#terraform (2019-08)

any workaround for

The "count" value depends on resource attributes that cannot be determined

I want to use output of MSK bootstrap servers to create R53 CNAME entries

don’t reference an output/attribute in count? can only reference vars and locals (and the locals must be fully deterministic in advance, i.e. cannot themselves rely on outputs/attributes)

@loren so is it possible to get output from e.g. resource “aws_msk_cluster” and use as count in another resource e.g. “aws_route53_record”

not as the count, no, not as far as i know, you’ll always get count cannot be determined errors

you can use the output in an attribute on another resource, but not in count

and you can set the count some other way where the length is fully deterministic from a var or local without relying on an attr of a resource/data source

say you pass in a var that determines the number of nodes in your cluster… you can use that var to count aws_route53_record, and then reference the attrs of aws_msk_cluster in aws_route53_record attrs

ye I saw workaround with bash echo

smth like this

here’s the issue with all the fun details, https://github.com/hashicorp/terraform/issues/12570

situation is somewhat improved in tf 0.12, so may run into the error less frequently, but it’s still a problem

thnx for answer

I’m stupid, already there number_of_broker_nodes

hello @here anyone knows and can recommend good libvirt provider other then this one here > https://github.com/dmacvicar/terraform-provider-libvirt

Does anybody know how to reference an instance created via a google_compute_instance_group_manager? I’m creating a route via google_compute_route and I need to have the name of the instance created via the group so I can set next_hop_instance.

:zoom: Join us for “Office Hours” every Wednesday 11:30AM (PST, GMT-7) via Zoom.

This is an opportunity to ask us questions on terraform and get to know others in the community on a more personal level. Next one is Aug 14, 2019 11:30AM.
Register for Webinar
#office-hours (our channel)

we’ve just published our first EMR module (by @Andriy Knysh (Cloud Posse)) https://registry.terraform.io/modules/cloudposse/emr-cluster/aws/0.1.0

https://github.com/cloudposse/terraform-aws-emr-cluster/releases/tag/0.2.0

We’ve been inconsistent about recording them

if we do, they’ll be posted to #office-hours

NP. Thanks!

I am facing an issue with provisioning multiple Windows EC2 instances using Terraform. This is an overview of my TF template (Oversimplified with syntax ignored): Template Overview

Resource EC2 {
count = variable

connection 
type     = "winrm"
host     = "${self.private_ip}"
user     = "${var.username}"
password = "${var.admin_password}"
timeout  = "${var.timeout_tf}"

provisioner remote-exec inline
    1. powershell.exe rename-computer -Machine is rebooted once this is run.
provisioner remote-exec inline
    2. powershell copy platform code from s3 bucket
    3. powershell.exe run DomainAdd.ps1 - Machine is rebooted once this is run.
provisioner remote-exec inline
    4. powershell.exe run PreDeploy.ps1 (DSC script)
}

• If I set the count of the instance to 1. All the above #1, #2, #3 and #4 provisioning steps work fine. Issue: If I set the count of the instance to anything other than 1 (e.g. 2), Terraform successfully runs #1, #2 and #3 on both the instances and runs #4 on ONLY ONE of the instances.

Observations:

• After running #3 on both the instances, the remote-exec is able to eastablish the connection with both the instances successfully however runs #4 on only one of the instances.
• Even after running #4 on one instance, it keeps on showing the following output unless I force TF to stop.

  aws_instance.ec2instance[1]: Still creating... [7m0s elapsed]
  aws_instance.ec2instance[0]: Still creating... [7m0s elapsed]
  aws_instance.ec2instance[1]: Still creating... [7m10s elapsed]
  aws_instance.ec2instance[0]: Still creating... [7m10s elapsed]
  aws_instance.ec2instance[0]: Still creating... [7m20s elapsed]
  aws_instance.ec2instance[1]: Still creating... [7m20s elapsed]
  aws_instance.ec2instance[1]: Still creating... [7m30s elapsed]
  aws_instance.ec2instance[0]: Still creating... [7m30s elapsed]
  aws_instance.ec2instance[0]: Still creating... [7m40s elapsed]
  aws_instance.ec2instance[1]: Still creating... [7m40s elapsed]
  aws_instance.ec2instance[1]: Still creating... [7m50s elapsed]
  

Why is Terraform behaving inconsistently when the instance count is set to anything other than 1? Is there something I might be missing? Any suggestions/pointers will be greatly appreciated! TF_LOG are not showing anything useful.

Need help in accessing values as a list element inside map values in terraform

this is how the variable looks like

@mmarseglia we converted the module to TF 0.12 https://github.com/cloudposse/terraform-aws-ecr/releases/tag/0.7.0

and this example are automatically tested on CI/CD https://github.com/cloudposse/terraform-aws-ecr/tree/master/examples/complete

can you try with TF 0.12?

i’m not sure all the modules I’m using have been converted. they weren’t, last I checked.

https://github.com/cloudposse/terraform-aws-ecr/releases/tag/0.7.0 is TF 0.12

https://github.com/cloudposse/terraform-aws-ecr/releases/tag/0.6.1 is TF 0.11

i built a manifest using elasticbeanstalk app w/ a multidocker container.

i am using 7 different modules. i think the elasticbeakstalk ones haven’t been converted yet?

no, benstalk has not been converted yet

i mean that we converted https://github.com/cloudposse/terraform-aws-ecr/releases/tag/0.7.0 to TF 0.12 a few weeks ago and it did not throw any policy errors

yes, i would like to use the new one. you have done great work converting them in a short time.

i’ll figure out a way around this in the short term and look to upgrade that module to 0.7.0

@mmarseglia try to delete the statement = [] from https://github.com/cloudposse/terraform-aws-ecr/blob/0.6.1/main.tf#L124

we don’t have it in TF 0.12 version https://github.com/cloudposse/terraform-aws-ecr/blob/master/main.tf#L120

(and we tested only 0.12 version recently)

If someone from Cloudposse gets a chance to review a PR: https://github.com/cloudposse/terraform-aws-datadog-integration/pull/11

Guys, I am looking how can I tag resources dynamically, and without repeating same block of code with one change.

# Resource 1
tags = merge(
    var.tags,
    map(
      "Name", format("dev-bastion-0%s.${var.domain}",count.index+1),
      "type", "bastion"
    )
  )

# Resource 2

tags = merge(
    var.tags,
    map(
      "Name", format("dev-app-0%s.${var.domain}",count.index+1),
      "type", "app"
    )
  )

any suggestions are welcome, thanks. Okay I see now that I could just abstract that with module

#office-hours hours starting in 15m https://zoom.us/meeting/register/dd2072a53834b30a7c24e00bf0acd2b8

I wonder what the backstory is here…

a) why did they launch with HCL support

b) why did they drop HCL support

strange that they even started with HCL support

maybe the devs working on that feature were also supporting the terraform github provider, and thought, wouldn’t it be neat if…?

