Terraform "ocasional" variable - amazon-web-services

I have built the following Route 53 module to create a weighted record along with healthcheck:
resource "aws_route53_health_check" "health_check" {
for_each = var.weighted-records
ip_address = each.value.ip_address
fqdn = each.value.fqdn
port = each.value.port
type = each.value.type
resource_path = each.value.resource_path
failure_threshold = each.value.failure_threshold
request_interval = each.value.request_interval
search_string = each.value.search_string
measure_latency = each.value.measure_latency
invert_healthcheck = each.value.invert_healthcheck
tags = {
Name = format("chk-%s", each.value.name)
}
}
resource "aws_route53_record" "weighted_record" {
for_each = var.weighted-records
zone_id = each.value.zone_id
name = each.value.dns_name
type = each.value.dns_type
ttl = each.value.ttl
health_check_id = aws_route53_health_check.health_check[each.key].id
weighted_routing_policy {
weight = each.value.weight
}
set_identifier = each.value.name
records = [each.value.ip_address]
}
In most cases, my Health check IP is the same as the destination IP, so I use the same VAR: each.value.ip_address.
However, in some cases, I need to specify a different IP for a health check.
Is there a way to avoid introducing a new VAR for health check IP and put it in every record I build? I would like to have the VAR specified only if required.
I was hoping to use either "dynamic" or "try" functions.

Usually you specify optimal variables, by creating some default value for them:
variable "new_ip" {
default = ""
}
Then you check if the new_ip was provided or not:
ip_address = var.new_ip != "" ? var.new_ip : each.value.ip_address

Related

Error Using Variable as a Tag in Terraform

I have a question about tags in Terrafrom. I have this variables, and I'd like to use the Transit variable description name as a tag in my main.tf file. How do I go about it?
#VPC CIDRs
variable "All_VPCs" {
type = map(any)
default = {
Dev_VPC = {
ip = "10.0.3.0/24"
instance_tenancy = "default"
}
Transit_VPC = {
ip = "10.0.4.0/23"
instance_tenancy = "default"
description = "Transit_VPC"
}
}
}
I used this, but it didn't work.
resource "aws_internet_gateway" "Transit_Internet_Gateway" {
vpc_id = var.All_VPCs.Transit_VPC
tags = {
Name = "${var.All_VPCs.Transit_VPC.description}" + " Internet_Gateway"
}
You can't concatenate strings in Terraform with a + operator. The correct method of doing this is to use string interpolation (which you are already partially doing):
tags = {
Name = "${var.All_VPCs.Transit_VPC.description} Internet_Gateway"
}

