Final state before storing backend

README.md

@@ -12,10 +12,19 @@ Creates an S3 bucket and a dynamodb table for terraform remote state storage.
 
 ## Usage
 
+### First Time Creation
+
+If this is your first time using this module, remove the `backend.tf` file, then create fresh via:
 ```
 terraform apply
 ```
 
+Save the output as `backend.tf` (replacing the key with a unique string), and run `terraform apply` again to migrate the state of this module back to S3.
+
+You can use the output again in other projects.
+
+If you wish to recreate, do _not_ update the config. You must `terraform destroy`, remove `backend.tf`, make changes, then `terraform apply`
+
 <!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
 ## Requirements
 

config.tf

@@ -1,11 +1,11 @@
 locals {
   profile = "default"
   region  = "us-east-1"
-  prefix  = "ftd-tf" # Prefix for resources. Select resource types may truncate this.
+  prefix  = "terraform-remote-state" # Prefix for resources. Select resource types may truncate this.
   tags = {
     "tf_module" : basename(path.root)
   }
-  dynamodb_support = true # whether to support locking (recommended for group projects)
+  dynamodb_support = false # whether to support locking (recommended for group projects)
 }
 
 # Uncomment if needed

output.tf

@@ -1,14 +1,14 @@
 locals {
-  backend_tf_dynamo   = <<EOF
+  backend_tf_dynamo   = local.dynamodb_support != true ? "" : <<EOF
 For your project(s), use a backend.tf containing the following:
 
 terraform {
   backend "s3" {
     bucket         = "${aws_s3_bucket.state_storage.id}"
     key            = SOMETHING UNIQUE PER PROJECT
-    region         = "us-east-1"
+    region         = "${local.region}"
     encrypt        = true
-    dynamodb_table = aws_dynamodb_table.lock_table.id
+    dynamodb_table = "${aws_dynamodb_table.lock_table[0].id}"
     profile        = "${local.profile}"
   }
 }
@@ -20,7 +20,7 @@ terraform {
   backend "s3" {
     bucket         = "${aws_s3_bucket.state_storage.id}"
     key            = SOMETHING UNIQUE PER PROJECT
-    region         = "us-east-1"
+    region         = "${local.region}"
     encrypt        = true
     profile        = "${local.profile}"
   }

s3.tf

@@ -2,8 +2,7 @@
 # tfsec:ignore:aws-s3-enable-bucket-logging - We should log, but we don't
 resource "aws_s3_bucket" "state_storage" {
   # checkov:skip=CKV_AWS_18:checkov also things we should log.
-  bucket = local.prefix
-
+  bucket_prefix = "${local.prefix}-"
 
   #logging {
   #  target_bucket = "target-bucket"