Terraform provider and AWS upgrade to #420

falila · 2023-06-27T15:40:45Z

Summary | Résumé

AWS and Terraform provider upgrade draft

Test instructions:

(optional) install tfenv to help manage terraform version with brew install tfenv and tfenv use 1.5.0 usage doc for more details.
In your console import import AWS credentials from this RaphaelKeita-scratch or you may request a scratch account (contact core team or patheard).
export AWS_ACCOUNTID and APP_ENV=[Name]_scratch
export AWS_SECRET_ACCESS_KEY=xxx export AWS_SESSION_TOKEN=XXXX
Create the satellite bucket with AWS_ACCOUNTID.
Create .env and add all required environment variables values
cd into aws/app and run terragrunt apply
(optional) _From env/cloud in each of the following folders Kms, Network, rds, redis, dynamoDB, sqs, hostedzone, ecr, app terragrunt init -upgrade and terragrunt apply . Caution Before deploying the app module make sure to pull and push an app docker image into the ECR repository (slack me)

Remarks

During the deployment of the lambda infrastructure, a problem was identified. Upon investigation, it was found that the V4.9.0 version of the terraform aws provider does not yet support Node.js v16, which is the current version in staging. The solution was to change the Node.js runtime version to v14 for lambdas functions.

Acceptance Criteria:

Terraform is upgraded to V1.5.0
AWS terraform provider upgraded to at least V4.9.0
AWS and Terraform provider versions have been upgraded to the latest stable releases.
Existing infrastructure and codebase/configurations are compatible with the upgraded providers.
Comprehensive testing has been conducted to verify the proper functioning of the upgraded providers.

github-actions · 2023-09-13T13:58:48Z

Staging: alarms

❌ Terraform Init: failed
❌ Terraform Validate: failed
✅ Terraform Format: success
❌ Terraform Plan: failed
❌ Conftest: failed

Show Init results

Initializing the backend...

Successfully configured the backend &quot;s3&quot;! Terraform will automatically
use this backend unless the backend configuration changes.
Initializing modules...
Downloading git::https://github.com/cds-snc/terraform-modules.git?ref=v6.1.3 for athena...
- athena in .terraform/modules/athena/athena_access_logs
Downloading git::https://github.com/cds-snc/terraform-modules.git?ref=v3.0.0 for athena_bucket...
- athena_bucket in .terraform/modules/athena_bucket/S3

Initializing provider plugins...
- Reusing previous version of hashicorp/aws from the dependency lock file
- Reusing previous version of hashicorp/random from the dependency lock file
- Reusing previous version of hashicorp/archive from the dependency lock file
- Installing hashicorp/random v3.4.3...
- Installed hashicorp/random v3.4.3 (signed by HashiCorp)
- Installing hashicorp/archive v2.4.0...
- Installed hashicorp/archive v2.4.0 (signed by HashiCorp)

Error: Failed to query available provider packages

Could not retrieve the list of available versions for provider hashicorp/aws:
locked provider registry.terraform.io/hashicorp/aws 4.67.0 does not match
configured version constraint &gt;= 3.36.0, &lt; 4.0.0, 4.67.0; must use terraform
init -upgrade to allow selection of new versions

time=2023-09-13T13:58:28Z level=error msg=Terraform invocation failed in /home/runner/work/forms-terraform/forms-terraform/env/cloud/alarms/.terragrunt-cache/XgbkfD_g71Av_4AqP1IjvLb28sU/-syjFrdAaB-6kNXhMmF1nXBOp7o/alarms prefix=[/home/runner/work/forms-terraform/forms-terraform/env/cloud/alarms] 
time=2023-09-13T13:58:28Z level=error msg=1 error occurred:
	* [/home/runner/work/forms-terraform/forms-terraform/env/cloud/alarms/.terragrunt-cache/XgbkfD_g71Av_4AqP1IjvLb28sU/-syjFrdAaB-6kNXhMmF1nXBOp7o/alarms] exit status 1

