I am trying out a for_each loop to build 21 web apps in Azure. For other resources that do not use a for_each loop I use the following to make the name

Azure App Service Plan

resource “azurerm_app_service_plan” “asp” {
name=join("",[“asp-”,var.platform,"-",var.environment,"-"])
…

I want to do something similar when looping through a list of webapps. In my variables file I have a list of 21 webapps. In my webapps.tf file I am doing the following:

resource “azurerm_app_service” “web” {
for_each = var.webapps
name = each.value
…

I was hoping to something like name= each.value join("",[“web-”,var.platform,"-",var.environment,"-"])

But that does not work.

Any ideas on how I might pull this off?

1 post - 1 participant

Read full topic

Hello, I’m looking for possible solution for my issue, can someone assits on this?
So I would like to use, condition if for_each which is refers to another for_each
Here what I’m trying to do:

resource "aws_lambda_code_signing_config" "lambda" {
   for_each = { for api, name in local.restapi.options.restapi : api => name if lookup(each.value.lambda, "signing", null)}

   ... Rest of the code ... 
}

So as you can see my question is how can I use lookup(each.value.lambda, "signing", null) this boolean

1 post - 1 participant

Read full topic

Hi There

Been trying to get this working but still haven’t managed too.

I have a module called subnet.
The module has an output like this.

output “subnet_id” {
value = azurerm_subnet.azure-subnet.id
}

I am invoking the module like this. The variable subnet_addresses is of type map.

module “subnet” {
for_each = var.subnet_addresses
source = “”
subnet_name = each.key
address_prefixes = each.value
}

I have a tfvars file that looks like

subnet_addresses = {
AzureSubnetAppGateway = “10.0.0.0”
AzureSubnetWeb = “10.0.0.0”
AzureSubnetData = “10.0.0.0” (not actual subnet values)
}

When trying to reference a particular subnet e.g inside an app gateway, it’s not working. let’s say i was trying to reference the subnet “AzureSubnetWeb” and get it’s ID.

frontend_ip_configuration {
name = local.frontend_ip_configuration_name
subnet_id = module.subnet[1].subnet_id
private_ip_address_allocation = “dynamic”
}

the error i am getting is

Error: Invalid index

48: subnet_id = module.subnet[1].subnet_id
|----------------
| module.subnet is object with 3 attributes
The given key does not identify an element in this collection value.

1 post - 1 participant

Read full topic

Hello Friends

I have a question for implementing an Azure service using Terraform.

I am trying to create Synapse Managed Private Endpoint for a Storage account using Terraform script. The module doesn’t have the sub-resource block to enable auto-approval of private endpoint in the target resource. As we are implementing infrastructure fully using automation scripts, looking for some ways of achieving this.

resource “azurerm_synapse_managed_private_endpoint” “example” {
name = “example-endpoint”
synapse_workspace_id = azurerm_synapse_workspace.example.id
target_resource_id = azurerm_storage_account.example_connect.id
subresource_name = “blob”

depends_on = [azurerm_synapse_firewall_rule.example]
}

1 post - 1 participant

Read full topic

Hi,

I am using Terraform version 2.60.0 and my provider is Azure. I am missing something basic here but I am trying to declare modules in my main.tf file in the root directory but it is complaining about my variables not being present.

Here is my directory structure.

|Terraform 
|
|- |modules
    |resourcegroups
          -main.tf
          -outputs.tf
          -terraform.tfvars
          -variables.tf
| main.tf
| terraform.tfvars
|variables.tf

In my root level main.tf file I have this:

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "2.60.0"

    }
  }
}

provider "azurerm" {
  # Configuration options
  features {}
}

module "resource_group" {
source = "./modules/resourcegroups"
}

in the resource groups main.tf file I have this:

resource "azurerm_resource_group" "resource_group" {
  name     = var.application_resource_group
  location = var.location
}

I have declared the location and application_resource_group in the terraform.tfvars and variables.tf files IN the resourcegroups directory. The ones in the root directory are blank. I don’t see why the root directory would duplicate entries. I get the following error:

Does anyone know what’s going on?

