Skip to content

Commit eb30ace

Browse files
mbarrienmbarrien
committed
[fix] Various fixes for TF AWS 3.0 compatibility
* Shorten static site lambda name * Remove unneeded bare aws provider from static site * Fix aws-ssm-params readme * Upgrade terraform-aws-modules/security-group/aws for TF 3.0 compatiblity * aws-lambda-functionaws_cloudwatch_log_group use ARN instead of manually constructing since ARN is fixed in TF AWS 3.0 * Update readmes via make docs
1 parent 9991541 commit eb30ace

File tree

21 files changed

+38
-45
lines changed

21 files changed

+38
-45
lines changed

‎aws-acm-certificate/README.md

+5-5
Original file line numberDiff line numberDiff line change
@@ -58,16 +58,16 @@ No modules.
5858

5959
| Name | Description | Type | Default | Required |
6060
|------|-------------|------|---------|:--------:|
61-
| <a name="input_aws_route53_zone_id"></a> [aws\_route53\_zone\_id](#input\_aws\_route53\_zone\_id) | n/a | `string` | n/a | yes |
61+
| <a name="input_aws_route53_zone_id"></a> [aws\_route53\_zone\_id](#input\_aws\_route53\_zone\_id) | Default Route 53 zone to create validation records in | `string` | n/a | yes |
6262
| <a name="input_cert_domain_name"></a> [cert\_domain\_name](#input\_cert\_domain\_name) | Like www.foo.bar.com or *.foo.bar.com | `string` | n/a | yes |
6363
| <a name="input_cert_subject_alternative_names"></a> [cert\_subject\_alternative\_names](#input\_cert\_subject\_alternative\_names) | A map of <alternative\_domain:route53\_zone\_id> | `map(string)` | `{}` | no |
64-
| <a name="input_tags"></a> [tags](#input\_tags) | Tags to apply to certificate | `map(string)` | `{}` | no |
65-
| <a name="input_validation_record_ttl"></a> [validation\_record\_ttl](#input\_validation\_record\_ttl) | n/a | `string` | `60` | no |
64+
| <a name="input_tags"></a> [tags](#input\_tags) | Tags to apply to certificate | `object({ project : string, env : string, service : string, owner : string, managedBy : string })` | n/a | yes |
65+
| <a name="input_validation_record_ttl"></a> [validation\_record\_ttl](#input\_validation\_record\_ttl) | TTL value of DNS validation records | `string` | `60` | no |
6666

6767
## Outputs
6868

6969
| Name | Description |
7070
|------|-------------|
71-
| <a name="output_arn"></a> [arn](#output\_arn) | n/a |
72-
| <a name="output_id"></a> [id](#output\_id) | n/a |
71+
| <a name="output_arn"></a> [arn](#output\_arn) | AWS ARN of the certificate |
72+
| <a name="output_id"></a> [id](#output\_id) | ID of the certificate |
7373
<!-- END -->

‎aws-aurora-mysql/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,7 @@ No resources.
8181
| <a name="input_rds_cluster_parameters"></a> [rds\_cluster\_parameters](#input\_rds\_cluster\_parameters) | Cluster params you can set. [Doc](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Reference.html#AuroraMySQL.Reference.Parameters.Cluster) | `list(any)` | <pre>[<br> {<br> "apply_method": "pending-reboot",<br> "name": "character_set_server",<br> "value": "utf8"<br> },<br> {<br> "apply_method": "pending-reboot",<br> "name": "character_set_client",<br> "value": "utf8"<br> }<br>]</pre> | no |
8282
| <a name="input_service"></a> [service](#input\_service) | Service for tagging and naming. See [doc](../README.md#consistent-tagging). | `string` | n/a | yes |
8383
| <a name="input_skip_final_snapshot"></a> [skip\_final\_snapshot](#input\_skip\_final\_snapshot) | When you destroy a database RDS will, by default, take snapshot. Set this to skip that step. | `string` | `false` | no |
84+
| <a name="input_snapshot_identifier"></a> [snapshot\_identifier](#input\_snapshot\_identifier) | Specifies whether or not to create this cluster from a snapshot. You can use either the name or ARN when specifying a DB cluster snapshot, or the ARN when specifying a DB snapshot. | `string` | `null` | no |
8485
| <a name="input_vpc_id"></a> [vpc\_id](#input\_vpc\_id) | The id of the existing VPC in which this cluster should be created. | `string` | n/a | yes |
8586

