Testing Terragrunt

[daanbosch]

I keep getting the following error:

Error locking project: ResourceNotFoundException: Requested resource not found

Any way to debug what is going on?

projects:
- name: 00_myvm
  dir: dev/env/00_myvm
  terragrunt: true

[ZIJ]

hey @daanbosch thanks for filing the issue! did you add your cloud provider keys as secrets in the action? (assuming you are using it with Github Actions)

also - what other log outputs are there?

[daanbosch]

Full logs:

Run diggerhq/tfrun@main
Run cd /runner/_work/_actions/diggerhq/tfrun/main
go: downloading github.com/aws/aws-sdk-go v1.44.219
go: downloading cloud.google.com/go/storage v1.30.1
go: downloading github.com/google/go-github/v50 v50.1.0
go: downloading gopkg.in/yaml.v2 v2.4.0
go: downloading github.com/hashicorp/terraform-exec v0.18.1
go: downloading github.com/hashicorp/terraform-json v0.15.0
go: downloading github.com/hashicorp/go-version v1.6.0
go: downloading cloud.google.com/go v0.110.0
go: downloading golang.org/x/oauth2 v0.6.0
go: downloading golang.org/x/crypto v0.5.0
go: downloading github.com/google/go-querystring v1.1.0
go: downloading github.com/zclconf/go-cty v1.13.0
go: downloading cloud.google.com/go/iam v0.12.0
go: downloading github.com/google/uuid v1.3.0
go: downloading github.com/googleapis/gax-go/v2 v2.7.1
go: downloading google.golang.org/api v0.114.0
go: downloading cloud.google.com/go/compute/metadata v0.2.3
go: downloading cloud.google.com/go/compute v1.18.0
go: downloading google.golang.org/genproto v0.0.0-20230320184635-7606e756e683
go: downloading google.golang.org/grpc v1.53.0
go: downloading google.golang.org/protobuf v1.29.1
go: downloading go.opencensus.io v0.24.0
go: downloading golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2
go: downloading golang.org/x/net v0.8.0
go: downloading github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e
go: downloading github.com/apparentlymart/go-textseg/v13 v13.0.0
go: downloading golang.org/x/text v0.8.0
go: downloading github.com/golang/protobuf v1.5.2
go: downloading golang.org/x/sys v0.6.0
go: downloading github.com/googleapis/enterprise-certificate-proxy v0.2.3
go: downloading github.com/google/go-cmp v0.5.9
go: downloading github.com/jmespath/go-jmespath v0.4.0
GitHub context parsed successfully
Digger config read successfully
Lock provider has been created successfully
GitHub event processed successfully
GitHub event converted to commands successfully
Lock team-<redacted>/<redacted>#00_myvm
2023/04/06 10:57:43 Error locking project: ResourceNotFoundException: Requested resource not found
Error: Process completed with exit code 1.

[daanbosch]

did you add your cloud provider keys as secrets in the action?

Yes using cloud creds of a supported provider and I share them as env vars.

[ZIJ]

Looking into it! Also created an issue to improve debuggability (above)

So far it seems to be coming from here:

digger/pkg/digger/digger.go

Line 233 in 46a2a6d

res, err := d.lock.Lock(d.LockId(), prNumber)

from there its either GCP locking provider or AWS locking provider that's throwing this error. We should capture this as debug info but for the time being need to resort to asking - which cloud provider are you using?

[ZIJ]

Ok we were able to isolate it to AWS locks implementation as the most likely source. It suggests that the DynamoDB table for locks likely wasn't created:

digger/pkg/aws/dynamo_locking.go

Line 50 in 46a2a6d

_, err = dynamoDbLock.DynamoDb.UpdateItem(input)

One possible reason is the AWS keys not having enough permissions to do that.

@daanbosch What is the scope of permissions for your AWS keys?

[daanbosch]

It has full access to the db, my guess it is trying to lock something that does not exist.

[ZIJ]

Okay then it's likely something wrong with the DynamoDB expression building here:

digger/pkg/aws/dynamo_locking.go

Line 43 in 46a2a6d

Key: map[string]*dynamodb.AttributeValue{"PK": {S: aws.String("LOCK")}, "SK": {S: aws.String("RES#" + resource)}},

We will obviously refactor this (#113) - but for the time being, can you share the entries that you have in your DynamoDB table currently?

[ZIJ]

If it contains anything that you are not comfortable sharing publicly - here's our Slack

[daanbosch]

I can't join your slack, it's limited to certain email addresses. What I did find was the following in Dynamodb:

"<redacted>/<redacted>/<redacted>/<redacted>/00_myvm/terraform-bm.tfstate-md5"

Could it be that it can't detect the custom name of the state? terraform-bm.tfstate the -bm part I add with Terragrunt?

Edit:
No, that's not it I think, I reverted this change already, this is on old entry.

[daanbosch]

Maybe it could be related to me using this Terragrunt fucntion for the key path:

${path_relative_to_include()}

Docs:
https://terragrunt.gruntwork.io/docs/reference/built-in-functions/#path_relative_to_include

[motatoes]

Hey @daanbosch I think there is a bug in dynamoDB creation I'm looking into it now and. I will keep you updated soon