Hi all, this is probably a very dumb and novice questions, but I’m having a hard time understanding what I’m doing wrong here. As far as I can tell, when I try to attach a policy document using a role from the CP role repository, the base module is expecting a string?

data "aws_iam_policy_document" "s3_full_access" {
    statement {
      sid       = "FullAccess"
      effect    = "Allow"
      resources = [
        "arn:aws:s3:::${module.static-app.s3_bucket}",
        "arn:aws:s3:::${module.static-app.s3_bucket}/*"
      ]

      actions = [
        "s3:PutObject",
        "s3:PutObjectAcl",
        "s3:GetObject",
        "s3:DeleteObject",
        "s3:ListBucket",
        "s3:ListBucketVersions",
        "s3:ListBucketMultipartUploads",
        "s3:GetBucketLocation",
        "s3:AbortMultipartUpload",
      ]
    }
  }

  module "s3-write-role" {
    source     = "git::<https://github.com/cloudposse/terraform-aws-iam-role.git?ref=0.4.0>"

    enabled    = "true"
    namespace = "${var.namespace}"
    stage     = "${var.stage}"
    name      = "${var.name}"

    policy_description = "Allow S3 FullAccess"
    role_description   = "IAM role with permissions to perform actions on S3 resources"

    policy_documents = ["${data.aws_iam_policy_document.s3_full_access.json}"]
  }

I’m wondering if I’m missing something ovbious here, or not understanding how to use this module?

Follow up error

Error: Incorrect attribute value type

  on .terraform/modules/s3-write-role.aggregated_assume_policy/main.tf line 23, in data "aws_iam_policy_document" "zero":
  23:   override_json = "${element(local.policies, 0)}"

Inappropriate value for attribute "override_json": string required.

You are missing something there

Why error says aggregated_assume_policy ?

Oh, your source is a git tag

I’m sorry, I’m not understanding what the source of confusion is? Could you possibly rephrase?

@Rich Allen can you look at the example https://github.com/cloudposse/terraform-aws-iam-role/blob/master/example/main.tf

(I personally did not test the latest changes to the module, so can’t just say what’s the exact issue is)

That is the example I’m working from. I’ve looked through it several times. And can’t see a difference. From what I can tell, my only real difference is I don’t have an outputs.tf

is is required I have that file, so that the module exposes the outputs to the consumer?

ok I see the issue https://github.com/cloudposse/terraform-aws-iam-policy-document-aggregator/blob/master/main.tf#L6

it does not work with one item in the list

since it checks only for >1

well so, I can provide and update, and I’m using 2

so the base + full admin, as the example suggests

policy_documents = [“${data.aws_iam_policy_document.s3_full_access.json}“]

the previous was to simplify, I will post an updated stanza

I’m now using 2 as the example suggests

provider "aws" {
  region = "${var.region}"
}

module "static-app" {
  source                   = "git::<https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn.git?ref=0.10.0>"
  namespace                = "${var.namespace}"
  stage                    = "${var.stage}"
  name                     = "${var.name}"
  aliases                  = "${var.aliases}"
  parent_zone_name         = "${var.parent_zone_name}"
  default_root_object      = "${var.default_root_object}"
  acm_certificate_arn      = "${var.acm_certificate_arn}"
  cors_allowed_headers     = ["GET", "HEAD"]
  cors_allowed_methods     = ["GET", "HEAD"]
  cors_allowed_origins     = ["*"]
}

data "aws_iam_policy_document" "s3_full_access" {
  statement {
    sid       = "FullAccess"
    effect    = "Allow"
    resources = ["arn:aws:s3:::${module.static-app.s3_bucket}/*"]

    actions = [
      "s3:PutObject",
      "s3:PutObjectAcl",
      "s3:GetObject",
      "s3:DeleteObject",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:GetBucketLocation",
      "s3:AbortMultipartUpload",
    ]
  }
}

data "aws_iam_policy_document" "base" {
  statement {
    sid = "BaseS3Access"

    actions = [
      "s3:ListBucket",
      "s3:ListBucketVersions",
    ]

    resources = ["*"]
    effect    = "Allow"
  }
}

  module "s3-write-role" {
    source     = "git::<https://github.com/cloudposse/terraform-aws-iam-role.git?ref=0.4.0>"

    enabled    = "true"
    namespace = "${var.namespace}"
    stage     = "${var.stage}"
    name      = "${var.name}"

    policy_description = "Allow S3 FullAccess"
    role_description   = "IAM role with permissions to perform actions on S3 resources"

    policy_documents = [
      "${data.aws_iam_policy_document.base.json}",
      "${data.aws_iam_policy_document.s3_full_access.json}"
      ]
  }

working for you?

no this is the result of that update

what TF version are you using?

17:04 $ terraform -v Terraform v0.12.2

• provider.aws v2.22.0
• provider.local v1.3.0
• provider.null v2.1.2
• provider.template v2.1.2

Ok, I’m seeing something nasty

I hope it’s not something that dumb like I forgot brew update

https://github.com/cloudposse/terraform-aws-iam-policy-document-aggregator/blob/ca820699baca5a1345f5e4a0d73762f8ce212982/main.tf

this module has not been updated to TF 0.12 yet https://github.com/cloudposse/terraform-aws-iam-role

that’s why the errors

In some point you are using this source: https://github.com/cloudposse/terraform-aws-iam-policy-document-aggregator.git?ref=tags/0.1.2

Which is this https://github.com/cloudposse/terraform-aws-iam-role/blob/05d1734bc40a73d6f21387b58c1f3204dbbe09aa/main.tf

Main file

so I’m a noobie here, @Andriy Knysh (Cloud Posse) where is that documented? I’m not seeing it but that could be true.

At line 23, you will see the error

both modules were not converted to TF 0.12 yet

that’s why TF 0.12 throws the errors

we’ll get to it soon

@Joan Hermida I’m not sure I understand the context there

Downgrade to the latest 0.11 version

@Andriy Knysh (Cloud Posse) could you just point out where I can see that? To avoid version mismatches in the future?

so for CloudPosse modules, the ones that were converted to TF 0.12 have hcl2 tag in the repo, e.g. https://github.com/cloudposse/terraform-aws-rds

and you can tell TF 0.11 from TF 0.12 by the syntax

TF 0.12 does not use any string interpolations https://github.com/cloudposse/terraform-aws-rds/blob/master/outputs.tf

and uses real first-class types like bool, number, list(string), map(string) instead if strings like “string” and “list” https://github.com/cloudposse/terraform-aws-rds/blob/master/variables.tf#L19

ty, that’s very helpful, I’m getting a few new errors related to the downgrade but I’ll fix these up. Much appreciate the help.