8687
## Outputs

‎aws-aurora-postgres/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,7 @@ No resources.
7777
| <a name="input_rds_cluster_parameters"></a> [rds\_cluster\_parameters](#input\_rds\_cluster\_parameters) | Cluster params you can set. [Doc](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Reference.html#AuroraPostgreSQL.Reference.Parameters.Cluster) | `list(any)` | `[]` | no |
7878
| <a name="input_service"></a> [service](#input\_service) | Service for tagging and naming. See [doc](../README.md#consistent-tagging). | `string` | n/a | yes |
7979
| <a name="input_skip_final_snapshot"></a> [skip\_final\_snapshot](#input\_skip\_final\_snapshot) | When you destroy a database RDS will, by default, take snapshot. Set this to skip that step. | `string` | `false` | no |
80+
| <a name="input_snapshot_identifier"></a> [snapshot\_identifier](#input\_snapshot\_identifier) | Specifies whether or not to create this cluster from a snapshot. You can use either the name or ARN when specifying a DB cluster snapshot, or the ARN when specifying a DB snapshot. | `string` | `null` | no |
8081
| <a name="input_vpc_id"></a> [vpc\_id](#input\_vpc\_id) | The id of the existing VPC in which this cluster should be created. | `string` | n/a | yes |
8182

8283
## Outputs

‎aws-aurora/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@ No modules.
6262
| <a name="input_rds_cluster_parameters"></a> [rds\_cluster\_parameters](#input\_rds\_cluster\_parameters) | n/a | `list(any)` | `[]` | no |
6363
| <a name="input_service"></a> [service](#input\_service) | Service for tagging and naming. See [doc](../README.md#consistent-tagging). | `string` | n/a | yes |
6464
| <a name="input_skip_final_snapshot"></a> [skip\_final\_snapshot](#input\_skip\_final\_snapshot) | n/a | `bool` | `false` | no |
65+
| <a name="input_snapshot_identifier"></a> [snapshot\_identifier](#input\_snapshot\_identifier) | Specifies whether or not to create this cluster from a snapshot. You can use either the name or ARN when specifying a DB cluster snapshot, or the ARN when specifying a DB snapshot. | `string` | `null` | no |
6566
| <a name="input_vpc_id"></a> [vpc\_id](#input\_vpc\_id) | n/a | `string` | n/a | yes |
6667

6768
## Outputs

‎aws-ecs-service-fargate/README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -158,8 +158,8 @@ No requirements.
158158

159159
| Name | Source | Version |
160160
|------|--------|---------|
161-
| <a name="module_alb-sg"></a> [alb-sg](#module\_alb-sg) | terraform-aws-modules/security-group/aws | 3.11.0 |
162-
| <a name="module_container-sg"></a> [container-sg](#module\_container-sg) | terraform-aws-modules/security-group/aws | 3.11.0 |
161+
| <a name="module_alb-sg"></a> [alb-sg](#module\_alb-sg) | terraform-aws-modules/security-group/aws | 4.3.0 |
162+
| <a name="module_container-sg"></a> [container-sg](#module\_container-sg) | terraform-aws-modules/security-group/aws | 4.3.0 |
163163

164164
## Resources
165165

‎aws-ecs-service-fargate/alb.tf

+3-3
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ resource "aws_lb_target_group" "service" {
2929
resource "aws_lb" "service" {
3030
name = local.name
3131
internal = var.internal_lb
32-
security_groups = [module.alb-sg.this_security_group_id]
32+
security_groups = [module.alb-sg.security_group_id]
3333
subnets = var.lb_subnets
3434
idle_timeout = var.lb_idle_timeout_seconds
3535

