37

Terraform doesn't have direct support for this sort of nested iteration, but we can fake it with some arithmetic. variable "list_of_allowed_accounts" { type = "list" default = ["1111", "2222"] } variable "list_of_images" { type = "list" default = ["alpine", "java", "jenkins"] } data "template_file" "ecr_policy_allowed_accounts" { count = "${...


10

Your first question if my provider setting is explicitly declaring the credentials to use inside the Terraform source code, why does my OS-level AWS configuration matter at all? The error message "Failed to load backend: Error configuring the backend "s3"" is referring to your Backend S3 configuration. Look in the file ./.terraform/terraform.tfstate ...


9

There are two problems that need to be overcome to use the same terraform configurations in multiple AWS accounts. The first, is that you will need to use a different state file for each account. The second, will be making sure the AWS provider uses the correct profile/credentials for the desired account. Using a different state file for each account At ...


8

The answers here do work (I used them initially), but I think I have a better solution using Terraform's setproduct function. I haven't seen many examples of it used around the interwebs, but setproduct takes two sets (or more importantly, two lists) and produces a list of sets with every permutation of the inputs. In my case I am creating SSM parameters: ...


7

I was missing the module path on my command. More details here. This is the right way to write it: terraform taint -module=MODULENAME TYPE.NAME For instance, if my module was named hosting: module "hosting" { ... } And if I wanted to taint the following resource: resource "null_resource" "provision_last" { ... } I would need to do the ...


7

Terraform does not run the ssh command line tool nor use OpenSSH as a library. Instead, it uses an alternative SSH client implementation written in Go. By default this SSH client does not do any host verification, and Terraform does not override this default. Thus it is not necessary to verify the host id as you would on the first connection with ssh. This ...


5

FYI if anyone comes here from Google, if you are using terraform 0.12, you will need to use the floor function anywhere you do divide, or else you will get an error about partial indexes. account_id = var.list_of_allowed_accounts[floor(count.index / length(var.list_of_images))]


5

The AWS APIs use an authentication mechanism that involves the client creating a signature representing the request. This signature includes a timestamp of the time the request is being made, as a measure to reduce the risk of replay attacks. The signature mechanism assumes that the client and server both have somewhat-accurate system clocks, such that the ...


5

There's no simple answer to this question. Using an architecture designed around images (commonly referred to as "immutable infrastructure") works fantastically for stateless services, like your application servers. It's most definitely possible to expand that to your stateful services with the right tools, failover systems and upgrade paths, but those are ...


5

If you have recommendations on how to do this better, then please submit an answer so I can do better next time. My example here will closely reflect the situation I was in. In particular, the S3 bucket I wanted to interact with was already defined and I didn’t want to give Glue full access to all of my buckets. The first component is the role itself. ...


5

Try using the target_group_arns option on the ASG. resource "aws_autoscaling_group" "asg" { name = "test" vpc_zone_identifier = ["${data.aws_subnet.sn-app-1.id}","${data.aws_subnet.sn-app-2.id}"] min_size = 1 desired_capacity = 1 max_size = 3 launch_configuration = "${aws_launch_configuration.lc.name}" target_group_arns = ["${...


5

This happends because storage account name is UNIQUE in all Azure, try something more unique :) Like: functions12df3f4g or rebgh35h3brw4t3ghr


5

This is expected behavior. Look at the paths being fetched in both instances - Instance1 10.0.21.217:31904 "GET /favicon.ico HTTP/1.1" 200 58 Instance2 10.0.21.217:47620 "GET / HTTP/1.1" 200 58 The second one fetches the page itself and the first request fetches the favicon of the page. When you deploy a web app, the browser makes separate requests ...


5

It seems that this is the answer # Required Variables variable "request_vpc_id" {} variable "accept_vpc_id" {} variable "request_region" {} variable "accept_region" {} data "aws_caller_identity" "current" {} provider "aws" { region = "${var.request_region}" } provider "aws" { alias = "peer" region = "${var.accept_region}" } # Requester's side ...


4

For your second disk, you want to use disk = "sql-server-secondary" instead of image as the identifier. Also, it's best to reference the second disk using Terraform's interpolation syntax (e.g. ${...}) to ensure your resources are created and managed in the appropriate order. resource "google_compute_disk" "sqlserversecondary" { name = "sql-server-...


