatar

seems like the policy is 6850 bytes, or 4230 if ignore whitespaces

shaiss avatar

so either way, it should technically fail since it’s over the 2048 limit

maarten avatar
maarten

Where did you read that ?

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

so maybe you could break it into a few aws_iam_user_policy(s) @shaiss

shaiss avatar

@Andriy Knysh (Cloud Posse) yeah, that’s a good option!

maarten avatar
maarten

or

maarten avatar
maarten

take this as input for your iam_user_policy “${replace(data.template_file.init.rendered,”/\s/”,”” )}”

shaiss avatar

@maarten sorry, not sure I’m following. atm, I’m going to try creating the policy as an IAM policy vs the iam_user_policy, then attaching it to the user, we’ll see if that works

maarten avatar
maarten

sure, what ever works for you.

shaiss avatar

ha, that worked

shaiss avatar

I agree not the best way to do it, but it worked, and it’ll have to do for now

maarten avatar
maarten

what did you try now ?

shaiss avatar

@maarten I created the user, created the iam policy, then attached the iam policy to the user. b/c it’s a generic iam policy and not a user policy, that limit doesn’t imply

shaiss avatar

*apply

shaiss avatar

Anyone here using terraform w/ a marketplace ami? Seems like you have to use the we console to subscribe to the marketplace item first b4 you can call it from TF

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

Yes that’s correct. We use terraform with pfSense firewall Ami from market place

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

I believe we first had to activate the subscription

Erik Osterman (Cloud Posse) avatar
Erik Osterman (Cloud Posse)

We didn’t attempt to automate market place subscriptions. This was more than a year ago. Not sure if it is possible.

i5okie avatar

hi, any plans to add support for ssl negotiating policy to the terraform-aws-elastic-beanstalk-environment module? (https://www.terraform.io/docs/providers/aws/r/lb_ssl_negotiation_policy.html)

AWS: aws_lb_ssl_negotiation_policy - Terraform by HashiCorp

Provides a load balancer SSL negotiation policy, which allows an ELB to control which ciphers and protocols are supported during SSL negotiations between a client and a load balancer.

i5okie avatar

or to specify an existing aws policy?

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

@i5okie if you open a PR, we’ll promptly review

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

thanks

i5okie avatar

alrighty. was just wondering. thanks

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

thank you for pointing that out, nice addition to the module

2018-10-31

Kenny Inggs avatar
Kenny Inggs

I have a question related to https://github.com/cloudposse/terraform-aws-route53-cluster-zone. How do you deal with the “production” stage + zones? Typically, I’d have a zone for “dev” (e.g. dev.example.com, containing e.g. api.dev.example.com), and have the prod zone on the apex (example.com containing e.g. api.example.com). I’m wondering whether you guys do something like creating a prod.example.com zone, with Alias in the parent / apex zone? Or how else do you deal with the prod stage to apex mapping?

cloudposse/terraform-aws-route53-cluster-zone

Terraform module to easily define consistent cluster domains on Route53 (e.g. [prod.ourcompany.com](http://prod.ourcompany.com)) - cloudposse/terraform-aws-route53-cluster-zone

Kenny Inggs avatar
Kenny Inggs

(this is particularly relevant on public, customer facing URLs in the prod zone. where you don’t want them to see prod. in every URL. Like websites or public API endpoints)

Kenny Inggs avatar
Kenny Inggs

p.s. I also typically have a “global” stage or something similar that will have my MX, SPF and DKIM records.

bober2000 avatar
bober2000

Hi all

bober2000 avatar
bober2000

Having problems on terraform init

Error downloading modules: Error loading modules: error downloading '<https://github.com/cloudposse/terraform-aws-s3-website.git?ref=tag/0.5.3>': /usr/bin/git exited with 1: error: pathspec 'tag/0.5.3' did not match any file(s) known to git.
bober2000 avatar
bober2000

How to correctly set revision ?

bober2000 avatar
bober2000
source              = "git::<https://github.com/cloudposse/terraform-aws-dynamic-subnets.git?ref=tag/0.3.7>"
cloudposse/terraform-aws-dynamic-subnets