Thanks,

1 post - 1 participant

Read full topic

Hello,

I have updated the terraform module from 0.13.2 to 0.14.11 and also make my .hcl lock file compatible for all the enviroment so that it will work for all types of machine we have in our organisation like Linux and MacOS.

I have executed that on MacOS it works fine, I would like to test for Linux as well before commit that file.

Kindly let me know way to test this before checkin and deploy to linux machine. So that I am sure 100% when I will checkin my file and try to run with CI/CD automated way with Linux environment it will work fine.

Cheers !

1 post - 1 participant

Read full topic

Whilst Vault can be use to serve secrets to Terraform for IaC, I understand that the Terraform state file still hold secrets as text. In a Cloud environment e.g. AWS, there is a recommendation to hold the state file encrypted at rest on S3 storage. However, I haven’t been able to find guidance on how to manage the state file securely when running Vault and Terraform in an entirely on premise environment i.e. no Cloud filesystem available… other than maybe store secrets as envars. My concern would be exposing secrets using the Terraform vSphere Provider. Are there recommendations for on premise encryption at rest, access controls, short-leased accounts to mitigate risk? When I have discussed this with potential adopters, I don’t have a good story to tell…I like the product - just need assurance that it can be implemented securely?

1 post - 1 participant

Read full topic

Is it possible to reference an arn IAM role directly inside a module block? Right now, we are referencing it via **source = git .....**. The existing IAM role that we need to reference is in a different string format which doesn’t match the ones we usually create. How would you workaround it?

1 post - 1 participant

Read full topic

We use Terraform Teams & Governance.
Pricing section show that there is an option to purchase additional runner so we can run 2 plans at the same time.
There does not seem to be a way to purchase additional runner in the UI.
Who can help us purchase an additional runner for TF Cloud.

Thanks

1 post - 1 participant

Read full topic

What’s the best way to package & build a Nodejs lambda function on Terraform Cloud? On local machine, I can just write a script to run npm install before using an archive_file data source to zip the whole folder as lambda package while on Terraform Cloud, there seems to be no easy way.

1 post - 1 participant

Read full topic

Hello all,

I am trying deploy a redis cluster on k8s in GCP. There is no information on setting up using Terraform scripts. Could any one help on this issue
Thank you in advance

1 post - 1 participant

Read full topic

I have 2 providers in my terraform (0.14) code, I would like to separate it based on my environment (workspace). So workspace A will not call workspace B provider.

Please help

1 post - 1 participant

Read full topic

Hi! I have a block resource “docker_container”

resource "docker_container" "example-alpine" {
  lifecycle {
   create_before_destroy = true
 }
  image = docker_image.example-alpine.latest
  name  = "site"
  restart = "always"
  privileged = "true"
  ports {
    internal = 80
    external = 8891
  }

I want to use the lifecycle meta-Argument create_before_destroy = true when i next run the command terraform apply to replace the container imperceptibly with new version docker image.

But I have an issue when I run commands terraform apply

docker_container.example-alpine: Creating...
╷
│ Error: Unable to create container: Error response from daemon: Conflict. The container name "/site" is already in use by container "450b17cdb435af240aba742b552c36b315880723a9e0bc252296393a0c47bbd2". You have to remove (or rename) that container to be able to reuse that name.

or

docker_container.example-alpine: Creating...
╷
│ Error: Unable to start container: Error response from daemon: driver failed programming external connectivity on endpoint trusting_chandrasekhar (ec793752c675d109323e606cee97cde2d1f355338f8d95012d1e918e058fb819): Bind for 0.0.0.0:8891 failed: port is already allocated

Is it possible to run new docker container without destroy previous container?

1 post - 1 participant

Read full topic

Hello,

I am having issues with a terraform upgrade from 0.14.4 to 1.0.0 in which I solved it by REMOVING the sensitive = true from the variable. But I wanted to share this… since I got a crash.