Hello, I’m using : “git://github.com/cloudposse/terraform-aws-alb-target-group-cloudwatch-sns-alarms.git?ref=tags/0.6.1>” and I notice when using the newer alb module that target_group_name = “${module.alb.target_group_name}” and target_group_arn_suffix = “${module.alb.target_group_arn_suffix}” are not valid outputs anymore so it can’t be use with this cloudwatch-sns module, are you guys deprecating the use of the cloudwatch-sns-alarms or recommend something else ?

and now I think I found a bug , I’m getting this :

Error: Error running plan: 1 error occurred:
	* module.alb_ingress.local.target_group_arn: local.target_group_arn: Resource 'aws_lb_target_group.default' not found for variable 'aws_lb_target_group.default.arn'

using : https://github.com/cloudposse/terraform-aws-alb-ingress/tree/0.7.0

If I pass the ARN or the module output still fails

unless I’m doing something really wrong

I made a copy of the module , removed the data resource and it does work, so I’m guessing this lies : https://github.com/cloudposse/terraform-aws-alb-ingress/blob/0.7.0/main.tf#L6

don’t really need to be there ? why making a lookup of something I’m already passing and creating that data resource that is not used in that tf ?

I guess is to check that the target group exists before continuing but in my case I used -target module.alb to make sure I had everything before continuing but somehow still fails

Hi everyone - new to the channel but was hoping to find a solution to a problem I am running into dealing with output variables from modules

I use the aws vpc terraform module, and there is a specific output that that gets created as a list, specifically the database subnet output. I am trying to reference this output as an input variable for an rds module

does anyone know how to properly reference an output list generated by a module, as an input variable for another module?

any guidance or direction would be sincerely appreciated

outputs types are the same regardless whether it’s a list or a string

for a working example see https://github.com/cloudposse/terraform-aws-emr-cluster/blob/master/examples/complete/main.tf

and another example where the list output from the subnet module goes into the elasticsearch module https://github.com/cloudposse/terraform-aws-elasticsearch/blob/master/examples/complete/main.tf#L33

same for RDS https://github.com/cloudposse/terraform-aws-rds/blob/master/examples/complete/main.tf#L45

and RDS Aurora https://github.com/cloudposse/terraform-aws-rds-cluster/blob/master/examples/complete/main.tf#L40

bingo!

thank you @Andriy Knysh (Cloud Posse)

any ideas on this ?

I know the posts from yesterday usually get buried….

what module are you using? can you share the code

https://sweetops.slack.com/archives/CB6GHNLG0/p1565311967155900

mmm that did not work, my complete post is just a higher

https://github.com/cloudposse/terraform-aws-alb-ingress/tree/0.7.0

@jose.amengual here is how we use aws-alb-ingress https://github.com/cloudposse/terraform-aws-ecs-web-app/blob/master/main.tf#L34

aws-ecs-web-app is used here https://github.com/cloudposse/terraform-aws-ecs-atlantis/blob/master/main.tf#L78

which itself is used here (working example) https://github.com/cloudposse/terraform-root-modules/blob/master/aws/ecs/atlantis.tf#L173

that is exactly where I got the example :

module "alb_ingress" {
  #source            = "git::<https://github.com/cloudposse/terraform-aws-alb-ingress.git?ref=tags/0.7.0>"
  source            = "../terraform-aws-alb-ingress"
  name              = "${var.name}"
  namespace         = "${var.namespace}"
  stage             = "${var.stage}"
  attributes        = "${var.attributes}"
  vpc_id            = "${var.vpc_id}"
  port              = "${var.container_port}"
  health_check_path = "${var.health_check_path}"
  target_group_arn  = "${module.alb.default_target_group_arn}"

  # Without authentication, both HTTP and HTTPS endpoints are supported
  unauthenticated_listener_arns       = ["${module.alb.listener_arns}"]
  unauthenticated_listener_arns_count = 1

  # All paths are unauthenticated
  unauthenticated_paths    = ["/*"]
  unauthenticated_priority = "100"
}

when this evaluation happens , for some reason this :

data "aws_lb_target_group" "default" {
  arn = "${local.target_group_arn}"
}

can’t find the ALB

and I’m 100% sure the value is correct

I mean the arn

but that data resource is the one that fails but is not anywhere else int he code

Did you provision the ALB?

yes first

Look at the root modules ECS folder

Did you try to run terraform apply second time?

yes

Sometimes there race conditions

I used target module.alb

then I run the rest

Where some resources are not created yet

I understand

I run target module.alb twice

then run the rest

Try running the rest twice

I did too

I’m destroying everything again right now

the thing is : even if I set

target_group_arn  = "${module.alb.default_target_group_arn}"

to the target group arn itself

it does not work

I ran this project https://github.com/cloudposse/terraform-root-modules/tree/master/aws/ecs about 35 times, but never saw it could not find the target group

I saw in many cases that the ALB was not ready yet (it’s slow), so it could not attach the target group

after running the whole thing second time, the ALB is already ready, and it finishes provisioning the rest

yes, ALBs are really slow

I’m running this thing again just to make sure I did’t do anything stupid

just tried from zero and run the alb target 3 times, waited few minutes and tun module.alb_ingress and I get the same error

null_resource.default: Refreshing state... (ID: 938128705396491941)
aws_security_group.default: Refreshing state... (ID: sg-0dca458073974ca29)
aws_lb_target_group.default: Refreshing state... (ID: arn:aws:elasticloadbalancing:us-east-1:...o-droneio-alb-default/c5d32c308b13dee7)
data.aws_elb_service_account.default: Refreshing state...
data.aws_iam_policy_document.default: Refreshing state...
aws_s3_bucket.default: Refreshing state... (ID: staging-demo-droneio-alb-alb-access-logs)
aws_lb.default: Refreshing state... (ID: arn:aws:elasticloadbalancing:us-east-1:...ging-demo-droneio-alb/61f67535cafe2201)
aws_lb_listener.http: Refreshing state... (ID: arn:aws:elasticloadbalancing:us-east-1:...-alb/61f67535cafe2201/8e7ac22fe675d697)

Error: Error running plan: 1 error occurred:
	* module.alb_ingress.local.target_group_arn: local.target_group_arn: Resource 'aws_lb_target_group.default' not found for variable 'aws_lb_target_group.default.arn'