Terraform module for public and private subnets provisioning in existing VPC - cloudposse/terraform-aws-dynamic-subnets

bober2000 avatar
bober2000

or

 source = "github.com/cloudposse/terraform-aws-dynamic-subnets/releases/tag/0.3.7"
Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

@Kenny Inggs it’s depends on a use case and a customer. We usually have two cases here:

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
  1. Use subdomains for stages (prod.example.net, staging.example.net), and use an alias or CNAME from the public domain (e.g. example.com) to the prod stage (CNAME prod.example.net for example.com)
Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
  1. The same as #1, but using diff TLDs for stages, e.g. [example.net](http://example.net) for prod and [example.qa](http://example.qa) for staging. Then CNAME for [example.com](http://example.com) pointing to [example.net](http://example.net)
Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

all MX, SPF and DKIM records are in the global/public domain

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-aws-s3-website

Terraform Module for Creating S3 backed Websites and Route53 DNS - cloudposse/terraform-aws-s3-website

Kenny Inggs avatar
Kenny Inggs

Awesome. Thanks @Andriy Knysh (Cloud Posse)

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

np

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

@bober2000 are you missing git:: in front of <https://github.com/cloudposse/terraform-aws-s3-website?ref=tag/0.5.3>?

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

if not, maybe some DNS or caching issues on you computer

bober2000 avatar
bober2000

@Andriy Knysh (Cloud Posse) according to https://www.terraform.io/docs/modules/sources.html#github for github git:: could be missed

Module Sources - Terraform by HashiCorp

The source argument within a module block specifies the location of the source code of a child module.

bober2000 avatar
bober2000

about DNS or caching - we tried this on two PCs in Ukraine and in Germany

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

can you try adding git:: and test again?

bober2000 avatar
bober2000

It was there from beginning

bober2000 avatar
bober2000
12:46:30 PM
bober2000 avatar
bober2000
12:46:44 PM
bober2000 avatar
bober2000

removed .terraform and tried again

bober2000 avatar
bober2000

get this

Andy avatar

try tags/0.5.3 with an S not just tag?

Andy avatar

<https://github.com/cloudposse/terraform-aws-s3-website?ref=tags/0.5.3>

cloudposse/terraform-aws-s3-website

Terraform Module for Creating S3 backed Websites and Route53 DNS - cloudposse/terraform-aws-s3-website

Andy avatar

yup @bober2000 I just tried without the s and received the same error

bober2000 avatar
bober2000

Nice catch! @Andy you saved me!

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

ah yea :slightly_smiling_face: no s

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

thanks @Andy

nukepuppy avatar
nukepuppy

just toying with you guys terraform for creating VPCs.. any suggestions on where to start?

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

hey @nukepuppy

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-aws-vpc

Terraform Module that defines a VPC with public/private subnets across multiple AZs with Internet Gateways - cloudposse/terraform-aws-vpc

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-aws-dynamic-subnets

Terraform module for public and private subnets provisioning in existing VPC - cloudposse/terraform-aws-dynamic-subnets

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-root-modules

Collection of Terraform root module invocations for provisioning reference architectures - cloudposse/terraform-root-modules

nukepuppy avatar
nukepuppy

i been messing with dynamic subnets.. its neat.. though it insists on cutting up a VPC in an odd way

nukepuppy avatar
nukepuppy

like a /24 vpc into 4 /28s instead of 4 /26s when giving 2 azs priv/pub was odd.. was trying to see how to force that if even possible

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

there are many ways of cutting up a VPC

nukepuppy avatar
nukepuppy

im getting the gist of it.. really cool collection of stuff you guys going

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

we have a few diff modules for that

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-aws-multi-az-subnets

Terraform module for multi-AZ public and private subnets provisioning - cloudposse/terraform-aws-multi-az-subnets

nukepuppy avatar
nukepuppy

i love the uber high re-use of these

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-aws-named-subnets

Terraform module for named subnets provisioning. Contribute to cloudposse/terraform-aws-named-subnets development by creating an account on GitHub.

nukepuppy avatar
nukepuppy

so i just want my /24 into 2 AZs priv/pub as /26s what would be your recommendation on which one to try out?

nukepuppy avatar
nukepuppy

actually.. terraform-aws-multi-az-subnets is one im trying now

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-aws-dynamic-subnets

Terraform module for public and private subnets provisioning in existing VPC - cloudposse/terraform-aws-dynamic-subnets

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

you can specify any number of subnets you need

nukepuppy avatar
nukepuppy

ooh so i assume if the value isnt set.. it uses AZ count as the subnet count maybe?

nukepuppy avatar
nukepuppy

i didnt look that deep into it yet ..