Where the variables are:

locals {
local_ips = [“10.0.0.0/8”, “127.0.0.0/8”, “172.0.0.0/8”]
}

allowed_ips_to_access set to sensitive

variable “allowed_ips_to_access” {
type = list
sensitive = true
description = “Addresses that are whitelisted to access resources”
}

As mentioned I solved this by removing sensitive = true but I would like to put it back. Thanks!

Error: Error in function call
│ 
│   on ../../tfmodules/helm_prometheus_observer/vars.tf line 110, in locals:
│  110:     whitelisted_ips           = join(",",concat(var.allowed_ips_to_access, local.local_ips)),
│     ├────────────────
│     │ local.local_ips is tuple with 3 elements
│     │ var.allowed_ips_to_access has a sensitive value
│ 
│ Call to function "concat" failed: panic in function
│ implementation: value is marked, so must be unmarked first
│ goroutine 1837 [running]:
│ runtime/debug.Stack(0xc0025f5c48, 0x2f875c0, 0x381c670)
│       /usr/local/go/src/runtime/debug/stack.go:24 +0x9f
│ github.com/zclconf/go-cty/cty/function.errorForPanic(...)
│       /home/circleci/go/pkg/mod/github.com/zclconf/go-cty@v1.8.3/cty/function/error.go:44
│ github.com/zclconf/go-cty/cty/function.Function.ReturnTypeForValues.func1(0xc0025f6100,
│ 0xc0025f6110)
│       /home/circleci/go/pkg/mod/github.com/zclconf/go-cty@v1.8.3/cty/function/function.go:217
│ +0x7c
│ panic(0x2f875c0, 0x381c670)
│       /usr/local/go/src/runtime/panic.go:965 +0x1b9
│ github.com/zclconf/go-cty/cty.Value.assertUnmarked(...)
│       /home/circleci/go/pkg/mod/github.com/zclconf/go-cty@v1.8.3/cty/marks.go:141
│ github.com/zclconf/go-cty/cty.Value.LengthInt(0x38b8708,
│ 0xc0025b6ae0, 0x3150f20, 0xc001bda9a8, 0x1)
│       /home/circleci/go/pkg/mod/github.com/zclconf/go-cty@v1.8.3/cty/value_ops.go:1050
│ +0x4f
│ github.com/zclconf/go-cty/cty/function/stdlib.glob..func78(0xc002597d80,
│ 0x2, 0x2, 0x49b2088, 0xc0025f5f88, 0x0, 0x0)
│       /home/circleci/go/pkg/mod/github.com/zclconf/go-cty@v1.8.3/cty/function/stdlib/sequence.go:58
│ +0x3ef
│ github.com/zclconf/go-cty/cty/function.Function.ReturnTypeForValues(0xc000194780,
│ 0xc002597d80, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0)
│       /home/circleci/go/pkg/mod/github.com/zclconf/go-cty@v1.8.3/cty/function/function.go:221
│ +0x4d4
│ github.com/zclconf/go-cty/cty/function.Function.Call(0xc000194780,
│ 0xc002597d80, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
│       /home/circleci/go/pkg/mod/github.com/zclconf/go-cty@v1.8.3/cty/function/function.go:228
│ +0xb5
│ github.com/hashicorp/hcl/v2/hclsyntax.(*FunctionCallExpr).Value(0xc000ac61e0,
│ 0xc001bda948, 0x0, 0xc0025b6cc0, 0x38b8698, 0xc000050470,
│ 0x38b8698, 0xc000050470, 0x2f875c0)
│       /home/circleci/go/pkg/mod/github.com/hashicorp/hcl/v2@v2.10.0/hclsyntax/expression.go:442
│ +0xff6
│ github.com/hashicorp/hcl/v2/hclsyntax.(*FunctionCallExpr).Value(0xc000ac62d0,
│ 0xc001bda948, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
│       /home/circleci/go/pkg/mod/github.com/hashicorp/hcl/v2@v2.10.0/hclsyntax/expression.go:408
│ +0x2406
│ github.com/hashicorp/hcl/v2/hclsyntax.(*ObjectConsExpr).Value(0xc000e1c320,
│ 0xc001bda948, 0x0, 0xc0025b6c40, 0x38b8698, 0xc000050470,
│ 0x38b8698, 0xc000050470, 0x2f875c0)
│       /home/circleci/go/pkg/mod/github.com/hashicorp/hcl/v2@v2.10.0/hclsyntax/expression.go:808
│ +0x2ac
│ github.com/hashicorp/hcl/v2/hclsyntax.(*FunctionCallExpr).Value(0xc000ac64b0,
│ 0xc001bda948, 0x0, 0xc0013ab800, 0x1, 0x1, 0x0, 0x0, 0x0)
│       /home/circleci/go/pkg/mod/github.com/hashicorp/hcl/v2@v2.10.0/hclsyntax/expression.go:408
│ +0x2406
│ github.com/hashicorp/terraform/internal/lang.(*Scope).EvalExpr(0xc0025ba2d0,
│ 0x38b7438, 0xc000ac64b0, 0x38b86d0, 0x49b2088, 0x0, 0x0,
│ 0x0, 0x0, 0x0, ...)
│       /home/circleci/project/project/internal/lang/eval.go:171
│ +0x1bc
│ github.com/hashicorp/terraform/internal/terraform.(*BuiltinEvalContext).EvaluateExpr(0xc002712460,
│ 0x38b7438, 0xc000ac64b0, 0x38b86d0, 0x49b2088, 0x0, 0x0,
│ 0x0, 0xffffffffffffffff, 0x0, ...)
│       /home/circleci/project/project/internal/terraform/eval_context_builtin.go:281
│ +0xbb
│ github.com/hashicorp/terraform/internal/terraform.(*NodeLocal).Execute(0xc0025b12f0,
│ 0x38ef9c0, 0xc002712460, 0xc0000a2002, 0xc001b5ece8,
│ 0x100b805, 0x30a89c0)
│       /home/circleci/project/project/internal/terraform/node_local.go:153
│ +0x67d
│ github.com/hashicorp/terraform/internal/terraform.(*ContextGraphWalker).Execute(0xc0014ef1e0,
│ 0x38ef9c0, 0xc002712460, 0x2e534858, 0xc0025b12f0, 0x0,
│ 0x0, 0x0)
│       /home/circleci/project/project/internal/terraform/graph_walk_context.go:129
│ +0xbf
│ github.com/hashicorp/terraform/internal/terraform.(*Graph).walk.func1(0x3230ec0,
│ 0xc0025b12f0, 0x0, 0x0, 0x0)
│       /home/circleci/project/project/internal/terraform/graph.go:59
│ +0xbd3
│ github.com/hashicorp/terraform/internal/dag.(*Walker).walkVertex(0xc00061b020,
│ 0x3230ec0, 0xc0025b12f0, 0xc002597500)
│       /home/circleci/project/project/internal/dag/walk.go:381
│ +0x288
│ created by
│ github.com/hashicorp/terraform/internal/dag.(*Walker).Update
│       /home/circleci/project/project/internal/dag/walk.go:304
│ +0x1246
│ .
╵