Show Validate results

Error: missing or corrupted provider plugins:
  - registry.terraform.io/hashicorp/aws: there is no package for registry.terraform.io/hashicorp/aws 4.67.0 cached in .terraform/providers
  - registry.terraform.io/hashicorp/random: the cached package for registry.terraform.io/hashicorp/random 3.4.3 (in .terraform/providers) does not match any of the checksums recorded in the dependency lock file

time=2023-09-13T13:58:35Z level=error msg=Terraform invocation failed in /home/runner/work/forms-terraform/forms-terraform/env/cloud/alarms/.terragrunt-cache/XgbkfD_g71Av_4AqP1IjvLb28sU/-syjFrdAaB-6kNXhMmF1nXBOp7o/alarms prefix=[/home/runner/work/forms-terraform/forms-terraform/env/cloud/alarms] 
time=2023-09-13T13:58:35Z level=error msg=1 error occurred:
	* [/home/runner/work/forms-terraform/forms-terraform/env/cloud/alarms/.terragrunt-cache/XgbkfD_g71Av_4AqP1IjvLb28sU/-syjFrdAaB-6kNXhMmF1nXBOp7o/alarms] exit status 1

Show plan

Error: Required plugins are not installed

The installed provider plugins are not consistent with the packages selected
in the dependency lock file:
  - registry.terraform.io/hashicorp/aws: there is no package for registry.terraform.io/hashicorp/aws 4.67.0 cached in .terraform/providers
  - registry.terraform.io/hashicorp/random: the cached package for registry.terraform.io/hashicorp/random 3.4.3 (in .terraform/providers) does not match any of the checksums recorded in the dependency lock file

Terraform uses external plugins to integrate with a variety of different
infrastructure services. To download the plugins required for this
configuration, run:
  terraform init
time=2023-09-13T13:58:47Z level=error msg=Terraform invocation failed in /home/runner/work/forms-terraform/forms-terraform/env/cloud/alarms/.terragrunt-cache/XgbkfD_g71Av_4AqP1IjvLb28sU/-syjFrdAaB-6kNXhMmF1nXBOp7o/alarms prefix=[/home/runner/work/forms-terraform/forms-terraform/env/cloud/alarms] 
time=2023-09-13T13:58:47Z level=error msg=1 error occurred:
	* [/home/runner/work/forms-terraform/forms-terraform/env/cloud/alarms/.terragrunt-cache/XgbkfD_g71Av_4AqP1IjvLb28sU/-syjFrdAaB-6kNXhMmF1nXBOp7o/alarms] exit status 1

github-actions · 2023-09-18T12:59:00Z

⚠ Terrform update available

Terragrunt: 0.51.0 (using 0.50.15)

github-actions · 2023-09-18T13:03:19Z

Staging: network

✅ Terraform Init: success
✅ Terraform Validate: success
✅ Terraform Format: success
✅ Terraform Plan: success
✅ Conftest: success

Plan: 0 to add, 2 to change, 0 to destroy

Show summary

CHANGE	NAME
update	`aws_security_group.forms_database`
	`aws_security_group.forms_redis`

Show plan

Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_security_group.forms_database will be updated in-place
  ~ resource "aws_security_group" "forms_database" {
        id                     = "sg-0b80bb714d886b8ff"
      ~ ingress                = [
          - {
              - cidr_blocks      = []
              - description      = ""
              - from_port        = 5432
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0328cae235e1dce04",
                ]
              - self             = false
              - to_port          = 5432
            },
          - {
              - cidr_blocks      = []
              - description      = "Security group rule for Forms DB ingress"
              - from_port        = 5432
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0554e1d0a9da92168",
                ]
              - self             = false
              - to_port          = 5432
            },
          + {
              + cidr_blocks      = []
              + from_port        = 5432
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "tcp"
              + security_groups  = [
                  + "sg-0328cae235e1dce04",
                ]
              + self             = false
              + to_port          = 5432
            },
        ]
        name                   = "forms-database"
        tags                   = {
            "CostCentre" = "forms-platform-staging"
            "Terraform"  = "true"
        }
        # (7 unchanged attributes hidden)
    }