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

yes, if not set, it uses all AZs

nukepuppy avatar
nukepuppy

ah i had done this ` availability_zones = [“us-east-1a”, “us-east-1c”]`

nukepuppy avatar
nukepuppy

and it did make 4 subnets.. but still cut up into /28s

nukepuppy avatar
nukepuppy

making me only have 10ips in each hehe

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

try to set max_subnet_count

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

it should divide correctly

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

or maybe this will be better for your use-case https://github.com/cloudposse/terraform-aws-multi-az-subnets#usage

cloudposse/terraform-aws-multi-az-subnets

Terraform module for multi-AZ public and private subnets provisioning - cloudposse/terraform-aws-multi-az-subnets

nukepuppy avatar
nukepuppy

hm still did /28s

nukepuppy avatar
nukepuppy
cloudposse/terraform-aws-multi-az-subnets

Terraform module for multi-AZ public and private subnets provisioning - cloudposse/terraform-aws-multi-az-subnets

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

since you provide CIDR blocks

nukepuppy avatar
nukepuppy

is what im using as an example.. and modifying appropriately

nukepuppy avatar
nukepuppy

im using the usage.. modified the AZ lists per pub/priv to just 2 AZs set.. az nat gw to 2

nukepuppy avatar
nukepuppy

setup variables to be some of the usual stuff /namespace/app etc

nukepuppy avatar
nukepuppy

cidr block set to a /24 but still get a /28 cut up

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-aws-multi-az-subnets

Terraform module for multi-AZ public and private subnets provisioning - cloudposse/terraform-aws-multi-az-subnets

nukepuppy avatar
nukepuppy
private_az_subnet_ids = {
  us-east-1a = subnet-xxxxx
  us-east-1c = subnet-xxxxx
}
public_az_subnet_ids = {
  us-east-1a = subnet-xxxxx
  us-east-1c = subnet-xxxxx
}
nukepuppy avatar
nukepuppy

let me have a look

nukepuppy avatar
nukepuppy

oh hmm different format of max_subnets o.O

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

if you need any changes to the subnet modules to accommodate your requirements, please open a PR

nukepuppy avatar
nukepuppy

oh hmm.. still cut into /28s despite having that var set

nukepuppy avatar
nukepuppy

yeah ill have a look..

nukepuppy avatar
nukepuppy

i mean terraform vpc there is bazillion templates

nukepuppy avatar
nukepuppy

i just liked the idea of minimal go for re-use

nukepuppy avatar
nukepuppy

its probably very useful for most normal larger VPCs but smaller ones may just be a bit too much?

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

yea it’s not easy to come up with a universal module to create subnets, too many possible ways of doing it

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

for our usage, the three modules were enough

nukepuppy avatar
nukepuppy

yeah its doing 99% of everything id want it to do

nukepuppy avatar
nukepuppy

except.. cut up the /24 into 4 /26s instead of /28s

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

the calculations are here

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-aws-multi-az-subnets

Terraform module for multi-AZ public and private subnets provisioning - cloudposse/terraform-aws-multi-az-subnets

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)
cloudposse/terraform-aws-multi-az-subnets

Terraform module for multi-AZ public and private subnets provisioning - cloudposse/terraform-aws-multi-az-subnets

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

(been long time since we reviewed that)

nukepuppy avatar
nukepuppy

thanks again @Andriy Knysh (Cloud Posse)… ill re-evaluate some other time.. i have this working in terraform i built by hand.. just wanted to give something shinier a whirl

maarten avatar
maarten

@nukepuppy outsider question, why do you want to have something smaller than a /24 when you have a /8 at disposal ?