1 post - 1 participant

Read full topic

Hi
Been trying to get this working for over 3 hours to no avail.

I have a certificate that i have successfully uploaded to key-vault.
During the import process I had to input the certificate password which was fine.

I am now trying to reference an SSL Certificate for an azure app-gateway.

I am trying to add a https listener to my application-gateway. My current set-up is as follows.

http_listener {
name = “https-listener”
frontend_ip_configuration_name = “frontip”
frontend_port_name = “frontend”
protocol = “Https”
host_name = “blabla”
ssl_certificate_name = “ssl-wild”
}

i have a ssl_certificate block which is needed according to the docs.
azurerm_application_gateway | Resources | hashicorp/azurerm | Terraform Registry

ssl_certificate {
name = “ssl-wild”
data = data.azurerm_key_vault_certificate.key-vault-certificate.certificate_data_base64
password = “”
}

i have a data reference to the key-vault certificate and the key-vault which looks like this.

data “azurerm_key_vault” “key_vault” {
name = var.key_vault_name
resource_group_name = var.key_vault_rg
}

data “azurerm_key_vault_certificate” “key-vault-certificate” {
name = “wildcert”
key_vault_id = data.azurerm_key_vault.key_vault.id
}

The error i am getting is

ssl-wild does
not have Private Key." Details=

I have tried the original password used for the import into key_vault as the password too, to no avail. I have also tried omitting “password” altogether but this throws the same error.

