#terraform (2023-12)

the redis module needs to be updated to use the latest version of the SG module. PRs are welcome, thanks

https://github.com/cloudposse/terraform-aws-elasticache-redis/pull/210

@Andriy Knysh (Cloud Posse)

@Andrew den Hertog thanks for all the changes, please address the last comment

I’m used to having a pre-commit hook run terraform format for me , I’ve done so, and pushed the changes

@Andrew den Hertog the PR is approved and merged, thanks

Thanks

Heres the code I inherited…I should also note that I already know there should be 5 cidrs that show up here for each subnet we have.

data "aws_subnet" "cidr" {
  for_each = toset(data.aws_subnets.public.ids)
  id       = each.value
}

data "aws_subnets" "public" {
  filter {
    name   = "vpc-id"
    values = [var.vpc_id]
  }

  filter {
    name   = "tag:Name"
    values = ["${var.environment}-public-*"]
  }

  tags = {
    Type = "Public"
  }
}

resource "aws_security_group" "security_group" {
  name        = var.instance_role
  description = "${var.instance_role} ${var.environment}"
  vpc_id      = var.vpc_id
  lifecycle {
    create_before_destroy = true
  }

  ingress {
    description = ""
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = [data.aws_subnet.cidr.*.cidr_block]. <-- NOT SURE WHAT I NEED TO PUT HERE
  }
}

There is also this in the code but im not sure how it fits in with any of this really…

locals {
  subnet = {
    ids   = [for s in data.aws_subnet.cidr : s.id]
    cidrs = [for s in data.aws_subnet.cidr : s.cidr_block]
  }
}

Figured it out finally…this got me what i was looking for. `

    cidr_blocks = [ for subnet in data.aws_subnet.cidr : subnet.cidr_block ]

`

@setheryops do you still need help here?

Nah…I figured it out in a hacky workaround. After the fact I found out that the devs didnt need one of the subnets/cidrs so that made it easier. Thanks though.

Update in place term means the resource (the instance in this case) will simply be updated. It will not be replaced.

Also indicated by the ~ prefixing the resource label

Thats what I was thinking but wanted to make double sure

A replacing update would be noted by -/+

yep

Is this what you are looking for? https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#backup_retention_period

You also have read replica settings further down on that page too.

That’s the fun part about AWS Backup. The capitalized version is a (little known) service in AWS, but many of the other services have their own redundant (lower-case) backup features. Makes it near impossible to search for!

I’m actually interested in figuring out how to implement AWS Backup in terraform for an RDS instance.

Ahhh

Theres this…not sure what you have looked at so far… https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_framework

Ive never used this service so thats all I got

Yeah i’m trying to navigate all the options under the AWS Backup terraform pages, but there are many and i’m kind of a noob.

You will wind up making what they call a backup plan resource. Backup drives many of those per service backup features but in a more global and uniform way. Backup goes above and beyond those service specific backup features in many cases. The backup plan resource will typically match on a tag. E.g. tag resources with BackupPlan=my-cool-plan

Backup is a neat service for sure

Main resources to use are https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_plan and https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_selection

Your selection selects things and assigns them to a backup plan.

examples of TF modules and components that use AWS backup:

https://github.com/cloudposse/terraform-aws-backup/tree/main

https://github.com/cloudposse/terraform-aws-backup/tree/main/examples/complete

https://github.com/cloudposse/terraform-aws-components/tree/main/modules/aws-backup

thank you all!

spacelift, Scalar

DiggerHq

@jose.amengual @loren Does they gives better than Hashicorp Cloud when we talking about the most suitable option based on the criterias ?

Hashicorp cloud is VERY expensive compared to all the other services mentioned

I dont mind at prices currently

if you use Cloudposse modules I will recommend to go with Spacelift

I know you do not mind prices, but the owner of the company does, and maybe you have money now, but what about later? What if you do not have the same budget down the road and then you are asked to cut costs and you have to work overtime to switch to another provider? that will be far most costly later

and do not get me wrong I have stocks in Hashicorp and I’m a Maintainer of Atlantis

you absolutly right but Thats something we will consider only after ordering the solutions

i dont come here to ask for pricing since its not the place to do it so i want to know the best suitable solution for managing cloud infra, and then we will check later for costs

We’ll also takes into consideration the maintainability costs but its another topic

they all get the job done. you’ll need to read the docs and think about your use cases and desired workflow to figure out which will be “best” for you…

Check out Terrateam https://terrateam.io/ – disclaimer: I’m the co-founder. But we fit your use case.

Forgot to mention that we are using Terragrunt to simplify the IaC, but it’s not mandatory if you know some equivalent/better solution

spacelift, env0, terrateam, etc. support terragrunt

@Josh Pollara thanks

@kfirfer Where are you located? While the alternate TACOS may be viable options for you, it’d be a good idea for one of HashiCorp’s technical teams to at least chat with you about your requirements and where we can help. Feel free to DM me and I can put you in touch with the proper folks. I’m also happy to have an initial conversation with you if you’d like (I’m a Field CTO for HashiCorp and have been here just short of 6 years).

