0

I have deployed a Cloudwatch Log Group community module to my terraform stack (sourced from https://github.com/cloudposse/terraform-aws-components) but I have spent more than a day trying to resolve this, unsuccessfully.

When I run terraform plan, the new component is not showing as a new piece of infrastructure.

$ terraform plan 
No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration and found no differences, so no changes are needed.

Could anyone please just scan my configuration to see if there are things that could be missing or misconfigured that would cause terraform from ignoring the new component. Getting terraform to run without error has been a struggle which I have just resolved but this in a new level that doesn't make sense. My configuration is set as follows:

test-stage-eu-west-1.yaml

    ec2_session_manager_log:
      component: cloudwatch_logs
      vars:
        context:
          enabled: true
          name: "ssm-logs"
        enabled: true
        name: "ec2-ssm-log-name"
        retention_in_days: 7
        kms_key_arn: "arn:aws:kms:eu-west-1:12345667890:key/xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx"
        principals: "ec2.amazonaws.com"
        additional_permissions: []
        stream_names: [ "app1", "app2" ]
        region: eu-west-1

    cloudwatch_logs:
      vars:
        context:
          enabled: false

cloudwatch-logs module: ./module/cloudwatch-logs/main.tf

locals {
  enabled = module.this.enabled
}

data "aws_caller_identity" "current" {
  count = local.enabled ? 1 : 0
}

data "aws_partition" "current" {
  count = local.enabled ? 1 : 0
}

module "logs" {
  source  = "cloudposse/cloudwatch-logs/aws"
  version = "0.6.5"

  name                   = var.name
  stream_names           = var.stream_names
  retention_in_days      = var.retention_in_days
  principals             = var.principals
  additional_permissions = var.additional_permissions
  kms_key_arn            = var.kms_key_arn
}

module "kms_key_logs" {
  source  = "cloudposse/kms-key/aws"
  version = "0.12.1"

  description             = "KMS key for CloudWatch Logs"
  deletion_window_in_days = 10
  enable_key_rotation     = true
  alias                   = "alias/${module.this.id}"
  policy                  = join("", data.aws_iam_policy_document.kms.*.json)

}

data "aws_iam_policy_document" "kms" {
  count = local.enabled ? 1 : 0

  statement {
    sid    = "EnableRootUserPermissions"
    effect = "Allow"

    actions = [
      "kms:Create*",
      "kms:Describe*",
      "kms:Enable*",
      "kms:List*",
      "kms:Put*",
      "kms:Update*",
      "kms:Revoke*",
      "kms:Disable*",
      "kms:Get*",
      "kms:Delete*",
      "kms:Tag*",
      "kms:Untag*",
      "kms:ScheduleKeyDeletion",
      "kms:CancelKeyDeletion"
    ]

    resources = [
      "*"
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:${join("", data.aws_partition.current[*].partition)}:iam::${join("", data.aws_caller_identity.current[*].account_id)}:root"
      ]
    }
  }

  statement {
    sid    = "Allow CloudWatch to Encrypt with the key"
    effect = "Allow"

    actions = [
      "kms:Encrypt*",
      "kms:Decrypt*",
      "kms:ReEncrypt*",
      "kms:GenerateDataKey*",
      "kms:Describe*"
    ]

    resources = [
      "*"
    ]

    principals {
      type = "Service"

      identifiers = [
        "logs.${var.region}.amazonaws.com",
      ]
    }
  }
}

Root: ./main.tf:

module "cloudwatch-logs" {
  source  = "./modules/cloudwatch-logs"
  for_each = local.cloudwatch_logs_components

  name                   = try(each.value.vars.name, null)
  stream_names           = try(each.value.vars.stream_names, null)
  retention_in_days      = try(each.value.vars.retention_in_days, null)
  aws_service_principal  = try(each.value.vars.principal, null)
  additional_permissions = try(each.value.vars.additional_permissions, null)
  region                 = try(each.value.vars.region, null)
  kms_key_arn            = try (each.value.vars.region, null)
  context                = try(each.value.vars.context, null)

}
1
  • 1
    It sounds like there are some optional components, the one which you are expecting is one of them, which are not being enabled. I would check the module to see what variables it expects to be toggled in order to enable them. Commented Apr 21, 2023 at 5:09

1 Answer 1

0

Your locales or data objects probably evaluate to nothing. So when you run your for_each statement, it is like running a loop on an empty list, nothing happens. I would check the local.cloudwatch_logs_components to see if there is data in it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.