`

so I can consistently reproduce the issue

I can run this :

terraform apply -target data.aws_lb_target_group.default                                                                                                                              
aws_lb_target_group.default: Refreshing state... (ID: arn:aws:elasticloadbalancing:us-east-1:...o-droneio-alb-default/c5d32c308b13dee7)

with same code is failing in the module and it does not fail outside of it

so, something is happening here :

locals {
  target_group_enabled = "${var.target_group_arn == "" ? "true" : "false"}"
  target_group_arn     = "${local.target_group_enabled == "true" ? aws_lb_target_group.default.arn : var.target_group_arn}"
}

what TF version are you using?

i think you are running into some race conditions

where this https://github.com/cloudposse/terraform-aws-alb-ingress/blob/master/main.tf#L21 has not been created yet

but this https://github.com/cloudposse/terraform-aws-alb-ingress/blob/master/main.tf#L6 is already being used in the outputs

but

resource "aws_lb_target_group" "default" {
  count       = "${local.target_group_enabled == "true" ? 1 : 0}"

will only be created if target_group_arn is = “”

base on the locals evaluation

so it should not even be trying to create this resource ?

so yes, you either provide one, or the module will create it

in my case I’m providing one

so you think somehow the evaluation is failing ?

even if I pass the raw arn value still fails

ok yes, there is a bug in that flow. we always created target group in the module (did not test when you provide one)

the bug is…

this https://github.com/cloudposse/terraform-aws-alb-ingress/blob/master/main.tf#L21 uses count so any output from it is a list

this https://github.com/cloudposse/terraform-aws-alb-ingress/blob/master/main.tf#L3 should be

target_group_arn = "${local.target_group_enabled == "true" ? join("", aws_lb_target_group.default.*.arn) : var.target_group_arn}"

want to open a PR?

for sure

thanks for finding it

this thing has been killing me, I though I was doing something wrong

I know I have to run few commands before I create the PR

are those documented somewhere ?

you mean to rebuild README?

you need that if you change any variable or outputs or README.yaml (not in this case where you just fix the code)

but run it anyway

I see ok

Has anyone here used terraform as the CD portion of the CI/CD pipeline? Currently, I’m deploying docker images to ECR with Gitlab, but I’m running into an issue where I need to somehow tell terraform to update it’s workspaces once a new image comes out. Was curious if anyone else had run into this / figured this out

@Mike Nock you mean that terraform is somehow constantly running and waiting for commands? Or it’s a manual process?

if manual, you can use https://www.terraform.io/docs/providers/aws/d/ecr_image.html to retrieve information about images

Yea, currently the pipeline is Gitlab > Docker > ECR for CI, and then manually deploying the images by going into TFE and updating the workspace so teraform sees the new image (the CI pipeline retags the image with :production and removes that tag from the old image when deploying to ECR, and terraform is set to only use the image with that tag). I’d like to automate that. So, when the developers push a new feature to master, it build, deposits the image, and then either sends an API call to terraform to update (prefer not doing it this way), or preferably someway of having terraform monitor the tags, and deploy once the tag is removed?

Also, for backstory, the reason I prefer not doing the api calls to update, is we are doing self-service terraform where client environments are being created regularly and dynamically, so I wouldn’t have a list of all the workspaces to send individual API calls to, and you can’t send 1 api call to update all workspaces, same as you can’t send 1 api call with a map of variables for the workspace but have to list out each one by one in separate calls.

that’s interesting (but we at CloudPosse did not use TFE)

Understandable, just figured it was worth asking if anyone else had run into it. Thanks!

I was looking at : https://github.com/cloudposse/terraform-aws-rds-cluster/blob/0.11/master/examples/basic/main.tf#L6 what is all that witchcraft ?

I’m guessing that is only available in providers and should not be used with other terraform code except rds ?

those are attributes on the provider which you can use to disable some checks if you want to run it faster

has nothing to do with RDS

used in some tests

but not necessary at all

RDS takes so long I was thinking on adding them to my big TF but I was not sure if they could break something

Do you have module which covers ACM Certificate for CloudFront if Route 53 HostedZone is not in us-east-1?

it’s a provider thing https://github.com/cloudposse/terraform-root-modules/blob/master/aws/acm-cloudfront/main.tf#L12

Thanks @Andriy Knysh (Cloud Posse) Of course, its provider thing, I may miss something, but I don’t see how this reference address my use case

If I see well it presume that Hosted Zone is in same Region

or i take that back

sorry

Hosted Zones are global

Yes hosted zones are global

You create a certificate in us-east-1 using different provider

Then reference the cert ARN when you create a distribution

@Andriy Knysh (Cloud Posse) Thank, I did that, but i messed up something else which made me problem

provisioning atm, everything looks good so far

regarding the HCL deprecation on github action

is very likely due to the recent news that github action will have built-in CI/CD

and given github is owned by microsoft

is very likely the backend is azuredevops

and until next tuesday, automation for azuredevops pipeline is in yaml

@Andriy Knysh (Cloud Posse) after much time, upcoming tuesday is the decided to release the azuredevops terraform provider

decided day*

Are there any known bugs with the ec2 module, release 0.11?

deployed an ec2 instance using the ec2 module, and had associate_public_ip_address set to true. Changed it to false from true, which then prompted a redeploy, now it fails with the error: value = coalesce( aws_eip.default is empty tuple aws_instance.default is tuple with 1 element Call to function “coalesce” failed: no non-null, non-empty-string arguments.

I cant destroy or apply any updates to my entire deployment

looks like there is a pull request for this specific issue: https://github.com/cloudposse/terraform-aws-ec2-instance/pull/45

does anyone know if there is a temp workaround for this?

@LeoGmad you can fork the branch of the PR and use that one ?

I will try, thank you @maarten

I was able to successful fork the PR but issue still persists. I would be interested if anyone has been successful with this PR or finding a workaround

the only way to resolve is to set all instances “associate_public_ip_address = true”

which I guess isnt a big deal as long as they’re deployed behind a NAT or limited ACL

@Leonard Wood ok let me run the example with associate_public_ip_address set to false, and see what can be done.

@Leonard Wood see if it works with the new pr

I tried with the new PR but no luck. I am deploying 2 ec2 instances, one set to true and one to set false - and thats when the issue occurs. All ec2 instance deployments have to be set to ‘true’ for it to deploy.

@Leonard Wood make sure to clean your cache. I’m running ‘examples/complete’ with instance_enabled = falseand that works

:zoom: Join us for “Office Hours” every Wednesday 11:30AM (PST, GMT-7) via Zoom.

This is an opportunity to ask us questions on terraform and get to know others in the community on a more personal level. Next one is Aug 21, 2019 11:30AM.
Register for Webinar
#office-hours (our channel)

Hello! I want to share with you resource:for_each and dynamicfor_each construction for terraform 12.6 . Hope this helps you work with large arrays of resources. https://github.com/devops-best-practices/terraform-best-practice/blob/master/s3.tf

Hey people, looking for terraform template on vpc peering ( syntax 0.12) any help plz

Hola fellas….