Have you thought about triggering the Well-Architected Tool on milestones or a schedule instead, to track your implementations over time (and worry less about your starting point) ? I like this idea, managing WAT resources from terraform-provider-aws: Support for Well Architected Tool resources #29755

There’s also aws-samples/aws-startup-landing-zone-terraform-example, fwiw (looks quiet).

it’s probably not possible since the error is from AWS, not from terraform

unless you use a wildcard, but that’s less secure

You could perhaps use a data source to lookup the principal and validate that it exists? It will at least error on plan that way, instead of on apply

I tried refresh, deleting the .terraform dir, moving the Account out of the child Org to the root before importing, disabling the SCPs, and updating to latest provider version and nothing

and I’m a root user on the Management account

still does not work

Unusual… Haven’t tried myself… suggest opening a bug report?

it is interesting, I see it in the state on another resource but I believe is from a data lookup since is a list instead of the indexed map where is supposed to be

I just moved all this account under the root just to see if that will make a difference

and nothing

is it possible that the index need to exist before importing?

if NEWINDEX does not exist it should create it anyways, no?

Yeah, if the index exists, it’s not really an import…

in my case it does not exist

do indexes have name length limits?

the import works even if I pass the wrong id

That definitely sounds wrong

I even switched to TF 1.6, nothing

this must be a bug

This is not cool, the last thing I needed today

Maybe try different AWS provider versions

I tried, 4 and 5 versions

interesting….

I created another resource, no for_each

I try the import and it worked

Huh

that is after the import

state list

then a state move and now I have it in the right place

OMG what a pain

Very strange

that worked

@RB

Did the emails have to align with the convention or did they trigger a recreation due to the emails not aligning with the cp convention?

emails did not manage the new convention

which is similar to the cp convention

Is he going to contribute to OpenTofu?

Also related https://sweetops.slack.com/archives/CB2PXUHLL/p1702595232445629

that is the new stuff they announced

anyone have tried this and know if is yet available in TF?

@Matt Calhoun @bradj

using the cloudtrail component

cloudtrail-bucket and deployed and the cloudtrail component can find it

mmm I had null tags

maybe these links will help:

https://awstip.com/resolving-the-no-new-non-vpc-ec2-eips-can-be-created-issue-with-terraform-on-aws-60d03e941a51

https://discuss.hashicorp.com/t/error-with-the-retirement-of-ec2-classic-no-new-non-vpc-ec2-eips-can-be-created/44064

the https://github.com/cloudposse/terraform-aws-dynamic-subnets module def has vpc = true set on resource "aws_eip" so this is not an issue in the module (it gets deployed all the time in many infras).

maybe you still have some EC2-Classic resources:

https://aws.amazon.com/blogs/aws/ec2-classic-is-retiring-heres-how-to-prepare/

https://github.com/aws-samples/ec2-classic-resource-finder

you mean you want the same zone in two different accounts? i don’t think that works…

Hm

@Dan Miller (Cloud Posse)

the top-level zone in one account, and a sub-zone in another is pretty easy to setup. but i don’t think you can have the same top-level zone in two different accounts…

So in order to provision a record, I would need access to both the management account and child account. Right?

in order to provision a subzone, you need access to both the management and child accounts. once the subzone exists, no access is needed to the management account to create records.

basically you create the subzone in the child account, and the ns delegation records in the management account, and it’ll work

we’ve done it for years now with this module, https://github.com/plus3it/terraform-aws-tardigrade-route53-zone

we do something similar. we have a primary zone in a dns account and then delegated zones in each child account. for example, example.com in a dns account and dev.example.com or prod.example.com in the child accounts

the apex zone can really be anywhere, but we choose to put it in an isolated account to managed access easily. Plus we usually purchase domains from aws in that same account

seems like a good practice to have a single account for DNS.

Or a shared services account?

we have a single account for each type of service, but that’s up-to-you of course. for example 1 account for DNS, 1 account for network (TGW, VPN, etc), 1 account for automation (github runners, spacelift, etc). We have more than a dozen accounts because of this

Damn

Do you have a catch all mailbox for aws-* lol

yup! we use plus addressing. for example

[email protected]
[email protected]
[email protected]
[email protected]

with plus addressing you can have 1 actual email, but all accounts connected to the same

Also note that a given zone and it’s records will have to be in one account. But you can seperate the management of a zone and the records in those zones into different terraform configurations.

Such as one configuration and automation that has the ability to create a zone, while another configuration and automation with lower privileges managed by the service owners of that domain to manage their records.

https://github.com/cloudposse/terraform-aws-components/blob/af8a534e03c9b21568d62d[…]6c4f7c1d6b58adb33/modules/eks/actions-runner-controller/main.tf

do you mean the eks/action-runner-controller component or the eks/github-actions-runner component? these are 2 different components. eks/arc is the previous implementation of the mumoshu chart, whereas eks/github-actions-runner is the brand new implementation using the GitHub supported solution

The new implementation

that comment above is for the old implementation, and the new implementation doesnt have a default policy added

oh! let me check out the new one

For example, I’m trying to setup the Audit Log settings via Terraform, but can’t even find an audit log resource in the provider.

I didn’t set up Cloud but on-prem with Ansible before, after a quick look, did you set up ``base_url?

I was going to use base url, with the one provided in enterprise cloud, but stopped when I couldn’t find a terraform resource for the audit logs.

baseUrl seems like it’s required for on-prem, so makes sense that i would have to use it for cloud enterprise as well.

does on-prem have audit logs as well?

it should have, a basic requirement

I believe the official provider has a lot of issues. I know Mineiros forked it, but it looks not maintained. https://github.com/mineiros-io/terraform-github-repository

Thanks @Erik Osterman (Cloud Posse) that is still interesting to look at regardless.

seems you need k8s ingress controller

ECS cannot do dynamic

@Dan Miller (Cloud Posse)

sorry no I havent used that provider myself

If you’re talking about this https://registry.terraform.io/providers/mongodb/mongodbatlas/latest/docs that documentation looks rather dubious

I’d think twice about following any instructions from that documentation