#terraform (2019-01)

Got a question regarding the output vars of https://github.com/cloudposse/terraform-aws-elasticache-redis, it seems I am not getting the host out of it.

@Wessel Were DNS records created for the elasticache cluster?

When using terraform-aws-elasticache-redis, when I do not specify a value for “replication_group_id”, I get the following Terraform (0.11.11) error: Error: module.example_redis.aws_elasticache_replication_group.default: “replication_group_id” must contain from 1 to 20 alphanumeric characters or hyphens

Note that the example at https://github.com/cloudposse/terraform-aws-elasticache-redis/blob/master/examples/simple/main.tf does not specify “replication_group_id”

checking

thx

hrmmmmm

ok, so looks like if you don’t specify one, we generate one

https://github.com/cloudposse/terraform-aws-elasticache-redis/blob/master/main.tf#L55

what values do you have for namespace, stage and name?

any chance they contain invalid characters?

namespace = “general” name = “iam2-redis” stage = “${var.environment}” // where the value is ‘dev’

hrm… looks good

I commented out the “zone” attribute

maybe this is the issue?

hrmm don’t think it could be related…

any words of wisdom would be appreciated

where did you specify stage = "${var.environment}"

in the module

module “example_redis” { source = “git://github.com/cloudposse/terraform-aws-elasticache-redis.git?ref=master>” namespace = “general” name = “iam2-redis” stage = “${var.environment}” //zone_id = “${var.route53_zone_id}” security_groups = [”${aws_security_group.rds_security_group.id}”]

auth_token = “${random_string.auth_token.result}” vpc_id = “${aws_vpc.iam2-persistence-vpc.id}” subnets = [”${aws_subnet.rds_subnet_1.id}”, “${aws_subnet.rds_subnet_2.id}”] maintenance_window = “wed00-wed00” cluster_size = “2” instance_type = “cache.t2.micro” engine_version = “4.0.10” alarm_cpu_threshold_percent = “75” alarm_memory_threshold_bytes = “10000000” apply_immediately = “true” availability_zones = [”${data.aws_availability_zones.available.names[0]}”, “${data.aws_availability_zones.available.names[1]}”]

automatic_failover = “false” //replication_group_id = “a123” }

hrm lgtm

any chance you have a space in var.environment?

e.g.

no.

This is from the config file: environment = “dev”

can you try this…. for debugging

you said that if you specify a replication_group_id it works (e.g. a123)

what if you specify: replication_group_id = "general-dev-iam2-redis"

do you get the same error?

yes, when I uncomment the a123 it does work (I did not type ‘yes’ with the apply)

it should work too

a123 is just a random string

we’re setting it to module.label.id

which should just be the concatenation of namespace, stage, name and attributes

(with - delimiter)

…maybe sometihng it doesn’t like with this "general-dev-iam2-redis"

the iam2-

I changed it to remove the hyphen. same error

module “example_redis” { source = “git://github.com/cloudposse/terraform-aws-elasticache-redis.git?ref=master>” namespace = “general” name = “iam2Redis” stage = “dev” //zone_id = “${var.route53_zone_id}” security_groups = [”${aws_security_group.rds_security_group.id}”]

auth_token = “${random_string.auth_token.result}” vpc_id = “${aws_vpc.iam2-persistence-vpc.id}” subnets = [”${aws_subnet.rds_subnet_1.id}”, “${aws_subnet.rds_subnet_2.id}”] maintenance_window = “wed00-wed00” cluster_size = “2” instance_type = “cache.t2.micro” engine_version = “4.0.10” alarm_cpu_threshold_percent = “75” alarm_memory_threshold_bytes = “10000000” apply_immediately = “true” availability_zones = [”${data.aws_availability_zones.available.names[0]}”, “${data.aws_availability_zones.available.names[1]}”]

automatic_failover = “false” //replication_group_id = “a123”

}

ohhhg

we ran into this before

https://github.com/cloudposse/terraform-aws-elasticache-redis/issues/16

did you try this?

TF_LOG=DEBUG

no. I will try

then you’ll get more info about the underlying API respone

I should have tried it. I read about TF_LOG=DEBUG

@stephen recently contributed the replication_group_id field

maybe he’s seen this error too and can shed some light

as far as you know, is it OK to just use any ID, or does it need to correspond to a pre-provisioned real resource?

as far as I know, it does not need to correspond to anything

cool. thanks

So I am going to start the year with building a kops terraform module to spin up a kops cluster in an existing vpc from a cluster.yaml template

Novice question. How do I manage dependencies between different state files. Example, I have a state file (A) that has Security Groups, and another state file (B) that has an instance and uses (A) as a data source to pull the security group information from. If I now update (A) with a different Security Group name, it won’t be able to destroy the existing security group ( create_before_destroy only works within the same state file) because it’s tied to a resource in (B), and I’ll need to re-run the apply on (B) as well. Is this a typical limitation of breaking things up into different state files, or is there a better way to structure this?