Quick question here… We have a Terraform RDS module (typical base build format) for the build deployments to use to setup RDS instances in our AWS Setups. Now I am tying to enable alerting (SNS topics with Cloudwatch) within the existing RDS module but not sure how to enable the alerting within an existing RDS module. I found out eh cloud posse GitHub repo (https://github.com/cloudposse/terraform-aws-rds-cloudwatch-sns-alarms) will give the ability to create the sns topics (please do correct me if I am wrong here), but what I need is to enable the alerting within the RDS module so that the users will create the required sns topics based on their needs. Anyone worked on this kind of typical setups before? Any input helps me for my cause here

or even anyone been through this kind of requirement before?

you can use the alarms from https://github.com/cloudposse/terraform-aws-rds-cloudwatch-sns-alarms/blob/master/alarms.tf (update them and add new ones if needed)

then you can create an SNS topic in diff module (or manually, or however you need it), and subscribe the RDS instance to the topic https://github.com/cloudposse/terraform-aws-rds-cloudwatch-sns-alarms/blob/master/main.tf#L20

(the module currently always creates an SNS topic)

and since we are talking about SNS alarms :

I’m using : “git://github.com/cloudposse/terraform-aws-alb-target-group-cloudwatch-sns-alarms.git?ref=tags/0.6.1>” and I notice when using the newer alb module that target_group_name = “${module.alb.target_group_name}” and target_group_arn_suffix = “${module.alb.target_group_arn_suffix}” are not valid outputs anymore so it can’t be use with this cloudwatch-sns module, are you guys deprecating the use of the cloudwatch-sns-alarms or recommend something else ?

Sure @Andriy Knysh (Cloud Posse)… Let me give it a try and will update here in the group with the progress..

https://twitter.com/JustinWGrote/status/1159986326785015808

Also @Andriy Knysh (Cloud Posse), just a quick fyi.. we dont use the IAM policy in the main.tf for the SNS topics creation as we use the user aces at higher levels in our build deployments. Is there other way to comment that part out of the module?

if you don’t use aws_sns_topic, then you don’t need the policy as well

comment out of the module: you can fork it and comment out aws_sns_topic and the policy, or you can open a PR and add new var sns_topic_enabled (set to true by default for backwards compatibility). Then use count = "${var.sns_topic_enabled == "true" ? 1 : 0}" for aws_sns_topic and aws_db_event_subscription and aws_sns_topic_policy`

Without using the aws_sns_topic, how can I subscribe the RDS instance to the topic https://github.com/cloudposse/terraform-aws-rds-cloudwatch-sns-alarms/blob/master/main.tf#L20 (from your above statement dude)?

you need an SNS topic to subscribe the instance to a topic

ok ok

let me comment out the section from the module and will try it out

Hi Everyone, I’m having the issue that when I attach a private EIP to an instance in a private subnet,, that associate_public_ip_address gets set to true. This with a subnet with public ip mapping to false. Maybe someone else stumpled upon the same issue ?

@maarten what module is this?

“terraform-aws-modules/ec2-instance/aws” but it’s irrelevant, it’s not a module problem

No but I just want to have a look

and what is the actual problem? You don’t want associate_public_ip_address: true ?

OK, makes more sense seeing that. saying that, I haven’t come across this

Does the instance then get a routable public IP that you don’t want it to have?

yep

Can you deny outside world access via SG rule?

It’s a human error I think. I thought the EIP would be private, but it’s actually a public EIP .. associated with a private address

ah i don’t think you can have a private EIP - you’d need ENI for that … assuming I understood correctly what you want (a private static ip?)

Don’t think that actually works does it?

EIPs are always public

Hello there, do you have any fargate terraform module to analyze and implement in a production environment?

https://asciinema.org/a/9Yg1A9kvTbWqor1poRTDKxxB3

Hi, is there any possibility to setup azurerm app service deployment from bitbucket automatically? scm_type block doesn’t work, as described in this issue: https://github.com/terraform-providers/terraform-provider-azurerm/issues/3696

Do you see any alternatives?

Hey guys, anyone know how to get terraform-aws-elastic-beanstalk-environment to attach security groups directly to the launch config this module creates? Currently, whatever SGs you list under var.security_groups, they all get added as security group rules of a new SG that this module creates, instead of actually associating the SGs themselves directly to the Launch Config… https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment/blob/master/main.tf#L318

Hi, I have a general Terraform question. Is anybody using it for deployment of and to HyperV? I found a community provider however I’m a little bit hesitant in using it. Which other gitops based tool would be available for HyperV deployments?

@github140 saw @chrism talking about hyperv in #geodesic last month

Our public weekly #office-hours is starting now! Join https://zoom.us/j/508587304

Hi, I’m trying to create a aws_vpc_peering_connection between 2 accounts, cross region using assume-role and specifying a aws provider for the aws_vpc_peering_connection_accepter with corresponding region. This fails because the requester tries to look for the accepter vpc in the same region and fails to find the vpc. I’ve used this code to successfully deploy cross account, but on the same region. Using TF version 0.11.13

I’ve been tinkering with this module today. https://github.com/cloudposse/terraform-aws-ec2-instance-group Is there a way to get instances spread across mutiple AZ’s?

@Patrick Beam you could provide a list of availability zones for that region e.g. [“a”, “b”, “c”] and then in your availability_zone input use this:

availability_zone = “${element(var.availability_zones, count.index)}”

You would just have to change that variable to a type = list(string)

hope that helps

Anyone with experience in

resource "aws_ssm_document

and after destroy the document does not seems to be deleted

Having this error on Tf Plan - Error: Missing resource instance key

on .terraform\modules\vpc_peering_cross_account[accepter.tf](http://accepter.tf) line 96, in locals: 96: accepter_aws_route_table_ids = “${distinct(sort(data.aws_route_tables.accepter.ids))}”

Are you using some of our terraform-modules in your projects? Maybe you could leave us a testimonial! It means a lot to us to hear from people like you.

How do i set order precedence in terraform? I have main.tf where it destroys a IAM role and deploy’s it again on terraform-apply. I am hitting a error ` aws_iam_role.service_role: Error creating IAM Role DEFAULT-TestingService-ecs-service-role: EntityAlreadyExists: Role with name DEFAULT-TestingService-ecs-service-role already exists`

This is after destroying the role, pretty sure that AWS needs some time to update the cache.

I want to first destroy the services and then create it. Is this possible?

hmmm…. terraform is used to create resource definitions - how to create them

terraform knows from its state file what was created

how are you doing destroy from TF files?