Terraform: Iterating list for AWS Certificate validation with Cloudflare DNS

I have a map in a tfvars file that contains, Cloudflare zone id, site address, and zone (domain), I am wanting to iterate through that map, generating an ACM certificate, with a certificate validation DNS record being created in Cloudflare.
My map looks like this;
my_domains = {
example1 = {
cloudflare_zone_id = "00000000000000000000000000001"
address = "dev.example1.com"
domain = "example1.com"
}
example2 = {
cloudflare_zone_id = "0000000000000000000000000000002"
address = "dev.example2.com"
domain = "example2.com"
}
example3 = {
cloudflare_zone_id = "0000000000000000000000000000003"
address = "dev.library.example3.com"
domain = "example3.com"
}
}
I then have the following code for the certificate creation and validation:
resource "aws_acm_certificate" "my_certs" {
for_each = var.my_domains
domain_name = each.value.address
validation_method = "DNS"
subject_alternative_names = [
"*.${each.value.address}"
]
lifecycle {
create_before_destroy = true
}
}
resource "cloudflare_zone" "my_zone" {
for_each = var.my_domains
zone = each.value.domain
type = "full"
}
resource "cloudflare_record" "my_certificate_validation" {
for_each = {
for dvo in aws_acm_certificate.my_certs.domain_validation_options : dvo.domain_name => {
name = dvo.resource_record_name
record = dvo.resource_record_value
type = dvo.resource_record_type
}
}
zone_id = cloudflare_zone.my_zone.id
name = each.value.name
value = trimsuffix(each.value.record, ".")
type = each.value.type
ttl = 1
proxied = false
}
When I run a plan, I get the following errors:
Error: Missing resource instance key
on cfcertvalidation.tf line 23, in resource "cloudflare_record" "my_certificate_validation":
23: for dvo in aws_acm_certificate.my_certs.domain_validation_options : dvo.domain_name => {
Because aws_acm_certificate.my_certs has "for_each" set, its attributes must be
accessed on specific instances.
For example, to correlate with indices of a referring resource, use:
aws_acm_certificate.my_certs[each.key]
Error: Missing resource instance key
on cfcertvalidation.tf line 30, in resource "cloudflare_record" "my_certificate_validation":
30: zone_id = cloudflare_zone.my_zone.id
Because cloudflare_zone.cdt has "for_each" set, its attributes must be
accessed on specific instances.
For example, to correlate with indices of a referring resource, use:
cloudflare_zone.my_zone[each.key]
Note: I added the cloudflare_zone resource rther than using the zone id already in the map as a way to simplify things in troubleshooting.
I am sure the answer is in the suggestion for using a [each.key], but I'm not sure how to implement it.
Any assistance would be greatly appreciated.
I have changed the map somewhat for my solution, so for completeness I have included the changed map here:
variable "my_domains" {
type = map(any)
default = {
example1 = {
cf_zone_id = "0000000000000000000000000000"
address = "example1.com"
zone = "example1.com"
}
example2 = {
cf_zone_id = "0000000000000000000000000000"
address = "example2.com"
zone = "example2.com"
}
example3 = {
cf_zone_id = "0000000000000000000000000000"
address = "library.example3.com"
zone = "example3.com"
}
}
}
What follows is the working solution, we start out by creating a local variable of type list, looping through the my_domains map to get the cert validation records we need. That then gets converted into a map, which is then used by the cloudflare_record resource to create the relevant DNS entries.
resource "aws_acm_certificate" "my_certs" {
for_each = var.my_domains
domain_name = "${var.env_url_prefix}${var.my_domains[each.key] ["address"]}"
validation_method = "DNS"
subject_alternative_names = ["*.${var.env_url_prefix}${var.my_domains[each.key]["address"]}"]
lifecycle {
create_before_destroy = true
}
}
locals {
validation = [
for certs in keys(var.my_domains) : {
for dvo in aws_acm_certificate.my_certs[certs].domain_validation_options : dvo.domain_name => {
name = dvo.resource_record_name
value = trimsuffix(dvo.resource_record_value, ".")
type = dvo.resource_record_type
zone_id = var.my_domains[certs]["cf_zone_id"] # Get the zone id
}
}
]
# transform the list into a map
validation_map = { for item in local.validation : keys(item)[0] => values(item)[0]
}
}
resource "cloudflare_record" "my_cert_validations" {
for_each = local.validation_map
zone_id = local.validation_map[each.key]["zone_id"]
name = local.validation_map[each.key]["name"]
value = local.validation_map[each.key]["value"]
type = local.validation_map[each.key]["type"]
ttl = 1
proxied = false #important otherwise validation will fail
}

Terraform syntax help to include instance ids from two instances to a single array