@@ -80,7 +80,7 @@ resource "aws_lb_listener" "https" {
8080

8181
module "alb-sg" {
8282
source = "terraform-aws-modules/security-group/aws"
83-
version = "3.11.0"
83+
version = "4.3.0"
8484
name = "${local.name}-alb"
8585
description = "Security group for ${var.internal_lb ? "internal" : "internet facing"} ALB"
8686
vpc_id = var.vpc_id
@@ -106,7 +106,7 @@ module "alb-sg" {
106106
to_port = var.container_port
107107
protocol = "tcp"
108108
description = "Container port"
109-
source_security_group_id = module.container-sg.this_security_group_id
109+
source_security_group_id = module.container-sg.security_group_id
110110
},
111111
]
112112
}

‎aws-ecs-service-fargate/outputs.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ output "ecs_task_definition_family" {
1313

1414
output "container_security_group_id" {
1515
description = "Security group id for the container."
16-
value = module.container-sg.this_security_group_id
16+
value = module.container-sg.security_group_id
1717
}
1818

1919
output "private_service_discovery_domain" {

‎aws-ecs-service-fargate/service.tf

+4-4
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ locals {
66

77
module "container-sg" {
88
source = "terraform-aws-modules/security-group/aws"
9-
version = "3.11.0"
9+
version = "4.3.0"
1010
name = local.name
1111
description = "ECS ingress port"
1212
vpc_id = var.vpc_id
@@ -18,7 +18,7 @@ module "container-sg" {
1818
to_port = var.container_port
1919
protocol = "tcp"
2020
description = "Container port"
21-
source_security_group_id = module.alb-sg.this_security_group_id
21+
source_security_group_id = module.alb-sg.security_group_id
2222
},
2323
]
2424

@@ -50,7 +50,7 @@ resource "aws_ecs_service" "job" {
5050

5151
network_configuration {
5252
subnets = var.task_subnets
53-
security_groups = [module.container-sg.this_security_group_id]
53+
security_groups = [module.container-sg.security_group_id]
5454
}
5555

5656
load_balancer {
@@ -91,7 +91,7 @@ resource "aws_ecs_service" "unmanaged-job" {
9191

9292
network_configuration {
9393
subnets = var.task_subnets
94-
security_groups = [module.container-sg.this_security_group_id]
94+
security_groups = [module.container-sg.security_group_id]
9595
}
9696

9797
load_balancer {

‎aws-ecs-service/README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -150,8 +150,8 @@ No requirements.
150150

151151
| Name | Source | Version |
152152
|------|--------|---------|
153-
| <a name="module_alb-sg"></a> [alb-sg](#module\_alb-sg) | terraform-aws-modules/security-group/aws | 3.11.0 |
154-
| <a name="module_container-sg"></a> [container-sg](#module\_container-sg) | terraform-aws-modules/security-group/aws | 3.11.0 |
153+
| <a name="module_alb-sg"></a> [alb-sg](#module\_alb-sg) | terraform-aws-modules/security-group/aws | 4.3.0 |
154+
| <a name="module_container-sg"></a> [container-sg](#module\_container-sg) | terraform-aws-modules/security-group/aws | 4.3.0 |
155155

156156
## Resources
157157

‎aws-ecs-service/alb.tf

+3-3
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ resource "aws_lb_target_group" "service" {
3030
resource "aws_lb" "service" {
3131
name = local.name
3232
internal = var.internal_lb
33-
security_groups = [module.alb-sg.this_security_group_id]
33+
security_groups = [module.alb-sg.security_group_id]
3434
subnets = var.lb_subnets
3535
idle_timeout = var.lb_idle_timeout_seconds
3636