  # aws_security_group.forms_redis will be updated in-place
  ~ resource "aws_security_group" "forms_redis" {
        id                     = "sg-092fddfbbac0e15aa"
      ~ ingress                = [
          - {
              - cidr_blocks      = []
              - description      = ""
              - from_port        = 6379
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0328cae235e1dce04",
                ]
              - self             = false
              - to_port          = 6379
            },
          - {
              - cidr_blocks      = []
              - description      = "Security group rule for Forms Redis ingress"
              - from_port        = 6379
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = [
                  - "sg-0554e1d0a9da92168",
                ]
              - self             = false
              - to_port          = 6379
            },
          + {
              + cidr_blocks      = []
              + from_port        = 6379
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "tcp"
              + security_groups  = [
                  + "sg-0328cae235e1dce04",
                ]
              + self             = false
              + to_port          = 6379
            },
        ]
        name                   = "forms-redis"
        tags                   = {
            "CostCentre" = "forms-platform-staging"
            "Terraform"  = "true"
        }
        # (7 unchanged attributes hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.

Warning: Deprecated Resource

  with data.aws_subnet_ids.ecr_endpoint_available,
  on network.tf line 68, in data "aws_subnet_ids" "ecr_endpoint_available":
  68: data "aws_subnet_ids" "ecr_endpoint_available" {

The aws_subnet_ids data source has been deprecated and will be removed in a
future version. Use the aws_subnets data source instead:
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/subnets

(and 3 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"
Releasing state lock. This may take a few moments...

Show Conftest results

18 tests, 18 passed, 0 warnings, 0 failures, 0 exceptions

github-actions · 2023-09-18T13:05:01Z

Staging: load_balancer

✅ Terraform Init: success
✅ Terraform Validate: success
✅ Terraform Format: success
✅ Terraform Plan: success
✅ Conftest: success

⚠️ Warning: resources will be destroyed by this change!

Plan: 4 to add, 1 to change, 2 to destroy

Show summary

CHANGE	NAME
add	`aws_s3_bucket_acl.firehose_waf_logs`
	`aws_s3_bucket_lifecycle_configuration.lifecycle_rules`
	`aws_s3_bucket_ownership_controls.s3_bucket_acl_ownership`
	`aws_s3_bucket_server_side_encryption_configuration.firehose_waf_logs`
delete	`aws_shield_protection.alb`
	`aws_shield_protection.route53_hosted_zone`
update	`aws_lb.form_viewer`

Show plan

Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
  - destroy

Terraform will perform the following actions:

  # aws_lb.form_viewer will be updated in-place
  ~ resource "aws_lb" "form_viewer" {
        id                                          = "arn:aws:elasticloadbalancing:ca-central-1:687401027353:loadbalancer/app/form-viewer/5e6bc2d9ab810b68"
        name                                        = "form-viewer"
        tags                                        = {
            "CostCentre" = "forms-platform-staging"
            "Name"       = "form_viewer"
            "Terraform"  = "true"
        }
        # (22 unchanged attributes hidden)

      ~ access_logs {
          ~ enabled = true -> false
            # (2 unchanged attributes hidden)
        }

        # (3 unchanged blocks hidden)
    }

  # aws_s3_bucket_acl.firehose_waf_logs will be created
  + resource "aws_s3_bucket_acl" "firehose_waf_logs" {
      + acl    = "private"
      + bucket = "forms-staging-terraform-waf-logs"
      + id     = (known after apply)
    }

  # aws_s3_bucket_lifecycle_configuration.lifecycle_rules will be created
  + resource "aws_s3_bucket_lifecycle_configuration" "lifecycle_rules" {
      + bucket = "forms-staging-terraform-waf-logs"
      + id     = (known after apply)

      + rule {
          + id     = "lifecycle_firehose_waf_logs"
          + status = "Enabled"

          + expiration {
              + days                         = 90
              + expired_object_delete_marker = (known after apply)
            }
        }
    }

