infrastructure-notes/MDR Terraform Notes.md

---

workspaces are being used to break up environments.

terraform workspace list terraform workspace select test

Strange errors? Unexpected results? try this rm .terraform terraform init

State issues terraform state show aws_ami.msoc_base terraform refresh -target=data.aws_ami.msoc_base

Terraform also has a DynamoDB State lock (msoc-terraform-lock). This will prevent terraform state breakage.

---

View TF code https://github.com/terraform-aws-modules

---

Modules

We are using the aws ec2-instance module

https://registry.terraform.io/modules/terraform-aws-modules/ec2-instance/aws/2.13.0 https://github.com/terraform-aws-modules/terraform-aws-ec2-instance

var.something means this is a module that needs the variable to run. Your code will fill the variable. data is a read-only terrafom object that queries provider or generates something on the localhost locals are variables that can refer to variables or other locals variables - expecting data from somewhere else. provider instance of the API

---

IAM Role

get this error? aws_iam_policy.nga_instance_policy: Error creating IAM policy nga_instance_tag_read: AccessDenied:

add this provider = "aws.iam_admin"

---

in terraform .tf files when the self = true. that is for putting the security group into itself. e.g. add the security group to the security groups rules.

the terraform is setup in folders. each folder is a project and apply should be run in the folder. Common is the execption as some of the projects are dependent on that folder.

role and policy have to be done in the IAM terraform

iam_data.tf

02-msoc_vpc/lambda.tf with security groups

terraform plan -target= terraform plan -target=module.sensu_go_server.aws_instance.this -target=module.sensu_go_server.aws_route53_record.private

terraform apply -target=module.sensu_server.aws_route53_record.private -target=module.sensu_server.aws_instance.this

terraform apply -target=aws_security_group_rule.outbound_to_sensu -target=module.sensu_servers_sg.aws_security_group_rule.ingress_with_cidr_blocks[0] -target=module.sensu_servers_sg.aws_security_group_rule.ingress_with_cidr_blocks[1]

terraform apply -target=module.vpc_default_security_groups.aws_security_group_rule.typical_host_outbound_to_sensu_8081 -target=aws_security_group_rule.vault_server_to_sensu -target=module.vpc_default_security_groups.aws_security_group_rule.typical_host_outbound_to_sensu_5672

terraform apply -target=module.afs_cluster.module.vpc_default_security_groups.aws_security_group_rule.typical_host_outbound_to_sensu_5672 -target=module.afs_cluster.module.vpc_default_security_groups.aws_security_group_rule.typical_host_outbound_to_sensu_8081