@Igor yes, if you change the interface between the modules (and a SG name is an interface), then you need to re-apply everything. You’ll need to do it in any cases even if you use just one state file. That though should be rarely needed

@Igor there is no nice way to do it AFAIK - and it is a pita

use naming conventions to uniquely name all the resources (e.g. terraform-null-label module)

then all the names will stay the same and unique

If you can seed things from the same variables and avoid passing state around that maybe able to help a little

you can just update/change the internals of each module (e.g. add rules to the SG), which should not affect any other module

Terragrunt has the idea of dependencies between state https://github.com/gruntwork-io/terragrunt#dependencies-between-modules

or, you can tag the resources, and then look them up by the tags (e.g. https://github.com/cloudposse/terraform-root-modules/blob/master/aws/eks-backing-services-peering/main.tf)

but it is less than ideal due to the plan/apply phases of Terraform. say you have X,Y,Z that are dependant on state from A. Plan all doesn’t do what you think it will, because A hasn’t actually been applied yet, so the changes to A are not shown in the plan for X,Y,Z

Passing around state is super helpful, but also problematic and should be avoided for things like @Andriy Knysh (Cloud Posse) suggestions

It can also make a bootstrap process harder - ordering matters.

Thanks @Andriy Knysh (Cloud Posse) @joshmyers. I guess there is no silver bullet. I am okay keeping track of order of applies, but not sure specifically about the case where something cannot be destroyed because it’s in use by a resource in a different state file.

Unless I can run the apply on (B) while (A) is stuck on its destroy step.. does the state of (A) get updated resource-by-resource?

yea, that’s not fun. try to use diff states as little as possible as @joshmyers pointed out

for example, you can prob put the SG into the same module because they are related

Yeah, makes sense. I need to think about this while planning how I structure things. Thanks for the feedback.

is this just a one-time task you want to do (destroy the SG and create a new one), or is this in your workflow?

I am in testing mode at the moment, thinking of the different scenarios/workflows, and just stumbled on this

if one time task, then just destroy and recreate everything. If it’s a workflow, don’t do it

select unique names for all the resources, and the issue will be reduced

anyone here ever tried to get a local-exec script output to a terraform variable?

you can use https://www.terraform.io/docs/providers/external/data_source.html

in example.sh:

thanks

https://github.com/cloudposse/terraform-external-module-artifact/blob/master/main.tf

have you guys run into this error?

did you write the token from the external program to the output? (either as shown here https://github.com/cloudposse/terraform-external-module-artifact/blob/master/main.tf or here https://github.com/terraform-providers/terraform-provider-kubernetes/issues/161#issuecomment-395302615)

doing this fixed it

"${data.external.token.result["token"]}"

as opposed to

"${data.external.galaxy_token.result.token}"

anyone here use the kubernetes provider?

for some reason my kubernetes_cluster_role_binding hangs on my initial terraform apply

but if i ctrl+c and run terraform apply again it works automatically

second attempt:

kubernetes_cluster_role_binding.kube_system_default_role_binding: Creation complete after 1s (ID: kube-system-default-role-binding)

@btai maybe you can add logging with TF_LOG to get a bit more output. @alex.somesan

yeah ill do that right now

^ @maarten

does that mean anything to you?

No but maybe to @alex.somesan

@Andriy Knysh (Cloud Posse) is using this kubernetes provider too - he’ll be online tormorrow

Good morning team

I have a question

Any idea when route53 resolver resource will be available ?

I saw this pull request https://github.com/terraform-providers/terraform-provider-aws/pull/6574

but I’m not sure

@rbadillo can you provide some additional context?

we use route53 in dozens of modules

I’m talking about the new route53 resolver feature

they just released back in Nov 2018

(or do you mean when the PR will be merged? )

the PR with the new feature

ohhhhhh gotcha! no, unfortunately don’t know anyone in connection to the PR

Hello! I was just looking at the updates: https://github.com/cloudposse/terraform-root-modules/pull/83/files and I believe https://github.com/cloudposse/terraform-root-modules/pull/83/files#diff-25b6b1e862ed7056e75cc43421b112c0R123 should be SecureString instead of String, but I dont konw if there is some other intention behind not making it a SecureString

BTW, I thought you used chamber to manage the secrets, do you just bootstrap them via terraform?

nice catch @pecigonzalo, that should be SecureString

in the last releases, we added code to write secrets (and other settings) to SSM from all modules via Terraform so they could be used from other modules as needed - simplifies the bootstrap process

Hi

I have a doubt on terraform configuration on azure platform

can we use condition like count to make the argument extension as optional in vmss on azure platform using terraform configuration

#terraform like the example as given below

extension { count = “${var.enabled == “true” ?}” name = “setexecutionpolicy-${local.vm_name_prefix}” publisher = “Microsoft.Compute” type = “CustomScriptExtension” type_handler_version = “1.9”

settings = <<SETTINGS
  {
      "commandToExecute": "powershell.exe Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force"
  }
SETTINGS   }

#terraform can you use count to enable or disable the extension depending upon our requirement?

@praveen i think not, count could be used only in resources count = "${var.enabled == "true" ? 1 : 0}"

for what you want to achieve, you can use the slice pattern (as we call it) to add different values to a setting depending on diff conditions

look here for some explanation https://www.reddit.com/r/Terraform/comments/99zri8/gke_regional_cluster_deployment_defining_zones/

