Trying to get this working

[ScottGuymer]

I'm trying to get this working and I love the idea! Its something that terraform should try and deal with but sadly just ignores the problem!

Couple of issues I have run into and wondering if you had solved.

This line
bootstrap = "${terraform.workspace == "base" ? 1 : 0}"

means that all other resources would need essentially the inverse of this should you ever want to go back to the base workspace and add things after bootstrapping and uploading the state.
Otherwise when switching from your other workspace to base terraform would then try to apply all of your other resources into the base workspace. Which probably isn't desired..

I presume you would work around this by never touching this workspace again once bootstrapped.

The other one is a couple of issues with the data resources not being excluded by the !bootstrap logic above.. Otherwise, they show up as issues in other workspaces

data "template_file" "operator_arn" {
  count    = "${length(var.operators)}"
  template = "\"$${arn}\""

  vars {
    arn = "${element(data.aws_iam_user.operators.*.arn, count.index)}"
  }
}

needs to become

data "template_file" "operator_arn" {
  count    = "${var.bootstrap ? length(var.operators) : 0}"
  template = "\"$${arn}\""

  vars {
    arn = "${element(data.aws_iam_user.operators.*.arn, count.index)}"
  }
}

[jandudulski]

Hi @ScottGuymer

I'm glad that you like the idea :)

I presume you would work around this by never touching this workspace again once bootstrapped.

Yes, that's our assumption. The entire sense for base workspace is to kick off the foundation for later use.

The other one is a couple of issues with the data resources not being excluded by the !bootstrap logic above

You're probably right :) I'm not working with terraform for a quite long time, so I lost an instinct here a little bit, but it seems like a valid comment to me.

Thanks for taking a deeper review of the process 🥇

[ScottGuymer]

Thanks for the reply

In my implementation of your idea, I named the workspace bootstrap to be more explicit than base. Hopefully, it makes it a bit more explicit to never touch it again, Along with the docs I wrote that say "never touch this again"

I also spent some time figuring out the process for un-bootstrapping an account which looks something like

  terraform workspace select bootstrap
  # reset the state to local state
  terraform init -backend-config="backend.auto.tfvars" bootstrap

  Read-Host -Prompt 'Please remove all of the state history from the s3 bucket'
  # At this point you will need to delete all of the versioned state files from the bucket manually
  
  terraform destroy bootstrap

[mbevc1]

Nice one 👍

Only thing I think it's missing is DynamoDB IAM, or am I missing it somewhere?

Something along the lines:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetItem",
        "dynamodb:PutItem",
        "dynamodb:DeleteItem"
      ],
      "Resource": "arn:aws:dynamodb:*:*:table/mytable"
    }
  ]
}

[jandudulski]

Only thing I think it's missing is DynamoDB IAM, or am I missing it somewhere?

Valid point, it should be added.

[mbevc1]

Also probably makes sense to use IAM resource resource in Terraform and drop JSON encoded operators in.