  # aws_s3_bucket_ownership_controls.s3_bucket_acl_ownership will be created
  + resource "aws_s3_bucket_ownership_controls" "s3_bucket_acl_ownership" {
      + bucket = "forms-staging-terraform-waf-logs"
      + id     = (known after apply)

      + rule {
          + object_ownership = "BucketOwnerPreferred"
        }
    }

  # aws_s3_bucket_server_side_encryption_configuration.firehose_waf_logs will be created
  + resource "aws_s3_bucket_server_side_encryption_configuration" "firehose_waf_logs" {
      + bucket = "forms-staging-terraform-waf-logs"
      + id     = (known after apply)

      + rule {
          + apply_server_side_encryption_by_default {
              + sse_algorithm = "AES256"
            }
        }
    }

  # aws_shield_protection.alb will be destroyed
  # (because aws_shield_protection.alb is not in configuration)
  - resource "aws_shield_protection" "alb" {
      - arn          = "arn:aws:shield::687401027353:protection/0cca3ef1-8edc-4180-8740-febba699a5b2" -> null
      - id           = "0cca3ef1-8edc-4180-8740-febba699a5b2" -> null
      - name         = "LoadBalancer" -> null
      - resource_arn = "arn:aws:elasticloadbalancing:ca-central-1:687401027353:loadbalancer/app/form-viewer/5e6bc2d9ab810b68" -> null
      - tags         = {
          - "CostCentre" = "forms-platform-staging"
          - "Terraform"  = "true"
        } -> null
      - tags_all     = {
          - "CostCentre" = "forms-platform-staging"
          - "Terraform"  = "true"
        } -> null
    }

  # aws_shield_protection.route53_hosted_zone will be destroyed
  # (because aws_shield_protection.route53_hosted_zone is not in configuration)
  - resource "aws_shield_protection" "route53_hosted_zone" {
      - arn          = "arn:aws:shield::687401027353:protection/84aef9e9-74ea-4dfc-bc40-ff3f3ca3700c" -> null
      - id           = "84aef9e9-74ea-4dfc-bc40-ff3f3ca3700c" -> null
      - name         = "Route53HostedZone" -> null
      - resource_arn = "arn:aws:route53:::hostedzone/Z05990652HOQ0SGHD81ZC" -> null
      - tags         = {
          - "CostCentre" = "forms-platform-staging"
          - "Terraform"  = "true"
        } -> null
      - tags_all     = {
          - "CostCentre" = "forms-platform-staging"
          - "Terraform"  = "true"
        } -> null
    }

Plan: 4 to add, 1 to change, 2 to destroy.

Warning: Argument is deprecated

  with aws_wafv2_web_acl.forms_acl,
  on waf.tf line 11, in resource "aws_wafv2_web_acl" "forms_acl":
  11: resource "aws_wafv2_web_acl" "forms_acl" {

Use rule_action_override instead

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"
Releasing state lock. This may take a few moments...

Show Conftest results

WARN - plan.json - main - Missing Common Tags: ["aws_wafv2_regex_pattern_set.forms_base_url"]
WARN - plan.json - main - Missing Common Tags: ["aws_wafv2_regex_pattern_set.valid_app_uri_paths"]

19 tests, 17 passed, 2 warnings, 0 failures, 0 exceptions

github-actions · 2023-09-18T13:08:18Z

Staging: app

✅ Terraform Init: success
✅ Terraform Validate: success
✅ Terraform Format: success
❌ Terraform Plan: failed
❌ Conftest: failed

Show plan

Resource actions are indicated with the following symbols:
  + create

Terraform planned the following actions, but then encountered a problem:

  # aws_s3_bucket_acl.archive_storage_acl will be created
  + resource "aws_s3_bucket_acl" "archive_storage_acl" {
      + acl    = "private"
      + bucket = "forms-staging-archive-storage"
      + id     = (known after apply)
    }

  # aws_s3_bucket_acl.reliability_file_storage_s3_acl will be created
  + resource "aws_s3_bucket_acl" "reliability_file_storage_s3_acl" {
      + acl    = "private"
      + bucket = "forms-staging-reliability-file-storage"
      + id     = (known after apply)
    }