@Andriy Knysh (Cloud Posse) got it. I am trying to create base module for windows vmss. For which I will have to include optional for enabling IIS on the base module. Is there a way I can do enable IIS optional when required

if you share some code, we can point you in the right direction

I have azurerm_virtual_machine_extension which I will have to make it optional for vmss base module. As I understand I cannot use azurerm_virtual_machine_extension for azure vmss. for which I will have to use extension as an argument . Just wanted to know how can I make this configuration as optional (enable/disable)

resource “azurerm_virtual_machine_extension” “iis” { count = “${var.iis_enabled == “true” ? var.av_set_size : 0}” name = “iis_${format(“${var.vm_name}%02d”,count.index+1)}” location = “${var.az_location}” resource_group_name = “${data.azurerm_resource_group.rg.name}” virtual_machine_name = “${format(“${var.vm_name}%02d”,count.index+1)}” depends_on = [“azurerm_virtual_machine.vm”] publisher = “Microsoft.Compute” tags = “${local.tags}” type = “CustomScriptExtension” type_handler_version = “1.9”

settings = <<SETTINGS { “commandToExecute”:”PowerShell -Command " Install-WindowsFeature -name web-server,Web-Default-Doc,Web-Http-Errors,Web-Http-Tracing,Web-Static-Content,Web-Http-Redirect,Web-Http-Logging,Web-Stat-Compression,Web-Dyn-Compression,Web-Filtering,Web-Net-Ext45,Web-Asp-Net45,Web-ISAPI-Ext,Web-ISAPI-Filter,Web-Mgmt-Console,Web-Scripting-Tools";PowerShell -Command " Remove-WindowsFeature -name Web-Dir-Browsing"; PowerShell -Command " Start-Sleep -Seconds 60; Get-Website | Remove-Website; Start-Sleep -Seconds 30; Get-IISAppPool | Remove-WebAppPool; Set-WebConfigurationProperty -Filter ‘/system.applicationHost/sites/siteDefaults/limits’ -PSPath IIS: -Name connectionTimeout -Value (New-TimeSpan -sec 30); Set-WebConfigurationProperty -Filter ‘/system.applicationHost/applicationPools/applicationPoolDefaults’ -PSPath IIS: -Name startMode -Value ‘AlwaysRunning’; Set-WebConfigurationProperty -Filter ‘/system.applicationHost/applicationPools/applicationPoolDefaults/processModel’ -PSPath IIS: -Name idleTimeout -Value ‘0000’"; exit 0” } SETTINGS

here is my extension which I use in windows vm configuration making it as optional using count

How about having an extension that has an empty commandToExecute?

and how would I injust the command to execute while sourcing the module

do you have any example/reference for it

define a local commandToExecute as ${var.enabled ? 'PowerShell -Command...' : 'echo DoNothing'}. Then use settings = ${local.commandToExecute}"

May I know if you have an example or reference of this scenario

I’m just thinking of a possible workaround. I don’t have any examples.

Looks like the slice pattern example that @Andriy Knysh (Cloud Posse) provided is a similar idea

@praveen do you want to enable/disable the whole extension, or just change the command inside settings?

whole extension

Except as a block within https://www.terraform.io/docs/providers/azurerm/r/virtual_machine_scale_set.html, not as azurerm_virtual_machine_extension, if I understood correctly

in what code do you want to do it? (the second snippet above has it already resource "azurerm_virtual_machine_extension" "iis")

Here’s something similar as an example: https://github.com/devops-workflow/terraform-aws-autoscaling/blob/master/main.tf Look at launch_configuration. It is defined inside the module, but allow it to be passed in instead.

yes this is a common pattern - if it’s not provided in the variables, then create a new one

so this is not a problem. I thought @praveen wanted to add different config to extension { in the first code snippet depending on some condition

@Andriy Knysh (Cloud Posse) “azurerm_virtual_machine_extension” is a resource which I used for creating a standalone virtual machine. I understand that we cannot use “azurerm_virtual_machine_extension” resource for vmss . for which we may have to use argument as extension to configure any vm extensions on vmss

as I will have to create generic module for windows vmss. am not finding opportunity to make iss enable optional for windows vmss module

share the code where you use this block

extension {
   count                = "${var.enabled == "true" ?}"
   name                 = "setexecutionpolicy-${local.vm_name_prefix}"
   publisher            = "Microsoft.Compute"
   type                 = "CustomScriptExtension"
   type_handler_version = "1.9"

   settings = <<SETTINGS
     {
         "commandToExecute": "powershell.exe Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force"
     }
   SETTINGS
 }

can you provide me your email address so that I can share the code with you

@praveen DM me

@Andriy Knysh (Cloud Posse) DM the code

if not without using extension or with any other approach can we optionally enable ISS while sourcing windows vmss module

i’ll take a look @praveen

sure

(the slice pattern is what could be used here)

can you give me example or snippet of slice pattern

It’s in the Reddit post above @praveen

Give me a few minutes, I’ll adapt it to your example

sure @Andriy Knysh (Cloud Posse)

checking Reddit post @Igor

@praveen here is a simplified version of using the slice pattern adjusted for your code

if var.iss_extention_enabled == "true", then extensions_final will contain all three extensions

if var.iss_extention_enabled == "false", then extensions_final will contain the first two extensions

I didn;t understand this line # https://www.terraform.io/docs/configuration/interpolation.html#slice-list-from-to- to_index = “${var.iss_extention_enabled == “true” ? 3 : 2}” extensions_final = “${slice(local.extensions, 0, local.to_index)}” }

it’s a comment

Is it possible to update the code which I sent you so that I can better understand

by making only IIS optional

should my locals look like this?

locals { count = “${var.create == “0” ? 0 : 1}” asgcount = “${length(var.asg_ids) > 0 ? 1 : 0}” vm_name_prefix = “${replace(var.resource_prefix,”/[_]/”,”-“)}” extensions = [ { name = “StaplesBGInfo” }, { name = “setexecutionpolicy-${local.vm_name_prefix}” }, { name = “IIS-${local.vm_name_prefix}” } ] to_index = “${var.iss_extention_enabled == “true” ? 3 : 2}” extensions_final = “${slice(local.extensions, 0, local.to_index)}” } }

Hi folks. I have a question about cloudposse/terraform-aws-cloudfront-s3-cdn. Does anyone have experience with that?

what’s the question @Rob?

