Fixes issue with AWS provider v4.4.0

only fixes it in codebuild_portal_lambda
to be tagged v4.0.3

base/codebuild_portal_lambda/README-FIX.md

@@ -0,0 +1,73 @@
+
+Codebuild issue: AWS 4.4.0 - Doesn't support project_visibility = "PRIVATE" in GovCloud. Temp fix only in test/aws-us-gov-/mdr-test-c2/380-codebuild-portal-lambda . Hoping fix comes out in a soon 4.x fix (or that AWS will role it out to GovCloud). If you need to fix others, copy changes in codebuild-portal-lambda's terragrunt.hcl to your module, and use terragrunt-local state rm <module> to remove the invalid schema objects from the current state.
+
+
+These errors will show up when using AWS provider version 3.x with the latest code 
+```
+Error: Unsupported argument
+│
+│   on main.tf line 12, in resource "aws_codebuild_project" "this":
+│   12:   project_visibility     = "PRIVATE"
+│
+│ An argument named "project_visibility" is not expected here.
+╵
+╷
+│ Error: Unsupported argument
+│
+│   on provider.tf line 51, in provider "aws":
+│   51:   use_fips_endpoint = true
+│
+│ An argument named "use_fips_endpoint" is not expected here.
+╵
+╷
+│ Error: Invalid resource type
+│
+│   on s3.tf line 15, in resource "aws_s3_bucket_acl" "s3_acl_bucket":
+│   15: resource "aws_s3_bucket_acl" "s3_acl_bucket" {
+│
+│ The provider hashicorp/aws does not support resource type
+│ "aws_s3_bucket_acl".
+╵
+╷
+│ Error: Invalid resource type
+│
+│   on s3.tf line 21, in resource "aws_s3_bucket_versioning" "s3_version_bucket":
+│   21: resource "aws_s3_bucket_versioning" "s3_version_bucket" {
+│
+│ The provider hashicorp/aws does not support resource type
+│ "aws_s3_bucket_versioning".
+╵
+╷
+│ Error: Invalid resource type
+│
+│   on s3.tf line 29, in resource "aws_s3_bucket_server_side_encryption_configuration" "s3_sse_bucket":
+│   29: resource "aws_s3_bucket_server_side_encryption_configuration" "s3_sse_bucket" {
+│
+│ The provider hashicorp/aws does not support resource type
+│ "aws_s3_bucket_server_side_encryption_configuration".
+```
+
+These errors will show up after the AWS provider version is correct and the TF code is correct, but the TF state contains the incorrect objects from AWS provider v4.
+```
+Error: no schema available for aws_s3_bucket_acl.s3_acl_bucket while reading state; this is a bug in Terraform and should be reported
+│
+│
+╵
+╷
+│ Error: no schema available for aws_s3_bucket_versioning.s3_version_bucket while reading state; this is a bug in Terraform and should be reported
+│
+│
+╵
+╷
+│ Error: no schema available for aws_s3_bucket_server_side_encryption_configuration.s3_sse_bucket while reading state; this is a bug in Terraform and should be reported
+```
+
+
+Remove the objects from the TF state using these commands. 
+```
+terragrunt-local state rm aws_s3_bucket_acl.s3_acl_bucket
+terragrunt-local state rm aws_s3_bucket_versioning.s3_version_bucket
+terragrunt-local state rm aws_s3_bucket_server_side_encryption_configuration.s3_sse_bucket
+```
+
+See test/aws-us-gov/mdr-test-c2/380-codebuild-portal-lambda/terragrunt.hcl for the changes that need to be made.

base/codebuild_portal_lambda/main.tf

@@ -9,6 +9,7 @@ resource "aws_codebuild_project" "this" {
   encryption_key        = aws_kms_key.s3_codebuild.arn
   badge_enabled         = var.badge_enabled
   concurrent_build_limit = 1
+  #project_visibility     = "PRIVATE"
   build_timeout          = 60
 
   source {
@@ -51,7 +52,17 @@ resource "aws_codebuild_project" "this" {
 
 resource "aws_codebuild_webhook" "this" {
   project_name  = var.name
-  branch_filter = var.webhook_branch_filter
+  filter_group {
+    filter {
+      type    = "EVENT"
+      pattern = "PUSH"
+    }
+
+    filter {
+      type    = "HEAD_REF"
+      pattern = var.webhook_filter_pattern
+    }
+  }
 
   depends_on = [ aws_codebuild_project.this  ]
 }

base/codebuild_portal_lambda/s3.tf

@@ -6,37 +6,50 @@ locals {
 
 #S3 bucket for codebuild output
 resource "aws_s3_bucket" "bucket" {
-  #provider = aws.common # COMMON SERVICES
   bucket        = local.bucket_name
   force_destroy = true
+  acl           = "private"
   tags = merge(var.standard_tags, var.tags)
-}
-
-resource "aws_s3_bucket_acl" "s3_acl_bucket" {
-  #provider = aws.common # COMMON SERVICES
-  bucket = aws_s3_bucket.bucket.id
-  acl    = "private"
-}
 
-resource "aws_s3_bucket_versioning" "s3_version_bucket" {
-  #provider = aws.common # COMMON SERVICES
-  bucket   = aws_s3_bucket.bucket.id
-  versioning_configuration {
-    status = "Suspended"
+  versioning {
+    enabled = false
   }
-}
 
-resource "aws_s3_bucket_server_side_encryption_configuration" "s3_sse_bucket" {
-  #provider = aws.common # COMMON SERVICES
-  bucket = aws_s3_bucket.bucket.id
-  rule {
-    apply_server_side_encryption_by_default {
-      kms_master_key_id = aws_kms_key.s3_codebuild.arn
-      sse_algorithm     = "aws:kms"
+  server_side_encryption_configuration {
+    rule {
+      apply_server_side_encryption_by_default {
+        kms_master_key_id = aws_kms_key.s3_codebuild.arn
+        sse_algorithm     = "aws:kms"
       }
     }
+  }
 }
 
+# resource "aws_s3_bucket_acl" "s3_acl_bucket" {
+#   #provider = aws.common # COMMON SERVICES
+#   bucket = aws_s3_bucket.bucket.id
+#   acl    = "private"
+# }
+
+# resource "aws_s3_bucket_versioning" "s3_version_bucket" {
+#   #provider = aws.common # COMMON SERVICES
+#   bucket   = aws_s3_bucket.bucket.id
+#   versioning_configuration {
+#     status = "Suspended"
+#   }
+# }
+
+# resource "aws_s3_bucket_server_side_encryption_configuration" "s3_sse_bucket" {
+#   #provider = aws.common # COMMON SERVICES
+#   bucket = aws_s3_bucket.bucket.id
+#   rule {
+#     apply_server_side_encryption_by_default {
+#       kms_master_key_id = aws_kms_key.s3_codebuild.arn
+#       sse_algorithm     = "aws:kms"
+#       }
+#     }
+# }
+
 resource "aws_s3_bucket_public_access_block" "public_access_block" {
   bucket                  = aws_s3_bucket.bucket.id
   block_public_acls       = true

base/codebuild_portal_lambda/vars.tf

@@ -27,7 +27,7 @@ variable "badge_enabled" {
     default = "false"
 }
 
-variable "webhook_branch_filter" {
+variable "webhook_filter_pattern" {
     type = string
-    default = "^(master|develop)$"
+    default = "^refs/heads/develop$"
 }