  # aws_s3_bucket_acl.vault_file_storage_acl will be created
  + resource "aws_s3_bucket_acl" "vault_file_storage_acl" {
      + acl    = "private"
      + bucket = "forms-staging-vault-file-storage"
      + id     = (known after apply)
    }

  # aws_s3_bucket_lifecycle_configuration.lifecycle_rules_archive_storage will be created
  + resource "aws_s3_bucket_lifecycle_configuration" "lifecycle_rules_archive_storage" {
      + bucket = "forms-staging-archive-storage"
      + id     = (known after apply)

      + rule {
          + id     = "lifecycle_archive_storage"
          + status = "Enabled"

          + expiration {
              + days                         = 30
              + expired_object_delete_marker = (known after apply)
            }
        }
    }

  # aws_s3_bucket_lifecycle_configuration.lifecycle_rules_reliability_file_storage will be created
  + resource "aws_s3_bucket_lifecycle_configuration" "lifecycle_rules_reliability_file_storage" {
      + bucket = "forms-staging-reliability-file-storage"
      + id     = (known after apply)

      + rule {
          + id     = "lifecycle_reliability_file_storage"
          + status = "Enabled"

          + expiration {
              + days                         = 30
              + expired_object_delete_marker = (known after apply)
            }
        }
    }

  # aws_s3_bucket_ownership_controls.archive_storage_s3_bucket_acl_ownership will be created
  + resource "aws_s3_bucket_ownership_controls" "archive_storage_s3_bucket_acl_ownership" {
      + bucket = "forms-staging-archive-storage"
      + id     = (known after apply)

      + rule {
          + object_ownership = "BucketOwnerPreferred"
        }
    }

  # aws_s3_bucket_ownership_controls.reliability_file_s3_bucket_acl_ownership will be created
  + resource "aws_s3_bucket_ownership_controls" "reliability_file_s3_bucket_acl_ownership" {
      + bucket = "forms-staging-reliability-file-storage"
      + id     = (known after apply)

      + rule {
          + object_ownership = "BucketOwnerPreferred"
        }
    }

  # aws_s3_bucket_ownership_controls.vault_file_s3_bucket_acl_ownership will be created
  + resource "aws_s3_bucket_ownership_controls" "vault_file_s3_bucket_acl_ownership" {
      + bucket = "forms-staging-vault-file-storage"
      + id     = (known after apply)

      + rule {
          + object_ownership = "BucketOwnerPreferred"
        }
    }

  # aws_s3_bucket_server_side_encryption_configuration.archive_storage will be created
  + resource "aws_s3_bucket_server_side_encryption_configuration" "archive_storage" {
      + bucket = "forms-staging-archive-storage"
      + id     = (known after apply)

      + rule {
          + apply_server_side_encryption_by_default {
              + sse_algorithm = "AES256"
            }
        }
    }

  # aws_s3_bucket_server_side_encryption_configuration.reliability_file_storage will be created
  + resource "aws_s3_bucket_server_side_encryption_configuration" "reliability_file_storage" {
      + bucket = "forms-staging-reliability-file-storage"
      + id     = (known after apply)

      + rule {
          + apply_server_side_encryption_by_default {
              + sse_algorithm = "AES256"
            }
        }
    }

  # aws_s3_bucket_server_side_encryption_configuration.vault_file_storage will be created
  + resource "aws_s3_bucket_server_side_encryption_configuration" "vault_file_storage" {
      + bucket = "forms-staging-vault-file-storage"
      + id     = (known after apply)

      + rule {
          + apply_server_side_encryption_by_default {
              + sse_algorithm = "AES256"
            }
        }
    }

  # aws_s3_bucket_versioning.vault_file_storage_versioning will be created
  + resource "aws_s3_bucket_versioning" "vault_file_storage_versioning" {
      + bucket = "forms-staging-vault-file-storage"
      + id     = (known after apply)

      + versioning_configuration {
          + mfa_delete = (known after apply)
          + status     = "Enabled"
        }
    }

Plan: 12 to add, 0 to change, 0 to destroy.
Releasing state lock. This may take a few moments...