Hi @Andriy Knysh (Cloud Posse), I was successful in created an S3 bucket and a CloudFront distro using this module. However, I need to set some attributes such as making the bucket private and restricting the CF distro to only accept signed URLs. I cannot find anywhere how to do that.

And my Google searches are not helping

@Andriy Knysh (Cloud Posse) terraform blocks are just list variables? that’s so useful… and I can’t believe I didn’t pick up on that earlier.

@praveen sent you example for your code

(you’d think tags would have given it away, ha)

can’t help you with Azure questions since I’m not familiar with it, so you have to take a look at the code and figure out the remaining issues (if any) by yourself

sorry @Rob, too much traffic here

no worries

@Andriy Knysh (Cloud Posse) Thank you very much . am going to test it now and let you know

@Andriy Knysh (Cloud Posse), I have to get lunch so I’ll ping you later when I get back. Thanks for the offer of help.

@Rob the bucket is already private https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn/blob/master/main.tf#L56 (if that’s was your question)

signed URLs are currently not supported by the module. I guess this needs to be added https://www.terraform.io/docs/providers/aws/r/cloudfront_distribution.html#trusted_signers

@Rob if you test it and open a PR, we’ll review promptly

thanks @Andriy Knysh (Cloud Posse), I’ll give it try shortly.

@Andriy Knysh (Cloud Posse) I just checked the bucket that was created and the 4 permissions, including ACLs, are marked as False. Going to delete the CF distro and bucket and try again. Will let you know. Note this is in the Permissions tab and the Public access settings button.

or are you suggesting that I modify the code and submit a PR? Maybe I didn’t understand.

@Rob yes, for trusted_signers, would be great if you could test it and open a PR

will do. thx

@Andriy Knysh (Cloud Posse), waiting for the terraform destory to complete. The CF distros take a while to complete. I’ll get it done asap and if it works, submit a PR. Thanks for your help.

Yea, CF is painfully slow.

especially when having used things like CloudFlare or Fastly

yeah! it finished!

do I need to create a fork in order to create a PR?

yes, fork it, then create a new branch, add your code, open a PR

The code change worked and the distro was created with a trusted_signer of “self”

thx

Hi there! I am new to the community, is this the correct place to ask questions about the terraform modules?

yep, mostly about the cloudposse/terraform-* modules

ok!

we also have a #terraform-aws-modules channel for https://github.com/terraform-aws-modules

Maybe you have a quick insight for me.

I am trying to implement https://github.com/cloudposse/terraform-aws-elasticache-redis

And I keep getting:

Error: module.redis.aws_elasticache_replication_group.default: "replication_group_id" must contain from 1 to 20 alphanumeric characters or hyphens

I have tried manually applying a replication_group_id but it still throws

hrm….

can you share the group id you manually set?

replication_group_id = "grizzly-redis-staging"

too long

OO man

i guess reading the error would help

wow sorry

(i know, it doesn’t look that long!!!)

honestly, this just came up for someone else last week

so that’s why it was fresh in my memory

Thank you so much!!

https://sweetops.slack.com/archives/CB6GHNLG0/p1546489404082600?thread_ts=1546478732.079900&cid=CB6GHNLG0

Awesome thank you so much!

np! that’s what we’re here for…

and thanks so much for all of the great modules!!

@Andriy Knysh (Cloud Posse) I created a PR.

thanks again for your help

btw, if you haven’t already, please give us a ★ on any of our github projects that you’re using It helps us a lot!

will do. great stuff guys. Keep up the good work. Saves us a lot of time.

thanks @Rob!

@Rob can you add 'self' is acceptable. to the variable description and then rebuild README by executing these commands:

(we don’t directly modify README.md, we modify README.yaml and varaibles.tf and outputs.tf` - then the README generator builds README.md)

sure thing

though I didn’t see anything in the yaml file to update. Am i missing something?

done and pushed

thanks @Rob

if the list is empty, does it still work?

I guess I should test that. oops. shame on me Will test and notify you when complete

thanks

@Andriy Knysh (Cloud Posse), yes, it works if you don’t specify trusted_signers and uses the default which is []

gotta love terraform

ah, I didn’t mean that as a slight against CP.

oh haha emoji fail

I just mean that terraform breaks my heart sometimes

for me, the biggest gripe is “count of cannot be computed”

hahaha. that is annoying

nothing is perfect

yea…

has anyone here taken a serious stab at using pulumi?

The way I get it, Pulumi is to Terraform what SASS is to CSS.

interesting concept. First I’ve heard of it. I like the purple website lol

@Rob https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn/releases/tag/0.6.0

thanks @Andriy Knysh (Cloud Posse)

Is any one using the https://github.com/cloudposse/terraform-aws-iam-user module in combination with the https://github.com/cloudposse/terraform-aws-ses-lambda-forwarder

what is the currently supported method for creating IAM users?

@Jan Don’t think I follow, supported method?

how do I add IAM users

that have keybase setup already

been a long two days and im tired so im probably missing something

@Jan here is our latest doc on this https://github.com/cloudposse/reference-architectures/tree/master/templates/conf/users

brilliant, thank you!

(Note that directory contains templates)

There is also https://github.com/cloudposse/terraform-null-smtp-mail

https://github.com/cloudposse/root.cloudposse.co/blob/master/conf/users/osterman.tf

anyone aware of or use any tools to allow someone to require any version of a module as long as it’s not a major breaking change for terraform? for example in node i can require a version “^1.0.0” which will give me any 1.x.x version of a package but not 2.0.0

oh that would be nice

I haven’t seen any tools for that.

