41

Not really. The standard way to work around this though is to use eg: terraform apply -target=aws_security_group.my_sg but that's only going to apply one security group at a time, so will get tedious if you have a lot of them. You can, however, target multiple resources in one command: terraform apply -target=aws_security_group.my_sg -target=...


26

Terraform supports adding an additional file with variables during invocation. documentation: https://www.terraform.io/intro/getting-started/variables.html#from-a-file We are using that feature to provide a secrets.tfvars file on each invocation of Terraform. We also use a script to wrap the command so that its invocation is consistent, and all team ...


25

Cloud-init files are essentially bootstrap codes, that run before each startup, and can - among others - modify files, set up services, create users, etc. Not all types of droplets support all functionalities of cloud-init, for example CoreOS uses it's own implementation, with a very limited subset of valid values. To use this in terraform, simply provide ...


22

There is currently no full solution to this integrated into Terraform, but there are some building blocks that could be useful to assist in writing tests in a separate programming language. Terraform produces state files in JSON format that can, in principle, be used by external programs to extract certain data about what Terraform created. While this ...


16

There are a few different ways to achieve goals of this sort, each with some different tradeoffs. I'm going to describe the most common ones below. The simplest approach is to use Terraform's create_before_destroy mechanism with autoscaling groups. An example of this pattern is included in the aws_launch_configuration documentation. In this scenario, ...


14

We recently open sourced Terratest, our swiss army knife for testing infrastructure code. Today, you're probably testing all your infrastructure code manually by deploying, validating, and undeploying. Terratest helps you automate this process: Write tests in Go. Use helpers in Terratest to execute your real IaC tools (e.g., Terraform, Packer, etc.) to ...


13

As an update to this question, there is now Kitchen-Terraform which allows the testing of Terraform Configuration files without breaking production environments. The repository also includes a few examples for different Terraform providers.


10

The old volume is never detached because skip_destroy = true. From the terraform docs: skip_destroy - (Optional, Boolean) Set this to true if you do not wish to detach the volume from the instance to which it is attached at destroy time, and instead just remove the attachment from Terraform state. This is useful when destroying an instance which has ...


10

The desired_capacity in Terraform is marked in the documentation as optional. So with a proper min_size value, Terraform can wait until the minimum capacity is reached before continuing. The above, with the addition of scale policy can effectively manage capacity without being specific about desired_capacity in your Terraform code. This will prevent you ...


10

The terraform import command uses the "Resource Address" syntax, which is a way to talk about objects in a configuration from outside of that configuration. (This is as opposed to references in the main Terraform language, which are always resolved in the context of a particular module.) To refer to a resource that is declared in a child module, you can add ...


9

If you're on AWS, then have a look at "The Right Way to Manage Secrets" by Segment.io on the AWS Blog. We advocate using chamber to all of our customers for managing secrets. It works by leveraging the AWS Systems Manager Parameter Store (SSM) together with KMS keys. This ensures secrets are encrypted at rest (and in transit), secured with IAM, auditable ...


9

A judicious usage of one of the cloud "orchestration" tools, such as Terraform or possibly Fugue seems to be the best way. You can start small, pick a less important and not very extensive environment, carefully decipher it into automatable code and proceed from there. Broadly this is referred to as infrastructure-as-code, for googling and other buzzword-...


8

We avoid terraform handle our secrets. Even if you manage to inject secrets by a var file "secrtes.tfvars" as pointed out above, these secrets will be stored in your terraform (remote-)state. You can protect remote-state files by using e.g. S3 authorization, or you can gitignore local state files but we decided not to rely on this kind of protection.


8

For an auto-scaling-group this is the most concise syntax available. For most other resources you use the tags syntax which looks like: tags { Key1 = "value1" Key2 = "value2" }


8

It all depends on how you are deploying your code. (First, IMHO, I don't think that Terraform is the right hammer for this operation. Terraform responsibility is to build the necessary infrastructure for your application, not to be the tool used for deploying it. But, as always, "the right/best one" will depend on lots of factors and, depending on the case/...


