search

fpco / terraform-aws-foundation

Establish a solid Foundation on AWS with these modules for Terraform
MIT License
204 stars 98 forks source link

Missing ASG IAM output variables on Gitlab example #241

Open devgnx opened 5 years ago

devgnx commented 5 years ago

Missing ASG IAM output variables on Gitlab example

Steps to reproduce

ᐅ cd ./examples/gitlab-simple-ha
ᐅ make generate-ssh-key
ᐅ make render-tfvars
ᐅ make network
ᐅ make plan
ᐅ make apply
terraform-0.12.2 plan -out=tf.out

Error: Reference to undeclared output value

  on main.tf line 65, in resource "aws_iam_role_policy_attachment" "s3-full-access-attachment":
  65:   role       = module.gitlab-asg.asg_iam_role_name

An output value with the name "asg_iam_role_name" has not been declared in
module.gitlab-asg.

Error: Reference to undeclared resource

  on ../../modules/persistent-ebs/outputs.tf line 12, in output "iam_profile_policy_document":
  12:   value       = aws_iam_role_policy.attach_ebs.policy

A managed resource "aws_iam_role_policy" "attach_ebs" has not been declared in
gitlab-asg.service-data.

Makefile:63: recipe for target 'plan' failed
make: *** [plan] Error 1

Version

Terraform v0.12.2 Terraform AWS Foundation master v0.9.3

ketzacoatl commented 5 years ago

Thanks for the ticket, we'll take a look.

JoseD92 commented 5 years ago

I looked into this problem, with terraform 0.12.7 I got errors:

Error: Reference to undeclared resource

on ../../modules/persistent-ebs/outputs.tf line 12, in output "iam_profile_policy_document": 12: value = data.aws_iam_role_policy.attach_ebs_policy_doc.policy

A data resource "aws_iam_role_policy" "attach_ebs_policy_doc" has not been declared in gitlab-asg.service-data.

Error: Reference to undeclared output value

on main.tf line 43, in resource "aws_iam_role_policy_attachment" "s3-full-access-attachment": 43: role = module.gitlab-asg.asg_iam_role_name

An output value with the name "asg_iam_role_name" has not been declared in module.gitlab-asg.

Error: Reference to undeclared output value

on main.tf line 52, in resource "aws_iam_role_policy" "associate_eip": 52: role = module.gitlab-asg.asg_iam_role_name

An output value with the name "asg_iam_role_name" has not been declared in module.gitlab-asg.

After looking around I fount out that this two commits are at fault:

  1. https://github.com/fpco/terraform-aws-foundation/commit/76305263bd7bf0a77d2f0fa7931db37ae5b3ff63 many variables were renamed and moved, and an output was left with the value aws_iam_role_policy.attach_ebs.policy that does not exists
  2. https://github.com/fpco/terraform-aws-foundation/commit/d63c3aaa242ab133b296bb49c6f42ac73a9e7d0b#diff-de7b621296cb5354086132f4fc41881e some outputs where deleted without giving a replacement

I made a fix commit https://github.com/fpco/terraform-aws-foundation/commit/f0f66e012c79b0270a89808187f87784254073d1 renames the faulty value of the output in 1 and adds a new output for 2 with the value module.instance_profile.iam_role_name that I think was the intended output here, @ketzacoatl can you please check if using this value for this output is ok?

and @devgnx could you please check that commit to see if it solve your issues, with those fixes it runs good to me

ketzacoatl commented 5 years ago

@devgnx The branch to test is 241-Missing-ASG-IAM-output-variables.

devgnx commented 5 years ago

Hi @JoseD92 and @ketzacoatl, thank you for the quick response, I'll test the branch 241-Missing-ASG-IAM-output-variables as soon as possible.

devgnx commented 4 years ago

Variables are now bound, but there still some issues, maybe worth a new Github Issue but for now I will post here:

S3 bucket policy is timing out while waiting for s3-full-access become success. Maybe is related to: https://github.com/terraform-providers/terraform-provider-aws/issues/9414 https://github.com/terraform-providers/terraform-provider-aws/issues/9435

Steps to reproduce

ᐅ cd ./examples/gitlab-simple-ha ᐅ make generate-ssh-key ᐅ make render-tfvars ᐅ make network ᐅ make plan ᐅ make apply "tf.out"

module.docker-registry-s3-storage.aws_s3_bucket_policy.s3-full-access: Creating...
module.docker-registry-s3-storage.aws_s3_bucket_policy.s3-full-access: Still creating... [10s elapsed]
module.docker-registry-s3-storage.aws_s3_bucket_policy.s3-full-access: Still creating... [20s elapsed]
module.docker-registry-s3-storage.aws_s3_bucket_policy.s3-full-access: Still creating... [30s elapsed]
module.docker-registry-s3-storage.aws_s3_bucket_policy.s3-full-access: Still creating... [40s elapsed]
module.docker-registry-s3-storage.aws_s3_bucket_policy.s3-full-access: Still creating... [50s elapsed]
module.docker-registry-s3-storage.aws_s3_bucket_policy.s3-full-access: Still creating... [1m0s elapsed]
module.docker-registry-s3-storage.aws_s3_bucket_policy.s3-full-access: Still creating... [1m10s elapsed]
module.docker-registry-s3-storage.aws_s3_bucket_policy.s3-full-access: Still creating... [1m20s elapsed]

Error: Error putting S3 policy: timeout while waiting for state to become 'success' (timeout: 1m0s)

  on ../../modules/s3-remote-state/main.tf line 94, in resource "aws_s3_bucket_policy" "s3-full-access":
  94: resource "aws_s3_bucket_policy" "s3-full-access" {

Makefile:65: recipe for target 'apply' failed
make: *** [apply] Error 1