The other tool I want is one for vendoring modules.

Hi guys! I’ve just published automated process to publish searchable PDFs for terraform core and all official providers, so we can work while flying and offline Here we go - https://github.com/antonbabenko/terraform-docs-as-pdf . Tooling may contain bugs, so please let me know by opening an issue, or submit PRs.

I’d like to do this eventually for cloudposse/docs

it’s a nice readable format

I can now update my linkedin profile and add ghostscript and wkhtmltopdf. Both are terribly slow and demand a lot of resources to run.

wkhtmltopdf will for sure attract another batch of automated recruiters

I need moooore spam from recruiters

https://github.com/hashicorp/terraform/pull/19066

Upvote

Hi guys, I’m new here. First of all I want to say ‘thanks’ for such a great collection of templates that you share. I’m building a stack for couple of small backend apps written in Django. My plan is to use this: https://github.com/cloudposse/terraform-aws-ecs-web-app but I want to reduce costs by not using public/private subnets and NAT gateways. Here are the questions:

1. Is it possible to use this template with only 1 public subnet per app (I know that it’s not recommended, but in this case costs are much more important than security)?
2. What other resources should I define? Can you provide an example on how to use this template?

hey @Lukasz German welcome

you deploy ecs-web-app into your own VPC (see https://github.com/cloudposse/terraform-aws-ecs-web-app/blob/master/main.tf#L69)

and into your own subnets https://github.com/cloudposse/terraform-aws-ecs-web-app/blob/master/main.tf#L71

it says private_subnet_ids, but it’s just a name, you can definitely provide just one public subnet Id, for example:

private_subnet_ids = ["subnet-XXXXXX"]

to create a VPC, you can use https://github.com/cloudposse/terraform-aws-vpc

to create subnets, you can use any of our modules https://github.com/cloudposse?utf8=%E2%9C%93&q=-subnets&type=&language=

here is an example on how to use vpc and subnets https://github.com/cloudposse/terraform-aws-eks-cluster/blob/master/examples/complete/main.tf#L36

(it’s for EKS, but will be similar for ECS)

you can set this to false to disable NAT gateways and save on cost https://github.com/cloudposse/terraform-aws-eks-cluster/blob/master/examples/complete/main.tf#L58

to create just one subnet, specify just one AZ here https://github.com/cloudposse/terraform-aws-eks-cluster/blob/master/examples/complete/main.tf#L48

I’m also working on an example as we speak

Subnets are free so you can just create them in each AZ and use as needed

for ECS in terraform-root-modules

(will be ready by EOW)

NAT gateways are not free

Looking at your .travis.yml files, how does travis know what to do for these steps? I am unable to find where these steps processes are defined: make terraform/install, make terraform/get-plugins, etc

@midacts it’s in the Makefile https://github.com/cloudposse/terraform-aws-vpc/blob/master/Makefile

which uses build-harness which has all of that stuff

https://github.com/cloudposse/build-harness

https://github.com/cloudposse/build-harness/blob/master/modules/terraform/Makefile

I see. that makes more sense. Thanks for the information.

something for you guys to consider for the null label, two tags that i think are useful that i added to our implementation are last_updated_by and repo so we can see who the last person to apply terraform was and which repo the code lives in that maintains a resource

Hi All!

I have a tfstate on a existant AWS S3 bucket created manually, and now I can implement a module used to create a S3 bucket and DynamoDB to lock state….

the question is: how I can migrate the tfstate from the original bucket to the new bucket? Or how I can apply changes into the original bucket manually created (to enable versioning and encrypt for example) without last the tfstate (because I have a production environment running)

I’m trying this using terraform import, but I cant have good results…

@javier if you remove the remote state directive in your terraform file, and run terraform init, your state should be available locally again.

then you can add the directive with your new bucket configured and run init again and it should be on there. I’m not sure if it’s possible in one step, but I’m sure 2 steps will work.

and there is a module for that https://github.com/cloudposse/terraform-aws-tfstate-backend

@maarten If I removed the backend directive do not lost the actual state? is not necessary copy the state from the bucket to my local?

you should always make a backup of your state just in case, but if you remove the remote state directive the state should be available again as local terraform.tfstate

perfect! Thanks @maarten @Andriy Knysh (Cloud Posse) I will try the module and removing the backend directive

i think you do terraform init on the S3 state first, then comment out the remote state, then do terraform init again - TF should offer you to import the state

exactly

I’m trying to import the actual s3 BUCKET to my tfstate using ‘terraform import’ and apply the changes if the state for these bucket was different to the config

but I cant have good results… so I will try the module and removing the backend directive

thanks again

take a look here, maybe will help https://docs.cloudposse.com/reference-architectures/cold-start/#provision-tfstate-backend-project-for-root (it’s tricky to provision the remote state and store the state in the remote state when you don’t have the remote state yet )

also here https://github.com/cloudposse/terraform-root-modules/tree/master/aws/tfstate-backend

Good! Thanks for your help

You can use local-exec provisioner to execute sed, which will uncomment desired remote state section in tf file after null_resource is being executed for the first time, which does nothing…

hehe, @Andriy Knysh (Cloud Posse) I see you are doing similar with just sed in the docs.