This is how my code looks,
module "alb_api" {
source = "./modules/load-balancer"
env = "${lower(var.env)}"
project = "api"
vpc_id = "${data.aws_vpc.main.id}"
public_subnet1_id = "${var.public_subnet1_id}"
public_subnet2_id = "${var.public_subnet2_id}"
health_check_target_group_path = "/status"
certificate_arn = "${var.certificate_arn}"
alb_target_group_port = "1984"
current_ec2_instance_ids = "${aws_instance.ec2[*].id}"
next_ec2_instance_ids = "${aws_instance.next_ec2[*].id}"
}
I need to be able to combine instances Ids from two instances to a single array
Expectation
ec2_instance_ids = "${aws_instance.ec2[*].id},${aws_instance.next_ec2[*].id}"
This give me a syntax error, Is it possible to achieve this ? what would be the proper syntax is so ?
Inside the module I'm registering these instances to a load-balancer, code below
resource "aws_alb_target_group_attachment" "alb_target_group_attachment" {
count = length("${var.current_ec2_instance_ids}")
target_group_arn = "${aws_alb_target_group.alb_target_group.arn}"
target_id = "${var.current_ec2_instance_ids[count.index]}"
port = "${var.alb_target_group_port}"
}
resource "aws_alb_target_group_attachment" "next_alb_target_group_attachment" {
count = length("${var.next_ec2_instance_ids}")
target_group_arn = "${aws_alb_target_group.alb_target_group.arn}"
target_id = "${var.next_ec2_instance_ids[count.index]}"
port = "${var.alb_target_group_port}"
}
I need to combine these to a single as well
resource "aws_alb_target_group_attachment" "alb_target_group_attachment" {
count = length("${var.ec2_instance_ids}")
target_group_arn = "${aws_alb_target_group.alb_target_group.arn}"
target_id = "${var.ec2_instance_ids[count.index]}"
port = "${var.alb_target_group_port}"
}
Current version of code
module "alb_example-backend" {
source = "./modules/load-balancer"
env = "${lower(var.env)}"
project = "example-backend"
vpc_id = "${data.aws_vpc.main.id}"
public_subnet1_id = "${var.public_subnet1_id}"
public_subnet2_id = "${var.public_subnet2_id}"
health_check_target_group_path ="/status"
certificate_arn = "${var.certificate_arn}"
alb_target_group_port = "2010"
ec2_instance_ids = concat(aws_instance.ec2[*].id,aws_instance.next_ec2[*].id)
}
resource "aws_alb_target_group_attachment" "alb_target_group_attachment" {
count = length("${var.ec2_instance_ids}")
target_group_arn = "${aws_alb_target_group.alb_target_group.arn}"
target_id = "${var.ec2_instance_ids[count.index]}"
port = "${var.alb_target_group_port}"
}
To join two lists, aws_instance.ec2[*].id and aws_instance.next_ec2[*].id you can use concat. Since your syntax is for 0.11, then it would be:
ec2_instance_ids = "${concat(aws_instance.ec2.*.id, aws_instance.next_ec2.*.id)}"
For TF 0.12+:
ec2_instance_ids = concat(aws_instance.ec2[*].id, aws_instance.next_ec2[*].id)

Terraform for_each use case

I am creating a bunch of Route 53 resolver rules in each region and this works great with for_each loop:
resource "aws_route53_resolver_rule" "resolver-rule" {
for_each = var.resolver-rules
domain_name = each.value.domain-name
name = format("core-%s", each.value.domain-label)
rule_type = "FORWARD"
resolver_endpoint_id = aws_route53_resolver_endpoint.outbound-endpoint.id
target_ip {
ip = each.value.forwarder1
}
target_ip {
ip = each.value.forwarder2
}
tags = merge(var.tags, map("Name", format("core-%s-%s-%s", var.team_name, var.environment, each.value.domain-label)))
}
My var looks like this:
variable "resolver-rules" {
description = "A map of parameters needed for each resolver rule"
type = map(object({
domain-name = string
domain-label = string
forwarder1 = string
forwarder2 = string
}))
}
resolver-rules = {
"resolver-rule1" = {
domain-name = "10.in-addr.arpa."
domain-label = "10-in-addr-arpa"
forwarder1 = "10.10.1.100"
forwarder2 = "10.10.2.100"
}
"resolver-rule2" = {
domain-name = "mycompany.com."
domain-label = "mycompany-com"
forwarder1 = "10.10.1.100"
forwarder2 = "10.10.2.100"
}
}
Now I need to associate those rules with resource share (not posting here):
resource "aws_ram_resource_association" "rule-association" {
for_each = var.resolver-rules
resource_arn = aws_route53_resolver_rule.resolver-rule.arn
resource_share_arn = aws_ram_resource_share.rte53-resolver-share.arn
}
Question: how do I modify (enumerate) my resource association part, so that each association would be created for each rule I define (it has to be 1 to 1 association). I just can't wrap my head around it :)
Your aws_route53_resolver_rule.resolver-rule will be a map with keys of resolver-rule1 and resolver-rule2.
Therefore to access its arn in your rule-association you could do the following:
resource "aws_ram_resource_association" "rule-association" {
for_each = var.resolver-rules
resource_arn = aws_route53_resolver_rule.resolver-rule[each.key].arn
resource_share_arn = aws_ram_resource_share.rte53-resolver-share.arn
}
In your question, aws_ram_resource_share.rte53-resolver-share.arn is not shown, thus I don't know if you also require some changes to it or not.

