Error with naming of IAM Role for CloudWatch Log Group (VPC Flow Logs)

[trc-smoehn]

When trying to enable VPC FlowLogs I receive the following error.

TF Code VPC Flow Logs:

vpc_flow_logs = {
      log_destination_type = "cloud-watch-logs"
      retention_in_days    = 180
    }

Error:

╷
│ Error: expected length of name_prefix to be in the range (1 - 38), got vpc-network-test-eu-central-1-cw-access-role-
│ 
│   with module.vpc_network_test.module.flow_logs[0].module.cloudwatch_log_group[0].aws_iam_role.main,
│   on .terraform/modules/vpc_network_test.flow_logs.cloudwatch_log_group/main.tf line 24, in resource "aws_iam_role" "main":
│   24:   name_prefix = "${var.name}-cw-access-role-"

Problem:

The name of the VPC is created by common best practice: "vpc--". If that's too long for an IAM Role name, you should automatically shorten the name OR give an option to add a custom IAM Role name.

FYI: Name of the IAM Role from hasicorp AWS VPC Module is "vpc-flow-log-role-"

[drewmullen]

hi thanks for opening this issue. yes we use the name of the vpc as a prefix for the iam role. perhaps i can slice the entry to allow for longer vpc names and not get this error

im sure you figured it out by now but a quick way to fix this is to shrink your vpc name.

im working on a couple things for this module regarding tf v1.6 so ill take a look at this during that effort

[trc-smoehn]

Hey, thanks for taking a look at this. Yes I know I could shrink the VPC name, but we're using this for a client who has a pretty strict naming convention and it's not unusual that VPCs are named like: "vpc-network-test-eu-central-1".

Would just be great if we could use an optional, alternative name or as you said slice it somehow to make it shorter.

[drewmullen]

@trc-smoehn completely agree. should be able to override at the very least

[drewmullen]

Just a quick update. We're discussing internally about name_prefixes, generally speaking. This is kind of a common issue where many resources have extremely restricting name prefixes. For example, the aws elb load balancer name_prefix only lets you specify 6 characters 🤯

I will get a quick fix in but I just figured you'd be interested to know the convo is happening at the provider level as well