yea, we used sed, but now have scripts that do all the steps automatically https://github.com/cloudposse/terraform-root-modules/tree/master/aws/tfstate-backend/scripts

i’m having trouble using terraform to upgrade the engine version of an RDS instance that has a read replica

a straight-up terraform apply fails because the read replica needs to be updated before the primary can be updated:

some googling indicated that i should target the read replica and upgrade it first before updating the primary, but when i try targetting just the read replica, it picks up the primary too:

anyone know how to get around this?

can use terraform plan/apply -target=...

the only thing that I can think of is doing it manually via click ops. And then applying. I haven’t had problems like this before so maybe it is something in the modules that is causing this ?

thanks, @Andriy Knysh (Cloud Posse), but when i try to -target the replica, it picks up the primary too

thanks, @Nikola Velkovski i’m probably going to end up doing click ops for this

also -target sometimes decides which other resources are chained together

I mean it’s not -target per se but amazon’s api

also, i like the term “click ops”… have never encountered it before, TIL!

ClickOps is a good addition to DevOps

maybe try this https://www.terraform.io/docs/commands/taint.html

well, my life would have been better without knowing it

it looks like taint will result in the replica db being destroyed and recreated which frightens me

yea

but it’s just a replica, isn’t it?

chaosops FTW

it’s a read replica that our application actually uses for some read-only operations unfortunately

why not update both as the last TF plan shows?

updating both fails with “Error modifying DB Instance staging: DBUpgradeDependencyFailure: One or more of the DB Instance’s read replicas need to be upgraded:…”

ah i see sorry

no problem - i appreciate everyone’s feedback and help!

Hot off the press: https://github.com/cloudposse/terraform-aws-ssm-tls-ssh-key-pair/

(this is useful for bot accounts)

chamber read -q atlantis atlantis_ssh_key > /dev/shm/id_rsa

easily rotate SSH secrets by just tainting the resource

what are the options for dealing with “default” resources, like a default route table and default network ACL?

my understanding is that the terraform module aws_default_route_table makes it explicit that the resource can’t be destroyed, but otherwise using the regular aws_route_table would be fine

is there some trap I’m setting up for myself if I take the latter option?

our best practice is never to use any of the default resources in an account

are you piggy backing on an existing infrastructure or starting fresh?

Adopting an existing infrastructure

aha ..

well, one option is to define the resources and use terraform import

just make sure the setting match

run terraform plan until they sync up perfectly. then you have a baseline to affect change.

except terraform import is lossy

eg - you can import EC2 instances, but it might not notice or complain if you don’t set all the parameters (like terminiation_protection).. So terraform import is good, but not perfect!

that’s what we’re doing, just running into this ambiguity with aws_default_route_table and its ilk. I can import it with aws_route_table and get the plans to match up, just wondering if that will come back to bite me one day

I guess it’s probably not a big deal, nothing is permanent after all

https://github.com/chanzuckerberg/terraform-provider-bless/blob/master/README.md

This looks amazing

Keep secrets out of terraform state store

Oh I missed the gist of this but still cool

This is related to Netflix bless.

I’ve added Foqal as a test to see how it goes over the next few weeks.

It’s only in this channel right now.

https://www.foqal.io/oss.html

If you have any feedback (Good/bad), do let me know.

or ping @vlad

@vlad has joined the channel

yup im here

hi @vlad

hey

@Andriy Knysh (Cloud Posse)

@Erik Osterman (Cloud Posse) I have a question, it may seem obvious but why Terraform over CloudFormation, if you’re planning to use AWS to host your infrastructure and services. Let me give some context, our CTO has mandated that the DevOps team to design, deploy and manage the SA using CloudFormation, the DevOps team is in opposition of this in favor of Terraform. We have to justify that decision.

@dalekurt I’ve had 2 main reasons: 1) Agnostic. You’ll say that you’re only going to use AWS so that doesn’t matter. But that is not reality. In addition to AWS you’ll use a notification system, version control, monitoring, etc.. By having a single tool that can manage many of these (can be extended for the ones it doesn’t), you greatly reduce the amount of tooling and learning required. I’ve used Terraform for Pagerduty, Datadog, InfluxDB, Grafana, Github, and have plans to use it for other services. 2) Neither Terraform or CloudFormation supports all of AWS or new features as they are released. But I’ve found that generally Terraform supports features sooner. Anyone can add support for a feature or request one. And if CloudFormation supports something that Terraform doesn’t, Terraform can run CloudFormation

Thank you @Steven you’ve mirrored my thoughts exactly, I appreciate that.

I’m on the right track.

Terraform is extensible

https://www.terraform.io/docs/providers/

Even if yiu only plan to use a single cloud provider there are loads of options for other services

And modular

Cf has also only just added config drift management

I have converted every Cf org I worked with to terraform

Always with lengthy deep dives into the pros and cons

@Jan Did you do that manually, or with the import feature?

I have used import often but almost always write the tf from scratch

Whilst building the provisioning layer you have the best perspective to find flaws

With production systems often its a case of import and then run plan

If you see a planned change yiu have either missed something or what you are meant to have had diverged from the Cf code base

Nice!

@dalekurt https://www.reddit.com/r/Terraform/comments/af4lsb/why_terraform_and_not_just_shell_scripts/edvflu9 This was written for Terraform opposed to shell, but also fully captures why Terraform is such a good tool.

Ever wish you could initialize terraform state backends using environment variables? (and without #terragrunt or other wrappers)

Now you can! https://github.com/cloudposse/tfenv

Combining tfenv with direnv and a task runner (e.g. make) gives ultimate flexibility without lock-in to one particular tool.