7

In addition to all the other options mentioned, I would like to mention that InSpec 2.0 added support for cloud provider APIs. Basically, you can continue writing the IaC with Terraform, then write compliancy checks with InSpec for your cloud resources. In addition, InSpec supports writing tests for individual machines if you ever need it. Here is an ...


6

When you create an Auto Scaling group with Terraform, you can specify the user_data to be used by instances created by this ASG. Documented here - https://www.terraform.io/docs/providers/aws/r/launch_configuration.html#user_data You can also create a single EC2 instance, and provide user_data to be used - https://www.terraform.io/docs/providers/aws/r/...


6

An idea key to your question is that of immutable infrastructure, which is the idea that an image is built once, deployed many times, and never changed at runtime. If the contents of the image need to change, an entirely new image is built from scratch and new instances replace the ones running the old image. This is the opposite of what you might now call ...


6

You can use a remote backend as a data source. That is working well for us thus far but this project is not very mature and we will likely refactor a time or ten. data "terraform_remote_state" "network" { backend = "s3" config { // some variables related to config would likely go here } } then for the teams not managing the network to consume ...


6

Part of adopting the Immutable Infrastructure Pattern is decomposing your system into small manageable pieces that can move through CI/CD Pipeline very quickly, this means that OS patches can be done quickly and in a controlled manner. I often see clients ending up with a halfway house where infrastructure is mostly immutable. However, there are a few ...


6

So what happens in first case is, as Dan's already said, there's no shell used and as such nothing to expand the ~. Quoting the documentation about program: Terraform does not execute the program through a shell On the second case, bash receive in stdin something like this: { "-c": "ssh-keygen -y -f ~/.ssh/id_rsa" } And this looks like a command block ...


5

There are, as always, a few ways to solve this. You can use a central source to keep secrets that each server reads from ala Hashicorp Vault. While popular this is not my preferred approach as its rather complex. There are quite a few key value stores that can provide similar functionality such as AWS Parameter Store. You can manually put data in these ...


5

On Aws-Side there is https://github.com/k1LoW/awspec - it should be possible, to feed in terraform.state and test, wheter terraform applied correct. But I think, beyond testing on low level the tool, you used, it's probably a better idea, to think about how to test whole infrastructures. We're discussing around this idea here: https://github.com/...


5

Terraform v0.12 added support for Dynamic Nested Blocks. The following example is derived from their blog post about the new features (see section Dynamic Nested Blocks): locals { standard_tags = { Name = var.cluster_prefix Owner = var.tag_Owner Project = var.tag_Project } } resource "aws_autoscaling_group" "example" { # ... ...


5

You may use matchbox on a VM as you do on a baremetal machine, you won't be able to use packer on a baremetal machine ont he other hand as it doesn't handle any PXE boot option. That said, leveraging vSphere/AWS/ API/cli to create a new machine from a template is usually quicker and more effective than using the API/cli to create the VM and then make it ...


5

If you organize your code by modules, you could apply terraform only on a module, eg : # securitygroup.tf module "securitygroup" { source = "git@github.com:user/securitygroup-terraform-module.git?ref=master" } $ tf apply -target=module.securitygroup


5

So let's imagine you have 20 microservices, each in a separate repository. Each microservice needs to be deployed into 5+ environments: dev local, dev cloud, test, staging, prod. Understandably all configuration will be different in each environment. However, you don't need to put it into the Dockerfile - in fact you don't put any configuration into the ...


5

The resource "azurerm_network_interface_backend_address_pool_association" "network_interface" block doesn't have the count argument set, so count.index is not meaningful in that block. Given the specific pair of resource types you're using here, I expect your intent was to create one association for each network interface, in which case you'd add the ...


5

This question runs two risks: of being marked as "primarily opinion-based", and its answers might age poorly. However, I think it's useful to express an opinion, if only for posterity; if and when things change, there may be better answers -- but there will always be blank slates. I would split the problem up into four sections: Infrastructure ...


5

terraform fmt The terraform fmt command is used to rewrite Terraform configuration files to a canonical format and style.


Only top voted, non community-wiki answers of a minimum length are eligible