Hi, do you guys have a preference on using the aws KMS managed key or creating a CMK ?

the reason I ask that is that after removing Kms_key_id from :

module "ssm_tls_ssh_key_pair" {
  source               = "git::<https://github.com/cloudposse/terraform-aws-ssm-tls-ssh-key-pair.git?ref=0.2.0>"
  namespace            = "${var.namespace}"
  stage                = "${var.stage}"
  name                 = "${var.name}"
  attributes           = "${var.attributes}"
  
  ssm_path_prefix      = "${var.stage}/${var.name}/infrastructure/ssh_keys"
  ssh_key_algorithm    = "RSA"
  ssh_private_key_name = "${module.default_label.id}-private"
  ssh_public_key_name  = "${module.default_label.id}-public"
  #kms_key_id           = "${module.kms_key.key_id}"
}

I got

Error refreshing state: 1 error occurred:
	* module.ssm_tls_ssh_key_pair.data.aws_kms_key.kms_key: 1 error occurred:
	* module.ssm_tls_ssh_key_pair.data.aws_kms_key.kms_key: data.aws_kms_key.kms_key: error while describing key [alias/test-demo-chamber]: NotFoundException: Alias arn:aws:kms:us-east-1:046894643055:alias/test-demo-chamber is not found.
	status code: 400, request id: 7e387954-2256-4ef2-a40e-b48269259e9c

Hey all, I updated the release of terraform-aws-dynamic-subnets that I’m pulling down and now I’m getting this error:

Error downloading modules: Error loading modules: module dynamic_subnets: Error parsing .terraform/modules/e972fa1c1c4c2e3a44d52f7491016697/label.tf: At 3:25: Unknown token: 3:25 IDENT var.attributes

Any idea what’s going on?

for TF 0.12, use release https://github.com/cloudposse/terraform-aws-dynamic-subnets/releases/tag/0.13.0 and newer

for TF 0.11, https://github.com/cloudposse/terraform-aws-dynamic-subnets/releases/tag/0.12.0

oh ok, I’m on TF 0.11.13 and trying to use release 0.16.0 of the module. That must be why then.

I’ll try version 0.12.0

thanks!

I’m looking to move terraform code for a customer from regular terraform to terraform enterprise. I googled but couldn’t find if there are any quirks or things I should know about TFE. My goal is to create a terraform module that can be used for both the open source version as well as TFE.

I have an existing aws ecs cluster (made by hand) and would like to update it by using terraform. Is there any documentation for updating existing aws services (alb, ecr, ecs)?

Hi, I am using terraform workspace to create azure windows server’s in more than one environment using one terraform code. For passing hostname and IP address am using the following lookup’s in local

locals { location = “${terraform.workspace}” image_id = “${module.image.image_id}” environment = “${module.locals.environment}”

subnets = { eastus2_prod = “${data.terraform_remote_state.shared_networking.eastus2_api_tier_subnet.id}” centralus_prod = “${data.terraform_remote_state.shared_networking.centralus_api_tier_subnet.id}” }

lb_ips = { eastus2_prod = “10.244.160.164” centralus_prod = “10.245.160.164” }

 system = {
eastus2_prod   = [   {
hostname = "wqilpeap101"
ip       = "10.244.160.165"   },   {
hostname = "wqilpeap102"
ip       = "10.244.160.166"   }, ]

centralus_prod = [   {
hostname = "wqilpcap101"
ip       = "10.245.160.165"   },   {
hostname = "wqilpcap102"
ip       = "10.245.160.166"   }, ]

}

subnet_id = “${lookup(local.subnets, format(“%s_%s”,local.location, var.environment))}” lb_ip = “${lookup(local.lb_ips, format(“%s_%s”,local.location, var.environment))}” systems = “${lookup(local.system, format(“%s_%s”,local.location, var.environment))}” }

it fails with following error message

Error: Error asking for user input: 1 error occurred: * local.systems: local.systems: lookup: lookup() may only be used with flat maps, this map contains elements of type list in:

${lookup(local.system, format(“%s_%s”,local.location, var.environment))}

can you help me fix this

@praveen you can try: subnet_id = “${local.subnets[ format(“%s_%s”,local.location, var.environment)]}”

subnet is working fine

issue is with systems

should I try it for systems?

yes

trying now

So, I’m trying to be a bit clever. I have a need to conditionally add statements to an IAM policy document

I did try to do a join on the data.aws_iam_policy_document.<stuff>.json property of multiple data sources, and mixed data sources and already rendered json documents coming in as variables in strings.

I think the root problem with this approach is that both things will render a FULL json document, so it will confuse stuff, such as:

{
  my policy doc
}
{
  my next policy doc
}

Is there a way to conditionally add statement blocks to a data.aws_iam_policy_document ?

The root cause here is that the cloudposse/terraform-aws-s3-module has some built in document handling to set an “encrypted-only” policy, so if I need to do something like add a separate cross-account access principal policy, I can’t, because an s3 bucket can only have one bucket policy attached.

I’ve forked it and attempted my above described fix here: https://github.com/asiegman/terraform-aws-s3-bucket/blob/moar-bucket-policy-0.11/main.tf#L94

But alas, that didn’t work due to the multiple json documents being joined to form invalid json.

I can always not use cloudposse’s module and just build my own resources, but if I could add a clever bit to add arbitrary statements in for stuff like this, I was going to deliver it back to the community

@Alex Siegman in 0.12 you can do this with “dynamic” loops. What you could do with 0.11 is using source_json with another aws_iam_policy_document. I don’t really like it so much but it’s a funny hack: https://github.com/doingcloudright/terraform-aws-ecr-cross-account/blob/ab55861e4de158d3bf490976c16a2bebb6661c28/main.tf#L43

Oh interesting. What happens if source json is just a blank string then~? I’ll play with it, great lead. Thanks!

also take a look at : https://github.com/cloudposse/terraform-aws-iam-policy-document-aggregator

heck, i can probably just use that, i already have multiple valid documents, i just need to aggregate all their statements in to one

Why did the release cadence change for this module? https://github.com/cloudposse/terraform-aws-vpc/releases

Hi, I do a bit of TF (0.12) + AWS. I have created a few modules: VPC, Subnets, IGW, etc. Each module outputs.tf some variables, I use S3 backend and I can access exported variables from different modules. All smooth and easy but when I create application load balancer (aws_lb) I can NOT make terraform to output any variable. My output.tf (root module dir) looks like this:

output “alb_id” { value = aws_lb.alb.id } output “alb-security-group_id” { value = aws_security_group.alb-security-group.id } output “alb-target-group_arn” { value = aws_lb_target_group.alb-target-group.arn }

The ALB, security group and target group gets created, I can see it in the console but the output is empty, no errors during terraform apply. Why?

Hi, Anybody using local persistent volume for any kubernetes_stateful_set. I am trying use affinity with ndoe_selector_term but failing. Kindly guide me if anyone using in this way.