Hi Everyone, I am trying to fix a “value of ‘count’ cannot be computed” but I cannot pintpoint the problem. When the module is applied together with a new ALB, I get a “‘count’ cannot be computed” which doesn’t make sense to me as the count condition itself is not dependent of the alb listener resource.

https://github.com/blinkist/terraform-aws-airship-ecs-service/blob/a304a850ef734c80cb96e6ebe81f0bf3e0eec912/modules/alb_handling/main.tf#L118

Everything within the count condition is not the result of another resource. It is however a parameter coming from a merged map, but that should actually just work. @Andriy Knysh (Cloud Posse)

click

we have it constatly

weird usually this happens with locals

and I all see is vars

@maarten counts with maps are not handled correctly by TF https://docs.cloudposse.com/troubleshooting/terraform-value-of-count-cannot-be-computed/

in your module, you provide a lookup map of all possible record types and then provide the desired record type in var.route53_record_type)

a quick fix (not ideal, but should work) would be

it will skip the test for allowed types, but you do it in many other places anyway

What module should I be using to deploy an atlantis setup

I am using the geodesic ref arch if that makes a difference

@Jan That is being worked on at the moment

this guy? https://github.com/cloudposse/geodesic-aws-atlantis

ha, thanks @foqal

@Andriy Knysh (Cloud Posse) is a Terraform ninja

https://github.com/cloudposse/geodesic-aws-atlantis is going to be archived to be replaced with https://github.com/cloudposse/terraform-root-modules/pull/91

but still ongoing work

If you have bigger fish to fry for now, I’d leave the Atlantis stuff until it properly lands (hopefully a few days)

I wanted to get the k8s stuff out

butwaiting on our parent zone to get delegated

Hi, Just checking if we have module for creating app service environment using terraform on Azure platform

#terraform Hi, Is there any opportunity to create app service environment in Azure platform using terraform?

@praveen https://www.terraform.io/docs/providers/azurerm/r/app_service.html

@Andriy Knysh (Cloud Posse) is app service plan & app service environment both the same?

anyone know what is required to get ` provisioner “local-exec” ` to output to stdout while doing the action?

I saw some resources do it, but I have a python script that is not showing anything

@praveen i’m not familiar with Azure, but looks like they are diff resources https://www.terraform.io/docs/providers/azurerm/r/app_service.html https://www.terraform.io/docs/providers/azurerm/r/app_service_plan.html

@pecigonzalo maybe this will help https://sweetops.slack.com/archives/CB6GHNLG0/p1546543043108000

Hey thanks! but not exactly what im looking for

Im trying to make it so my script in a null resource outputs it output to stdout douring run

so we can see the progress

We dont need to capture it

we are toying with the idea of a asg-roll module which basically has script to roll the instances of an ASG group

but we want to see the progress

instead of getting it all at the end

the “when” terraform shows output seems pretty random, as sometimes does only after it finishes

sometimes is doing it after some minute ¯_(ツ)_/¯

Ill try that, seems hacky but hacky that works is always awesome

https://www.reddit.com/r/Terraform/comments/afznb2/terraform_without_wrappers_is_awesome/

the terraform gods have heard our prayers and answered.

https://github.com/dmlittle/scenery

“A Terraform plan output prettifier” in go

(goodbye terraform-landscape hello scenery)

ya’ll ever run into issues where cloning modules is slow from github?

yea

especially if you have A LOT of modules

i mean, it can take minutes

be glad if you aren’t using codecommit github is soooo much faster, just about always

I wish terraform cached the modules as it does with the plugins

I dont think it would be that hard to do, but had not had time to look at the codebase

it would make dev a lot faster at least

Work on terraform provider for DocumentDB is progressing nicely: https://github.com/terraform-providers/terraform-provider-aws/issues/7077

https://github.com/cloudposse/terraform-root-modules/tree/master/aws/backing-services

what are all these services used for?

bootstraping the root accounts

check: https://github.com/cloudposse/reference-architectures

what I am looking for is what are the services used for

rd psql + mysql + elasticache + replicas

AFAIK for KOPS

nope

kops does not use rds not redis / memcache

not by itself any how

but some operators or etc might

EG: https://github.com/cloudposse/terraform-root-modules/blob/master/aws/backing-services/elasticsearch.tf

I think its probably more for atlantis or something

has references to KOPS

and AFAIK it does not use elasticsearch either

yea

hence my asking

in templates/conf/backing-services/terraform.tfvars

mmmmm

@Jan those backing services are for applications (running on k8s for example), they not for the infra

those are just examples

you can provision all or some of them as needed

that sounds odd, as you already have CP modules for those

#terraform In Azure am sourcing virtual machine module to create multiple windows VM’s. As part of the virtual machine module I also have virtual machine extensions which does not get attach to multiple instances created while sourcing base module

here is the virtual machine base module code resource “azurerm_virtual_machine” “vm” { count = “${length(var.system)}” name = “${var.app_code}${var.app_name}${local.az_env}_${count.index}” location = “${var.location}” resource_group_name = “${var.resource_group_name}” network_interface_ids = [”${element(azurerm_network_interface.nic.*.id, count.index)}”] vm_size = “${var.vm_type}” delete_os_disk_on_termination = true delete_data_disks_on_termination = true

and the extension as follows

resource “azurerm_virtual_machine_extension” “set_execution_policy” { name = “setexecutionpolicy-${lookup(var.system[count.index], “hostname”)}” location = “${var.location}” resource_group_name = “${var.resource_group_name}” virtual_machine_name = “${element(azurerm_virtual_machine.vm.*.name, count.index)}” depends_on = [“azurerm_virtual_machine.vm”]

publisher = “Microsoft.Compute” type = “CustomScriptExtension” type_handler_version = “1.9”

settings = <<SETTINGS { “commandToExecute”: “powershell.exe Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force” } SETTINGS }

I knoew am doing something wrong with virtual_machine_name = “${element(azurerm_virtual_machine.vm.*.name, count.index)}” in extension

is there a way we can attach extensions to multiple instances created using base virtual machine module

@praveen we’ll take a look at ^

@Jan @pecigonzalo to give you more details on having backing-services in the root modules:

@Andriy Knysh (Cloud Posse) should I provide you the complete code or the snippet will suffice ?