4

The aws_instance resource in the example does not have the subnet_id attribute provided, so the instance would launch into your account's default subnet for the target region. It's likely that the default subnet is not the one you were trying to use, and so it has a different IP address range. To fix this, determine the appropriate subnet id and add a ...


4

No you cannot do that. You need to return the login values from the module so you can setup a provider outside the module using those values. I would just edit the module and do what you need inside the module so you don't have to output those things.


4

There is no way to do this at the moment, you will have to go with the parameter.


4

Sometimes Terraform can be too complicated too ;) Plenty reasons why you'd want to use CloudFormation instead: Whether it's complicated or not depends on one's experience. CFN doesn't feel complicated to me. It's AWS native tool, specifically developed for deploying AWS services. Often has a better support for less common services. AWS Support can help ...


4

You could try using ignore_changes within a lifecycle configuration block for the specific resource. Note, this cannot be done at the module level, but only per-resource. An example of how it could be used is as follows, where the attribute "acl" would be ignored after initial resource creation: resource "aws_s3_bucket" "bucket" { name = "test-bucket" ...


4

There is no way around having an Elastic IP for those NAT Gateways, it is probably because the Gateways can be restarted and recreated automatically (and therefore reduce the interruption by hanging onto the same IP) An EIP does not cost extra when attached, so you only need to make sure to release them once your NAT Gateway is removed. In some situations ...


3

Turns out I needed to set the service to ecs.amazonaws.com and not ec2.amazonaws.com in my aws_iam_role. I'd tried this before, but didn't specify sufficient in the aws_iam_role_policy . It's very much like this issue on the AWS forums. resource "aws_iam_role" "beatthemarket" { name = "beatthemarket" assume_role_policy = <<EOF { "Version": "...


3

Supposed solutions: Option 1: Your ASG should be created with instance protection ON - Terraform docs In this case, we could have next sequence of operations for instance decommission: Perform decommission of particular instance(s)(remove data from it(them)) Reduce count of ASG's size by desirable value Apply Terraform state Remove protection flag from ...


3

There are two possible ways to achieve what you want: Option 1: Suspend Auto Scaling Processes You can put the Auto Scaling group's processing "on hold" while you are making your adjustments. For example, you could try: Pause Auto Scaling processing: aws autoscaling suspend-processes --auto-scaling-group-name MyGroup Decommission and terminate your EC2 ...


3

Chances are you have the wrong sshKey set in your project. Assuming you have something like the following attached to either your provisioner or resource: resource "google_compute_instance" "my-host" { // ... connection { type = "ssh" agent = false user = "${var.gce_ssh_user}" port = "${var.gce_ssh_port}" ...


3

The general solution to this class of problem is the ignore_changes lifecycle setting, which causes Terraform to ignore changes to specific attributes when creating a plan. resource "google_compute_disk" "blog" { image = "ubuntu-1604-lts" lifecycle { ignore_changes = ["image"] } } With this in place, Terraform will not automatically plan to ...


3

Yes this is how terraform works. It looks at its state file for what it knows should be the state of your infrastructure and then it queries the API for what it currently is and basically does a diff and tells you this is what changed and I'm going to change this to make it the state you told me. Of course you are using ASGs that can change dynamically. So ...


3

Your issue is default = ["${aws_instance.my_instance1.id}", "${aws_instance.my_instance2.id}", "${aws_instance.my_instance3.id}", "${aws_instance.my_instance4.id}", "${aws_instance.my_instance5.id}"] That either has to be passed in or set statically. If my_instance1-5 are the same and can be set with a count in them like above. Then its better to do ...


3

Terraform supports multiple providers provider.tf # default provider provider "aws" { access_key = "foo" secret_key = "bar" region = "us-east-1" } provider "aws" { alias = "aws-assume" assume_role { role_arn = "arn:aws:iam::ACCOUNT_ID:role/ROLE_NAME" session_name = "SESSION_NAME" external_id = "EXTERNAL_ID"...


3

The error is that you have specified two arguments to a aws_launch_configuration resource which aren't valid; namely ami and vpc_security_group_ids, see the documentation for what's valid. I suspect you've changed from using a single aws_instance resource to an aws_launch_configuration resource, however they don't use the same arguments.


Only top voted, non community-wiki answers of a minimum length are eligible