:zoom: Join us for “Office Hours” every Wednesday 11:30AM (PST, GMT-7) via Zoom.

This is an opportunity to ask us questions on terraform and get to know others in the community on a more personal level. Next one is Aug 28, 2019 11:30AM.
Register for Webinar
#office-hours (our channel)

anybody working with terraform integration with Jenkins cicd pipeline

we use atlantis and Codefresh to deploy terraform, but here are a few articles on how to do it from Jenkins

https://dzone.com/articles/immutable-infrastructure-cicd-using-hashicorp-terr

https://devblog.xero.com/ci-cd-with-jenkins-pipelines-part-1-net-core-application-deployments-on-aws-ecs-987b8e032aa0

https://medium.com/@timhberry/terraform-pipelines-in-jenkins-47267129ff06

Hello, I was curious to see if anyone has ever tried to create a cross account aws codepipeline with terraform. If not, It would be great to get some feedback on my current approach

Does anyone use software to detect state drift on a recurring basis?

I’d like to start performing infrastructure wide Terraform state drift identification, and work towards making sure I see that excellent “No changes.” messaging after issuing a terraform plan across the board more frequently.

We just have our CI run terraform plan -detailed-exitcode, and alert on job failures…

I was looking at the detailed-exitcode option, seems good as I can get an explicit list of terraform projects that are having issues. I’d like to go a step further so I can reduce operator work around identification and fixing of the state drift manually.

Only saw a few project on GitHub, none of them maintained.

Cheap and easy and works was my thinking, can always optimize later

Could save off the plan, and analyze it separately. Maybe whitelist some resources/diffs to run apply automatically

The Foqual bot was able to find some information regading GitHub Actions to perform plans, could be a good starting point for me.

Yeah, very much MVP for this drift detector - iterate later

Thanks for the ideas, I’ll think about this some more and see how to approach this

Hi, should this module : https://github.com/cloudposse/terraform-aws-cloudwatch-logs when a CMK key gets passed to create a policy to be able to use that key ?

Hi All, I’m creating a bucket policy data resource (https://www.terraform.io/docs/providers/aws/r/s3_bucket_policy.html)

I’m running into an issue where I’m trying to reference the ‘json’ attribute of the data source in a policy account resource, can anyone help me with the below?

I’m getting the error that it’s an empty tuple, not sure what I’m doing wrong here..

@Callum Robertson what about you do at line16 the same as line 2, so the count’s are in sync

or what is the idea there, that you only want to apply the policy when var.upload_bucket_objects is set to true, correct ? What happens now is that you refer to a policy you are not creating hence it fails.

encountered the following error when running terraform apply?

[3:57 PM] “policy” contains an invalid JSON: invalid character ‘a’ looking for beginning of value

Thanks @maarten, I think it’s the case of starting at a problem for to long

I fixed it with the following if anyone is interested

Can’t recall but when you create an AWS SG rule with terraform and you do something like count index vs creating separate rules, which one doesn’t delete the whole sg and create a new one? Instead of creating a new sg every time I’d like to just keep adding/removing ports if needed.

from_port = "80" vs from_port = var.allowed_ports[count.index]

I know in your tf you do the second one. let me know! Thank you!

@pericdaniel when you create a separate aws_security_group w/o rules, you can add as many aws_security_group_rule as you need w/o recreating the whole SG

https://github.com/cloudposse/terraform-aws-emr-cluster/blob/master/main.tf#L196

#office-hours starting now! https://zoom.us/j/508587304

Curious, are you all using or looked into dependabot for terraform module dependencies - https://dependabot.com/terraform/

for the cloudposse modules, I got all these working with 0.12: https://github.com/cloudposse/terraform-aws-ec2-autoscale-group/pull/14 https://github.com/cloudposse/terraform-aws-eks-workers/pull/21 https://github.com/cloudposse/terraform-aws-eks-cluster/pull/20

I forgot to update the version for CI to 0.12, will try and push that out

I am using them and they are working

but could use some help to get the rest of the work done (porting examples and adding the new CI stuff)

except… looking around, I have no idea how to get it 0.12 to run as part of the things

Error: The role “arniam:role/gc-invoicedataimport-function-role” cannot be assumed. There are a number of possible causes of this - the most common are:

* The credentials used in order to assume the role are invalid

* The credentials do not have appropriate permission to assume the role

* The role ARN is not valid

Do you need to use version Terraform 0.11 when bootstrapping with the reference-architectures?

Hey folks. Is there a way to use a merge or use a splat-type operator in a terraform child block (not identifier values) ? i.e.

data "aws_ami" "potato" {
  filter {
    ...local.default_filters
  }
}

I’m effectively trying to filter merge(local.thing, {})

So, when you’re creating an ECS service, you either have the choice between using an ALB or not.

If you’re using an ALB, you need to pass in additional objects for the load_balancer parameter, example here: https://www.terraform.io/docs/providers/aws/r/ecs_service.html#example-usage

How would you structure a module to make this object parameterized and optional?

I guess this kind of answers my question: https://github.com/blinkist/terraform-aws-airship-ecs-service/blob/master/modules/ecs_service/main.tf

just create a ton of these different ecs_service resources based on how they’re configured.

The variable “lambda_settings” is required, so Terraform cannot proceed without a defined value for it. “ - any idea about this

:zoom: Join us for “Office Hours” every Wednesday 11:30AM (PST, GMT-7) via Zoom.

This is an opportunity to ask us questions on terraform and get to know others in the community on a more personal level. Next one is Sep 04, 2019 11:30AM.
Register for Webinar
#office-hours (our channel)

Hey all! New to terraform, I’m trying to do some acm cert validation using : https://www.terraform.io/docs/providers/aws/r/acm_certificate_validation.html

In the link, they show the following r53 record for cert validation being created:

resource "aws_route53_record" "cert_validation" {
  name    = "${aws_acm_certificate.cert.domain_validation_options.0.resource_record_name}"
  type    = "${aws_acm_certificate.cert.domain_validation_options.0.resource_record_type}"
  zone_id = "${data.aws_route53_zone.zone.id}"
  records = ["${aws_acm_certificate.cert.domain_validation_options.0.resource_record_value}"]
  ttl     = 60
}

Specifically, aws_acm_certificate.cert.domain_validation_options.0.resource_record_name , I create my acm certs(Specifically 2) like this:

resource "aws_acm_certificate" "cert" {
  provider          = "aws.acm"
  domain_name       = "*.${var.domain}.${element(var.certs, count.index)}.${var.aws_env == "prod" ? "com." : "test."}"
  validation_method = "DNS"

  tags = "${local.required_tags}"

  lifecycle {
    create_before_destroy = true
  }
  count = "${length(var.certs)}"
}

How would I be able to reference each cert for validation?