Terraform - Conditional Data Source

In terraform, is there any way to conditionally use a data source? For example:
data "aws_ami" "application" {
most_recent = true
filter {
name = "tag:environment"
values = ["${var.environment}"]
}
owners = ["self"]
}
I'm hoping to be able to pass in an environment variable via the command line, and based on that, determine whether or not to fetch this data source.
I know with resources you can use the count property, but it doesn't seem you can use that with data sources.
I would consider tucking this code away in a module, but modules also can't use the count parameter.
Lastly, another option would be to provide a "Default" value for the data source, if it returned null, but I don't think that's doable either.
Are there any other potential solutions for this?
You can use a conditional on data sources the same as you can with resources and also from Terraform 0.13+ on modules as well:
variable "lookup_ami" {
default = true
}
data "aws_ami" "application" {
count = var.lookup_ami ? 1 : 0
most_recent = true
filter {
name = "tag:environment"
values = [var.environment]
}
owners = ["self"]
}
One use case for this in Terraform 0.12+ is to utilise the lazy evaluation of ternary statements like with the following:
variable "internal" {
default = true
}
data "aws_route53_zone" "private_zone" {
count = var.internal ? 1 : 0
name = var.domain
vpc_id = var.vpc_id
private_zone = var.internal
}
data "aws_route53_zone" "public_zone" {
count = var.internal ? 0 : 1
name = var.domain
private_zone = var.internal
}
resource "aws_route53_record" "www" {
zone_id = var.internal ? data.aws_route53_zone.private_zone.zone_id : data.aws_route53_zone.public_zone.zone_id
name = "www.${var.domain}"
type = "A"
alias {
name = aws_elb.lb.dns_name
zone_id = aws_elb.lb.zone_id
evaluate_target_health = false
}
}
This would create a record in the private zone when var.internal is true and instead create a record in the public zone when var.internal is false.
For this specific use case you could also use Terraform 0.12+'s null to rewrite this more simply:
variable "internal" {
default = true
}
data "aws_route53_zone" "zone" {
name = var.domain
vpc_id = var.internal ? var.vpc_id : null
private_zone = var.internal
}
resource "aws_route53_record" "www" {
zone_id = data.aws_route53_zone.zone.zone_id
name = "www.${data.aws_route53_zone.zone.name}"
type = "A"
alias {
name = aws_elb.lb.dns_name
zone_id = aws_elb.lb.zone_id
evaluate_target_health = false
}
}
This would only pass the vpc_id parameter to the aws_route53_zone data source if var.internal is set to true as you can't set vpc_id when private_zone is false.
Old Terraform 0.11 and earlier answer:
You can in fact use a conditional on the count of data sources but I've yet to manage to work out a good use case for it when I've tried.
As an example I successfully had this working:
data "aws_route53_zone" "private_zone" {
count = "${var.internal == "true" ? 1 : 0}"
name = "${var.domain}"
vpc_id = "${var.vpc_id}"
private_zone = "true"
}
data "aws_route53_zone" "public_zone" {
count = "${var.internal == "true" ? 0 : 1}"
name = "${var.domain}"
private_zone = "false"
}
But then had issues in how to then select the output of it because Terraform will evaluate any variables in the ternary conditional before deciding which side of the ternary to use (instead of lazy evaluation). So something like this doesn't work:
resource "aws_route53_record" "www" {
zone_id = "${var.internal ? data.aws_route53_zone.private_zone.zone_id : data.aws_route53_zone.public_zone.zone_id}"
name = "www.example.com"
type = "A"
alias {
name = "${aws_elb.lb.dns_name}"
zone_id = "${aws_elb.lb.zone_id }"
evaluate_target_health = "false"
}
}
Because if internal is true then you get the private_zone data source but not the public_zone data source and so the second half of the ternary fails to evaluate because data.aws_route53_zone.public_zone.zone_id isn't defined and equally with the other way around too.
In your case you probably just want to conditionally use the data source so might be able to do something like this:
variable "dynamic_ami" { default = "true" }
variable "default_ami" { default = "ami-123456" }
data "aws_ami" "application" {
most_recent = true
filter {
name = "tag:environment"
values = ["${var.environment}"]
}
owners = ["self"]
}
resource "aws_instance" "app" {
ami = "${var.dynamic_ami == "true" ? data.aws_ami.application.id : var.default_ami}"
instance_type = "t2.micro"
}