Help would be appreciated. The TF community has been great.

Thanks

1 post - 1 participant

Read full topic

I have some intricate code, some of it alluded to in a past post where I used a dynamic { } block to build out custom widgets for the newrelic_dashboard resource, which will soon no longer work. We are required to move to the new newrelic_one_dashboard quite soon, because by the end of next month the newrelic_dashboard will stop working.

Root Module
In my current code for the newrelic_dashboard resource and building out dynamic widget { }s, customizable and extensible in terms of how many widget { }s you’d like, I have this code in my root module for passing in data mappings of the content I’d like for each individual widget { } to be created by the child module in its newrelic_dashboard (see section after this one):

# locals for passing customized/dynamic widgets data to the child module `nr_dashboard`
locals {
  # mappings for multiple widgets
  dynamic_widgets = [
    {
      title         = "Requests per minute"
      visualization = "billboard"
      entity_ids    = [data.newrelic_entity.my_application.application_id, ]
      nrql          = "SELECT rate(count(*), 1 minute) FROM Transaction WHERE appName = '${var.nr_entity_name}'"
      row           = 1
      column        = 1
    },
    {
...

Of course, the above is passed to the child module that creates the newrelic_dashboard via the module { } block:

module "newrelic_dashboard" {
    ...
     widgets       = local.dynamic_widgets
     ....

Current Child Module which Creates the newrelic_dashboard
In the child module which creates the dashboard, I have the code for the dashboard:

resource "newrelic_dashboard" "exampledash" {
  title = "New Relic Terraform Example"

  filter {
    event_types = [
        "Transaction"
    ]
    attributes = [
        "appName",
        "name"
    ]
  }

dynamic "widget" {
  for_each = var.widgets  # `widgets` is passed to us from Root module locals
  content {
    title = widget.value.title
    visualization = widget.value.visualization
    ....# other required values for a `widget { }`
    entity_ids  = try(widget.value.entity_ids, null)  # `try() is used for all attributes that are optional, such as `entity_ids`
    nrql  = try (widget.value.nrql, null)
    ....
    dynamic "metric" {
      for_each = try(widget.value.metric.name
      content {
        name = widget.value.metric.name
        valus = widget.value.metric.values
      }
    }
....

Issue with New Relic One Dashboard

The issue with the newrelic_one_dashboard is that widget isn’t the name of the argument anymore for using widgets. Each widget type now has it’s own custom name - prior to this the newrelic_dashboard kind of widget { } was defined by the widget { }s visualization argument - those new custom / pre-defined widget names being for example:

• widget_bar
• widget_billboard
• widget_bullet, etc

So the issue is, how do I easily convert from my old code for newrelic_dashboard to the newrelic_one_dashboard, given the change in how widgets are defined in the newrelic_one_dashboard resource?

Could I perhaps try to interpolate in the child module’s current dynamic "widget { } block and do something like have an array of widget suffixes like so:

suffixes = [ "bar", "billboard", "bullet" ]

and then have some type of surrounding iterative block for the above array - perhaps a for_each or other? - and interpolate each of the above values one by one into the dynamic "widget" { } block by changing said block to the below, or similar?:

dynamic "widget_${suffix}" { 
 .....

Just curious, but would be great if I could move my current code to the new newrelic_one_dashboard pretty seamlessly and keep my dynamic and extensible code for widgets.

That was a lot, thanks a lot to anyone in advance who reads/assists!