This looks correct

what looks correct?

I dont know how to reference each cert for validation

@Brij S you are missing a resource - let me find it

ah, I see what you mean … you will need to somehow loop over all of your certs and specify a aws_acm_certificate_validation resource for each one…

yeah.. thats the tricky part

not sure how to facilitate that

@Brij S are you using terraform 0.12+?

no, TF 0.11

it might be impossible to do this, since the count for resource "aws_route53_record" "cert_validation" will not be able to be <computed>, i.e. can’t dynamically set to the cert count iirc

What are you guys toughs on Terraform enterprise ?

is it worth it ?

@sarkis right! that makes sense, any thoughts on how to go forward with this then

@Brij S i’d say if you want to continue to go with this dynamically, TF 0.12 upgrade may be the only option… otherwise only way I can think of solving this in 0.11 is to have static cert_validations - hopefully someone can prove me wrong here

ok, if I was on TF 0.12, how would you go about it

you just count over the variable input again, length(var.certs)

but how would i reference it?

aws_acm_certificate.cert.domain_validation_options.0.resource_record_name refers to..one cert?

you want to create a route53 record for each certificate?

yep

because for me aws_acm_certificate.cert contains two certs (corresponding to two zones)

@loren this is awesome, would the following be the same too then?

resource "aws_acm_certificate_validation" "cert" {
  certificate_arn         = "${aws_acm_certificate.cert.arn}"
  validation_record_fqdns = ["${aws_route53_record.cert_validation.fqdn}"]
}

something like that, can also use element(...) interpolation

need the wildcard to reference all the resources…

resource "aws_acm_certificate_validation" "cert" {
  certificate_arn         = "${aws_acm_certificate.cert.arn}"
  validation_record_fqdns = ["${aws_route53_record.cert_validation.*.fqdn}"]
}

there are also more syntax options in terraform 0.12

"${aws_acm_certificate.cert.arn}" would be "${aws_acm_certificate.cert.*.arn[count.index]}" ?

validation_record_fqdns is a list, so i think you want a single resource there, not multiple with count. just pass the list of all fqdns to the parameter, rather than a single one (using count.index)

if you do want a aws_acm_certificate_validation resource per cert though, then yes, same setup

@loren mind if I DM you for more questions? Just want to confirm some things to make sure I understand

Hi Guys

I have some issue when running terraform validdate on this modules terraform-null-label

hi @Phuc

Does anyone expenrienced this before ?

  terraform-null-label git:(0.11) ✗ terraform validate

Error: local.generated_tags: local.generated_tags: zipmap: count of keys (1) does not match count of values (0) in:

${zipmap(
    compact(list("Name", local.namespace != "" ? "Namespace" : "", local.environment != "" ? "Environment" : "", local.stage != "" ? "Stage" : "")),
    compact(list(local.id, local.namespace, local.environment, local.stage))
    )}

I didn’t adjust anything

just running simple command to validate at first

what TF version?

for 0.11 and below

I clone the repo on branch 0.11/master

how do you use it? show the example

actually I didn’t used it yet

I just try to validate the code first to see if there is error

just simple terraform init then terraform validate

and that error coming up

@Andriy Knysh (Cloud Posse) Is there any possibility to support TF12 for https://github.com/cloudposse/terraform-aws-ec2-bastion-server module ? I can’t find any issue regarding this?

Can I know estimation time for this PR to be merged - https://github.com/cloudposse/terraform-aws-multi-az-subnets/pull/16 ? Also TravisCI is failing because it checks this TF12 upgrade PR in TF11 binary.

Hello all, I’m trying to do acm cert validation(multiple at a time) and I’m running into some issues.

resource "aws_route53_record" "cert_validation" {
  count   = length(var.certs)
  name    = aws_acm_certificate.cert[count.index].domain_validation_options.0.resource_record_name
  type    = aws_acm_certificate.cert[count.index].domain_validation_options.0.resource_record_type
  zone_id = aws_route53_zone.zones[count.index].id
  records = ["${aws_acm_certificate.cert[count.index].domain_validation_options.0.resource_record_value}"]
  ttl     = 60
}

the above code..kinda works? when I apply this, I get the following error:

Error: Invalid index

  on ../modules/bootstrap/acm_validation.tf line 4, in resource "aws_route53_record" "cert_validation":
   4:   type    = aws_acm_certificate.cert[count.index].domain_validation_options.0.resource_record_type
    |----------------
    | aws_acm_certificate.cert is tuple with 2 elements
    | count.index is 0

The given key does not identify an element in this collection value.


Error: Invalid index

  on ../modules/bootstrap/acm_validation.tf line 6, in resource "aws_route53_record" "cert_validation":
   6:   records = ["${aws_acm_certificate.cert[count.index].domain_validation_options.0.resource_record_value}"]
    |----------------
    | aws_acm_certificate.cert is tuple with 2 elements
    | count.index is 0

The given key does not identify an element in this collection value.


Error: Invalid index

  on ../modules/bootstrap/acm_validation.tf line 6, in resource "aws_route53_record" "cert_validation":
   6:   records = ["${aws_acm_certificate.cert[count.index].domain_validation_options.0.resource_record_value}"]
    |----------------
    | aws_acm_certificate.cert is tuple with 2 elements
    | count.index is 0

The given key does not identify an element in this collection value.

But when I do destory, it seems its creating at least 1..

module.nonprod.aws_route53_record.cert_validation[1]: Still destroying... [id=Z3FZBH8XNPPPYT__3aedbf37656ebde46d6db19a4f38212c.test-api.dev._CNAME, 30s elapsed]
module.prod.aws_route53_record.cert_validation[1]: Still destroying... [id=Z2IAS5UODUXPHA__73016316fbab15ae3d5db4d2b9b240c8.test-api.com._CNAME, 30s elapsed]

any ideas?

what version of TF? what’s type of var.certs? If it’s a list of string, how many items are in it?

Saw on Reddit: https://www.reddit.com/r/Terraform/comments/cwgy7r/i_created_a_visualizer_for_terraform_project_cc/

#office-hours starting now! join us here https://zoom.us/s/508587304

how would this line be turned into ‘tf 12 syntax “*.${var.domain}-${element(var.certs, count.index)}.${var.aws_env == “prod” ? “com.” : “dev.”}”`

Hi everyone! We are currently using the terraform-null-label module for labels in Terraform but we are running into an issue when updating our code to v0.12 We pass “context” between modules so we have a variable defined in the module called “tags_context” and type: map This was upgraded to type: map(string) by Terraform but then the plan doesn’t work What type should the context variable be in v0.12?

@Joshua Snider see #announcements

nvm, it was answered in #announcements