Invalid value for input variable when deploying ECS clusters

[jochem725]

I am trying to deploy the ECS clusters as described in this document https://docs.cloudposse.com/layers/ecs/deploy-clusters/

When running atmos workflow deploy/clusters -f quickstart/platform/ecs I get the following two Terraform errors, but I can't seem to figure out what the cause of these are:

╷
│ Error: Invalid value for input variable
│ 
│   on main.tf line 79, in module "cluster":
│   79:   capacity_providers_ec2 = {
│   80:     for name, provider in var.capacity_providers_ec2 :
│   81:     name => merge(
│   82:       provider,
│   83:       {
│   84:         security_group_ids          = concat(aws_security_group.default[*].id, provider.security_group_ids)
│   85:         subnet_ids                  = var.internal_enabled ? module.vpc.outputs.private_subnet_ids : module.vpc.outputs.public_subnet_ids
│   86:         associate_public_ip_address = !var.internal_enabled
│   87:       }
│   88:     )
│   89:   }
│ 
│ The given value is not suitable for module.cluster.var.capacity_providers_ec2 declared at .terraform/modules/cluster/variables.tf:46,1-34: element "default":
│ attribute "block_device_mappings": incorrect list element type: attribute "ebs": attribute "throughput" is required.
╵
╷
│ Error: reading ACM Certificates: empty result
│ 
│   with data.aws_acm_certificate.default[0],
│   on main.tf line 159, in data "aws_acm_certificate" "default":
│  159: data "aws_acm_certificate" "default" {
│ 

Do you have any insights in the possible cause of these two errors?

[Benbentwo]

What version of the ECS Cluster component are you using (component.yaml / vendor.yaml)? What version is your ECS/Cluster module ("cloudposse/ecs-cluster/aws")?

It looks like this error is caused by not having a throughput input in the scaling of the ECS cluster module. This has been added in the past year, and so we probably just need to update your module version to the latest, which is 1.2.0.

[jochem725]

Hey @Benbentwo thank you for your response, this points me into the right direction.

We're using the latest version of the ecs module (v1.535.3) which is still using version 0.9.0 of the ecs-cluster module.
https://github.com/cloudposse-terraform-components/aws-ecs/blob/d86c992a70bdb453b3b30657d7fdaa354aab7ebf/src/main.tf#L72

[jochem725]

I see a PR is already open to update this version - cloudposse-terraform-components/aws-ecs#35

Would it be possible to get this merged so we can retry deploying?

[Benbentwo]

Hey @jochem725 can you take a look at cloudposse-terraform-components/aws-ecs#46 - this should fix it.

[Benbentwo]

There might be another problem with the EC2 auto scaling group, but let me know how this goes for you.

And please post any error with the plan if this fails as well. Thanks.

[jochem725]

Thank you @Benbentwo;

What remains now is some warnings and the ACM error which could be a configuration issue from the reference architecture.
I'm assuming it's an issue with the format of the acm_certificate_domain and default_domain_name from the dns-delegated component - which has the following format for us $service.$region.$account.$tenant.$tld.

Maybe you can shed some light here as well @milldr

│ Warning: Deprecated Parameters
│ 
│   with module.dns_delegated.data.terraform_remote_state.data_source[0],
│   on .terraform/modules/dns_delegated/modules/remote-state/data-source.tf line 45, in data "terraform_remote_state" "data_source":
│   45: data "terraform_remote_state" "data_source" {
│ 
│ The following parameters have been deprecated. Replace them as follows:
│   * role_arn -> assume_role.role_arn
│ 
│ 
│ (and 5 more similar warnings elsewhere)
╵
╷
│ Error: reading ACM Certificates: empty result
│ 
│   with data.aws_acm_certificate.default[0],
│   on main.tf line 159, in data "aws_acm_certificate" "default":
│  159: data "aws_acm_certificate" "default" {
│ 

[jochem725]

^ We've solved (?) it for now by overriding the variable as follows in our stack:

components:
  terraform:
    ecs/cluster:
      vars:
        acm_certificate_domain: !terraform.state ecs/platform/acm xxx-use1-dev domain_name

(assuming this is the required domain name)

[ronaldsteen]

We think this bit has a bug or isn't compatible with our ref arch (link to the component).

format("%s.%s", var.environment, module.dns_delegated.outputs.default_domain_name)

This doesn't seem to take the tenant into account, just the env, resulting in a name that doesn't exist in our setup. I can share exact hostnames, etc., privately if it helps.

[Benbentwo]

Hey guys sorry for the delay here.

I do not believe you should need acm_certificate_domain set. Assuming that variable is null, it should lookup info from dns-delegated for you.

[jochem725]

We sticked with setting acm_certificate_domain in the end - I don't think the lookup worked.
I can take another look at this next week to confirm.

[GabisCampana]

@jochem725 do you still need support on this topic or can we close this?

[GabisCampana]

@jochem725 following up here. Can we consider this discussion answered?

[jochem725]

I'll verify next week, I don't think it was fully solved in the end @GabisCampana

[GabisCampana]

Ok, please let us know when you verified it

[GabisCampana]

Hi @jochem725,

Just checking back to see whether you had a chance to verify this and confirm whether the issue is fully resolved.
Please let us know either way so we can decide on next steps or close this out if appropriate.

Thanks.