5 posts - 2 participants

Read full topic

I am trying to use the local-exec provisioner and I have a long command that I would like to make multiline for readability sakes but I am having trouble doing so

using an az cli command as an example, I currently am doing this:

provisioner "local-exec" {
    command = "az iot hub routing-endpoint create --endpoint-resource-group ${} --endpoint-name ${} --endpoint-subscription-id ${} --endpoint-type eventhub --hub-name ${} --auth-type identitybased --identity ${} --endpoint-uri ${} --entity-path ${}"
  }

But I would like to use something like this

provisioner "local-exec" {
    command = <<EOD
az iot hub routing-endpoint create 
--endpoint-resource-group ${} \
--endpoint-name ${} \
--endpoint-subscription-id ${} \
--endpoint-type eventhub \
--hub-name ${} \
--auth-type identitybased \
--identity ${} \
--endpoint-uri ${} \
--entity-path ${} \
EOD
  }

but it complains about the backslash and if i don’t use the backslash, it tries to run every new line as its own command

Has anyone gotten around this?

1 post - 1 participant

Read full topic

Hi All,

We want to provision Oracle Integration Cloud (OIC/ICS) using Terraform but couldn’t find the proper documentation in OCI registry. Is there any generic template to do so or any documentation that can help me. Any leads will be much appreciated.

Thanks
Altaf Hussain

1 post - 1 participant

Read full topic

Hi guys,

I’m importing existing resources into Terraform and one thing I’m currently stuck is to import multiple route tables with routes… I have created route map in the following format that I’m passing to the vpc module:

additional_route_tables = {
    rtb1 = {
      rtb_name = "myrtb1"
      routes = [
        {
          cidr_block     = "0.0.0.0/0"
          nat_gateway_id = "nat-xxxxxxxxx"
        },
        {
          transit_gateway_id = "tgw-xxxxxxx"
          cidr_block = "x.x.x.x/x"
        }
      ]
    },
  
    rtb2 = {
      rtb_name = "myrtb2"
      routes = [
        {
          cidr_block     = "0.0.0.0/0"
          gateway_id = "igw-xxxxxxxxxxxxxx"
        },
        {
          vpc_endpoint_id = "vpce-xxxxxxxxxxxx"
          cidr_block = "x.x.x.x/x"
        }
  
      ]
    }
  }

In the module, I’m extracting the routes and creating a local variable:

locals {
  rtb_routes = flatten([
    for k, v in var.additional_route_tables : [
      v["routes"]
    ]
  ])
}

and then use aws_route_table resource with dynamic module:

resource "aws_route_table" "default" {
  for_each = var.additional_route_tables
  vpc_id = aws_vpc.vpc.id

  dynamic "route" {
    for_each = local.rtb_routes
    content {
      cidr_block      = route.value.cidr_block
      ipv6_cidr_block = lookup(route.value, "ipv6_cidr_block", null)

      egress_only_gateway_id    = lookup(route.value, "egress_only_gateway_id", null)
      gateway_id                = lookup(route.value, "gateway_id", null)
      instance_id               = lookup(route.value, "instance_id", null)
      nat_gateway_id            = lookup(route.value, "nat_gateway_id", null)
      network_interface_id      = lookup(route.value, "network_interface_id", null)
      transit_gateway_id        = lookup(route.value, "transit_gateway_id", null)
      vpc_endpoint_id           = lookup(route.value, "vpc_endpoint_id", null)
      vpc_peering_connection_id = lookup(route.value, "vpc_peering_connection_id", null)

    }
  }
  tags = merge(
    {
      "Name" = each.value["rtb_name"]
    },
    local.common_tags
  )
}

It creates two route tables, however, it adds up all the routes and create those routes in both rtb. In the example above, it will add four routes in each of the route table. I tried several other combinations but I’m not able to produce the required output.

Can you please suggest the workaround for this problem?

Thanks much,
Karan

2 posts - 1 participant

Read full topic

I am reading this topic https://stackoverflow.com/a/62480424 and I am curious about this:

I would not use terraform-aws-modules.
I would use aws provider resources like ...

I wonder why it is one or the other ? Can we use both ? If yes then when it is better to use one or the other ?

2 posts - 2 participants

Read full topic