1. root-modules is the resource catalog - everything you deploy in your environment(s) goes in there. CloudPosse root modules is just an example. Every company gets its own copy with only the resources they need

On my side currently im building modules for private dns zones

already done as such

then a terraform rendered k8s cluster spec

changing a modul for kops backing state

as I aklready have domain

var.domain_enabled

that actually helps

1. Those invocations of RDS, Redis, Elasticsearch in root-modules are more than just instantiating those modules. They are connected to the other resources and networks. For example, RDS/Redis/Elasticsearch security groups are connected to the kops/EKS/ECS security groups. kops VPC is used to peer to the backing services VPC

and all of that (and more) is codified in the root-modules, so those backing services are not just CP modules’ invocation, it’s more about connecting them together (network, DNS, SGs, etc) and provisioning the entire infra

@praveen you can send the code, we’ll take a look

@Andriy Knysh (Cloud Posse) I just sent you the code

or hit the + to the left of the text input and create a code snippet

hi

in https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment ..

which files, and pushed by what?

you create a log bucket, assign it to the EB environment, and then beanstalk will push all logs from all instances (including your app) to the bucket

doesnt work tho.

also https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment/blob/master/main.tf#L609 this is not honoured

terraform created all the s3 buckets for each environment. but they are empty. and ELB logs are pushed to the AWS default of elb-logs-< your aws account number>

i’m not sure, but maybe ELB logs get pushed just to the default bucket (don’t remember)

in practice that is what is hapenning. im not really concerned about that tho. lol im just curious about that one setting.

if you find any issues, please open a PR

thats assuming that I know enough to make changes lol

was just digging around in cli.. eb config is showing these settings here

i wonder if thats related

(cloudposse is not actively deploying any beanstalk clusters… we wrote these in 2016 for a few customers)

Are you using some of our terraform-modules in your projects? Maybe you could leave us a testimonial! It means a lot to us to hear from people like you.

#terraform am trying to make the following resource optional as part of azure virtual machine base module

resource “azurerm_network_interface_backend_address_pool_association” “nic” { count = “${var.lb_bepool_IDs == “0” ? 0 : 1}” network_interface_id = “${element(azurerm_network_interface.nic.*.id, count.index)}” ip_configuration_name = “${var.app_code}${var.app_name}IP${count.index}” backend_address_pool_id = “${var.lb_bepool_IDs}” }

with lb_bepool_IDs is defined in end code as lb_bepool_IDs = “${module.lb.backend_address_pool_id}”

it throws the following error value of ‘count’ cannot be computed

ah yea, the famous error take a look here https://docs.cloudposse.com/troubleshooting/terraform-value-of-count-cannot-be-computed/

should I change the count decision to true or false?

@praveen there is no easy answer to that error. You need to play with [module.lb](http://module.lb) because it’s a dependency for "azurerm_network_interface_backend_address_pool_association" "nic"

you can share here the code for the module so we’d take a look if anything could be resolved fast

oh looks like terraform-aws-rds-cluster module outputs don’t work. in envvars of a beanstalk module.. i’m trying this:

and in plan or apply, its not wanting to create rds_db_name because ^ module.rds_cluster_…. is empty

when i do terraform state show… i can see these things under “module.rds_cluster_aurora_postgres.aws_rds_cluster.default”

i have no idea how to troubleshoot this

is the enabled flag set to "true"

for the module.rds_cluster_aurora_postgres

@i5okie are you using this module https://github.com/cloudposse/terraform-aws-rds-cluster?

yes

and when you apply it, it should show all these outputs https://github.com/cloudposse/terraform-aws-rds-cluster/blob/master/outputs.tf

you see them?

under module.rds_cluster_aurora_postgres.aws_rds_cluster.default yes

you also using this https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment?

setting env vars here https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment/blob/master/variables.tf#L349?

indeed

Did you check the beanstalk UI under environment settings if you have those values there?

they didn’t get added, and deployed failed, thats how i found out.

i’ve been using the normal postgres rds previously. trying aurora first time here.

Ok so the problem is the failed deployment?

no the problem is that terraform doesn’t understand what “RDS_DB_NAME”, “${module.rds_cluster_aurora_postgres.name}“, is

It should be a map

Variable

and @Erik Osterman (Cloud Posse) i didn’t notice your question earlier. yes. it created the environment.

and it is

Let me show an example of that

i just didn’t copy the []

i’ve got a bunch of envvars in there already. i just copied the one line as example here.

terraform created all the other envvars except ones referring to ${module.rds_cluster_aurora_postgres. …}

this was working before https://github.com/cloudposse/terraform-aws-jenkins/blob/master/main.tf#L49

I’ll try it again tomorrow.

@Andriy Knysh (Cloud Posse) i don’t think map is the problem here.