@@ -81,7 +81,7 @@ resource "aws_lb_listener" "https" {
8181

8282
module "alb-sg" {
8383
source = "terraform-aws-modules/security-group/aws"
84-
version = "3.11.0"
84+
version = "4.3.0"
8585
name = "${local.name}-alb"
8686
description = "Security group for ${var.internal_lb ? "internal" : "internet facing"} ALB"
8787
vpc_id = var.vpc_id
@@ -114,7 +114,7 @@ module "alb-sg" {
114114
to_port = var.container_port
115115
protocol = "tcp"
116116
description = "Container port"
117-
source_security_group_id = module.container-sg.this_security_group_id
117+
source_security_group_id = module.container-sg.security_group_id
118118
},
119119
]
120120
}

‎aws-ecs-service/outputs.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ output "ecs_task_definition_family" {
1313

1414
output "container_security_group_id" {
1515
description = "Security group id for the container."
16-
value = module.container-sg.this_security_group_id
16+
value = module.container-sg.security_group_id
1717
}
1818

1919
output "private_service_discovery_domain" {

‎aws-ecs-service/service.tf

+4-4
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ locals {
66

77
module "container-sg" {
88
source = "terraform-aws-modules/security-group/aws"
9-
version = "3.11.0"
9+
version = "4.3.0"
1010
create = var.awsvpc_network_mode
1111
name = local.name
1212
description = "ECS ingress port"
@@ -19,7 +19,7 @@ module "container-sg" {
1919
to_port = var.container_port
2020
protocol = "tcp"
2121
description = "Container port"
22-
source_security_group_id = module.alb-sg.this_security_group_id
22+
source_security_group_id = module.alb-sg.security_group_id
2323
},
2424
]
2525

@@ -52,7 +52,7 @@ resource "aws_ecs_service" "job" {
5252
for_each = compact([var.awsvpc_network_mode ? "present" : ""])
5353
content {
5454
subnets = var.task_subnets
55-
security_groups = [module.container-sg.this_security_group_id]
55+
security_groups = [module.container-sg.security_group_id]
5656
}
5757
}
5858

@@ -95,7 +95,7 @@ resource "aws_ecs_service" "unmanaged-job" {
9595
for_each = compact([var.awsvpc_network_mode ? "present" : ""])
9696
content {
9797
subnets = var.task_subnets
98-
security_groups = [module.container-sg.this_security_group_id]
98+
security_groups = [module.container-sg.security_group_id]
9999
}
100100
}
101101

‎aws-lambda-function/main.tf

+1-9
Original file line numberDiff line numberDiff line change
@@ -81,14 +81,6 @@ data "aws_region" "current" {}
8181
data "aws_caller_identity" "current" {}
8282

8383
# TODO scope this policy down
84-
#
85-
# I would love to use "${aws_cloudwatch_log_group.log.arn}", as the
86-
# resource here, but the provider returns an ARN that looks like:
87-
# arn:aws:logs:us-west-2:123456789:log-group:/foo/bar:*
88-
# Unfortunately you need to use an ARN like:
89-
# arn:aws:logs:us-west-2:123456789:log-group:/foo/bar
90-
# to match operations on the log group(like creating a new stream.) So instead we construct one
91-
# without the colon before the *, so that we can match both log groups and log streams.
9284
data "aws_iam_policy_document" "lambda_logging_policy" {
9385
statement {
9486
effect = "Allow"
@@ -101,7 +93,7 @@ data "aws_iam_policy_document" "lambda_logging_policy" {
10193
resources = [
10294
var.at_edge ?
10395
"*" :
104-
"arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:log-group:${aws_cloudwatch_log_group.log.name}*",
96+
"${aws_cloudwatch_log_group.log.arn}:*"
10597
]
10698
}
10799
}

‎aws-redis-node/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ No requirements.
1818