Error: reading ECS Task Definition (form-viewer): ClientException: Unable to describe task definition.

  with aws_ecs_task_definition.form_viewer,
  on ecs.tf line 56, in resource "aws_ecs_task_definition" "form_viewer":
  56: resource "aws_ecs_task_definition" "form_viewer" {

time=2023-09-18T13:08:17Z level=error msg=Terraform invocation failed in /home/runner/work/forms-terraform/forms-terraform/env/cloud/app/.terragrunt-cache/K54TG7zAX8DTTyqwBYHSG8Hho6I/-syjFrdAaB-6kNXhMmF1nXBOp7o/app prefix=[/home/runner/work/forms-terraform/forms-terraform/env/cloud/app] 
time=2023-09-18T13:08:17Z level=error msg=1 error occurred:
	* [/home/runner/work/forms-terraform/forms-terraform/env/cloud/app/.terragrunt-cache/K54TG7zAX8DTTyqwBYHSG8Hho6I/-syjFrdAaB-6kNXhMmF1nXBOp7o/app] exit status 1

falila and others added 3 commits June 27, 2023 11:31

upgrading terraform provider and aws

8d1a3fd

update actions with new terraform version

049cfdd

s3 config update

eec7f8a

falila marked this pull request as ready for review July 5, 2023 14:06

bryan-robitaille added 10 commits July 7, 2023 08:25

test: Update to latest provider version / node 16

035af78

update localstack provider

3452731

update provider in locks

d29a1bf

update security scan to latest

d0f0306

formatting

602ca00

update provider lock files

d6e65b2

Update alarms archive module

9c6d5b2

template module is depreciated

265ad80

Remove template_file

7617b6e

update external modules from cds

8af68d9

bryan-robitaille force-pushed the aws-terraform-provider-upgrade branch from 17ed50c to 8af68d9 Compare July 10, 2023 18:48

Merge branch 'develop' into aws-terraform-provider-upgrade

3f6f73e

falila mentioned this pull request Jul 12, 2023

Update WAF rules to support newly added URIs #433

Merged

bryan-robitaille and others added 5 commits August 9, 2023 09:27

Merge branch 'develop' into aws-terraform-provider-upgrade

059b1a9

Merge branch 'develop' into aws-terraform-provider-upgrade

dee743a

bump terraform version

23aa0da

formatting

3ec39cd

bump version requirements in workflow files

473d01d

bryan-robitaille added 4 commits September 15, 2023 15:20

update lock files

b78a2fa

Merge branch 'develop' into aws-terraform-provider-upgrade

e01c3a8

Merge branch 'develop' into aws-terraform-provider-upgrade

a0b90a8

Add relative path

61cdfca

bryan-robitaille closed this Dec 20, 2023

bryan-robitaille deleted the aws-terraform-provider-upgrade branch December 20, 2023 16:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Terraform provider and AWS upgrade to #420

Terraform provider and AWS upgrade to #420

falila commented Jun 27, 2023 •

edited

Loading

github-actions bot commented Sep 13, 2023

github-actions bot commented Sep 18, 2023

github-actions bot commented Sep 18, 2023

github-actions bot commented Sep 18, 2023

github-actions bot commented Sep 18, 2023

Terraform provider and AWS upgrade to #420

Terraform provider and AWS upgrade to #420

Conversation

falila commented Jun 27, 2023 • edited Loading

Summary | Résumé

Test instructions:

Remarks

github-actions bot commented Sep 13, 2023

Staging: alarms

github-actions bot commented Sep 18, 2023

⚠ Terrform update available

github-actions bot commented Sep 18, 2023

Staging: network

github-actions bot commented Sep 18, 2023

Staging: load_balancer

github-actions bot commented Sep 18, 2023

Staging: app

falila commented Jun 27, 2023 •

edited

Loading