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

yea that’s why we did not pay much attention to how /8 was divided

nukepuppy avatar
nukepuppy

@maarten because when you own IP space that must be routable between things and use IPAM at enterprise level

nukepuppy avatar
nukepuppy

smaller VPCs are created for specific purposes..

nukepuppy avatar
nukepuppy

and multi- account (aws) strategies become a bigger thing

nukepuppy avatar
nukepuppy

no one should or would cut up a /8 into 1 VPC in aws i hope and run a company out of it

nukepuppy avatar
nukepuppy

use about 20-30 aws accounts for stag and 25ish for prod

nukepuppy avatar
nukepuppy

and all have different use cases / purposes

nukepuppy avatar
nukepuppy

and different peering requirements

nukepuppy avatar
nukepuppy

so.. its always viable

nukepuppy avatar
nukepuppy

but a /24 for an individual person.. to use in multiple subnets in a VPC

nukepuppy avatar
nukepuppy

seems pretty much a normal use case to me

maarten avatar
maarten

Wow, those are a lot of accounts per stack. Using /16 per vpc/account ourselves, I guess you have a lot of different teams/apps then

nukepuppy avatar
nukepuppy

yes a lot… quite a lot

nukepuppy avatar
nukepuppy

but in general wanted to just “can” as in soup.. the process of getting smaller stuff without everyone re-writing stuff ya know

nukepuppy avatar
nukepuppy

all good .. very cool to see

nukepuppy avatar
nukepuppy

i was just building a small VPC for a specific reason and had a /24 available to toy with

maarten avatar
maarten

Thanks for explaining the use-case. I know someone who works at a company which makes route planning sw for cars .. the sheer size of different aws/azure accounts is just mindblowing.

nukepuppy avatar
nukepuppy

oh right thats other thing the /8 has multi cloud uses etc etc.. so getting a small cut etc is usually something like a /20 for a team until its used up

nukepuppy avatar
nukepuppy

and from that /20 you cut up what you can

nukepuppy avatar
nukepuppy

but even then a class C VPC can host a bunch of things ya know

maarten avatar
maarten

True, but on the other hand, if you divide a /8 in /16’s you have 255 VPC’s. If the company can’t fit inside 255 VPCs it’s maybe time to do things differently

nukepuppy avatar
nukepuppy

well there is data centers using up a ton of the space too

nukepuppy avatar
nukepuppy

all good though.. everyone’s got different use cases..

maarten avatar
maarten

yep

Andriy Knysh (Cloud Posse) avatar
Andriy Knysh (Cloud Posse)

@nukepuppy we can create another subnets module specifically for that use-case. want to try together?

nukepuppy avatar
nukepuppy

@Andriy Knysh (Cloud Posse) for sure ! in a few days.. i still gotta get something finished up here.. gonna roll my manual made one for now and wrap that up

nukepuppy avatar
nukepuppy

then id love to re-visit as i feel everytime someone needs to make a vpc here.. they basically re-invent the wheel

maarten avatar
maarten

last cents @nukepuppy A /21 for a VPC allows 6 /24’s public+private subnets in 3 az’s which is also quite economical, and does allow for enough growth within a VPC. And 8K of VPC’s

nukepuppy avatar
nukepuppy

i cut up a /20 into 7 /23s and 2 /24s for smaller things

nukepuppy avatar
nukepuppy

the /23s usually used for rebuilding kops/eks clusters to test out

nukepuppy avatar
nukepuppy

and the small /24s for things like permanent smaller infra / smaller management vpcs etc

maarten avatar
maarten

Sounds like you have a huge platform, how much is terraformed ?

nukepuppy avatar
nukepuppy

depends on diff teams and use cases

nukepuppy avatar
nukepuppy

most is hybrid stuff.. some are heavily orchestrated etc… so it isnt all one stop shop for things

johncblandii avatar
johncblandii
DEVOPS-232: Add aws:elasticbeanstalk:cloudwatch:logs support by johncblandii · Pull Request #59 · cloudposse/terraform-aws-elastic-beanstalk-environment

Feature Support log settings. Solution Added support for awshostmanager, awscloudwatch:logs, and awscloudwatchhealth options https://do

    keyboard_arrow_up