1919
| Name | Source | Version |
2020
|------|--------|---------|
21-
| <a name="module_sg"></a> [sg](#module\_sg) | terraform-aws-modules/security-group/aws | 3.12.0 |
21+
| <a name="module_sg"></a> [sg](#module\_sg) | terraform-aws-modules/security-group/aws | 4.3.0 |
2222

2323
## Resources
2424

‎aws-redis-node/main.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ locals {
1313

1414
module "sg" {
1515
source = "terraform-aws-modules/security-group/aws"
16-
version = "3.12.0"
16+
version = "4.3.0"
1717
name = local.name
1818
description = "Allow traffic to Redis."
1919
vpc_id = var.vpc_id
@@ -56,7 +56,7 @@ resource "aws_elasticache_cluster" "default" {
5656
num_cache_nodes = 1
5757
parameter_group_name = var.parameter_group_name
5858
subnet_group_name = aws_elasticache_subnet_group.default.name
59-
security_group_ids = [module.sg.this_security_group_id]
59+
security_group_ids = [module.sg.security_group_id]
6060
apply_immediately = var.apply_immediately
6161
availability_zone = var.availability_zone
6262
tags = local.tags

‎aws-redis-replication-group/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ No requirements.
1818

1919
| Name | Source | Version |
2020
|------|--------|---------|
21-
| <a name="module_sg"></a> [sg](#module\_sg) | terraform-aws-modules/security-group/aws | 3.12.0 |
21+
| <a name="module_sg"></a> [sg](#module\_sg) | terraform-aws-modules/security-group/aws | 4.3.0 |
2222

2323
## Resources
2424

‎aws-redis-replication-group/main.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ locals {
1313

1414
module "sg" {
1515
source = "terraform-aws-modules/security-group/aws"
16-
version = "3.12.0"
16+
version = "4.3.0"
1717
name = local.name
1818
description = "Allow traffic to Redis."
1919
vpc_id = var.vpc_id
@@ -47,7 +47,7 @@ resource "aws_elasticache_replication_group" "default" {
4747
number_cache_clusters = var.number_cache_clusters
4848
parameter_group_name = var.parameter_group_name
4949
subnet_group_name = aws_elasticache_subnet_group.default.name
50-
security_group_ids = [module.sg.this_security_group_id]
50+
security_group_ids = [module.sg.security_group_id]
5151
apply_immediately = var.apply_immediately
5252
at_rest_encryption_enabled = var.at_rest_encryption_enabled
5353
transit_encryption_enabled = var.transit_encryption_enabled

‎aws-single-page-static-site/main.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@ resource "aws_s3_bucket_public_access_block" "bucket" {
8787
module "security_headers_lambda" {
8888
source = "../aws-lambda-edge-add-security-headers"
8989

90-
function_name = replace("${local.website_fqdn}-static-site-security-headers", ".", "-")
90+
function_name = replace("${local.website_fqdn}-headers", ".", "-")
9191

9292
project = var.project
9393
owner = var.owner

‎aws-single-page-static-site/providers.tf

-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
provider "aws" {}
2-
31
provider "aws" {
42
alias = "us-east-1"
53
region = "us-east-1"

‎aws-ssm-params/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ You can use [our secrets setup module](../aws-params-secrets-setup/README.md) to
88

99
```hcl
1010
module "secret" {
11-
source = "github.com/chanzuckerberg/cztack/aws-ssm-params-secret?ref=v0.18.2"
11+
source = "github.com/chanzuckerberg/cztack//aws-ssm-params?ref=v0.40.0"
1212
1313
project = "acme"
1414
env = "staging"

‎github-webhooks-to-s3/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -92,5 +92,5 @@ No requirements.
9292

9393
| Name | Description |
9494
|------|-------------|
95-
| <a name="output_bucket"></a> [bucket](#output\_bucket) | n/a |
95+
| <a name="output_bucket"></a> [bucket](#output\_bucket) | S3 bucket that Github webhooks are streamed into |
9696
<!-- END -->

0 commit comments

Comments
 (0)