fix: Replace deprecate aws_cloudwatch_event_rule.is_enabled, requires provide upgrade #3655

officel · 2023-12-07T06:29:50Z

npalm

@officel thx, change looks good. Need to run a quick test asap.

npalm · 2023-12-08T09:33:59Z

Just ran a deployment got the following error

➜  multi-runner git:(fix/deprecate_aws_cloudwatch_event_rule.is_enabled) ✗ terraform apply                               <aws:swcoe-dev-admin>
╷
│ Error: expected state to be one of ["ENABLED" "DISABLED" "ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS"], got true
│
│   with module.runners.module.ami_housekeeper.aws_cloudwatch_event_rule.ami_housekeeper,
│   on ../../modules/ami-housekeeper/main.tf line 106, in resource "aws_cloudwatch_event_rule" "ami_housekeeper":
│  106:   state               = true

See also https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule#state

npalm

The state property should be an enum, see https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule#state

modules/ami-housekeeper/main.tf

see https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule#state At first we forced enable. but now that `ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS` can be specified. we can change it with a variable. Please let me know if you have a better naming scheme.

Like this?

officel · 2023-12-08T21:25:07Z

Once you have decided on the naming and code direction, decide how to fix ssm_houcekeeper.
Are you okay like that?

…ami_housekeeper

officel · 2023-12-11T14:40:15Z

@npalm how about this?

…nabled

npalm

@officel thx, the variable enable_event_rule_binaries_syncer used on the top-level module and multi-runner. Can you update those as well. See also CI errors

modules/runner-binaries-syncer/variables.tf

I'm sorry I didn't check it out better. - Written similar to `variables.deprecated.tf` - top-level `versions.tf` did not know if it should be corrected...

…nabled

npalm · 2023-12-18T19:31:32Z

@officel can you also update this file? modules/multi-runner/runner-binaries.tf line 23, in module "runner_binaries"

…nner

officel · 2023-12-19T01:31:34Z

@npalm maybe green?

terraform-aws-github-runner $ gg enable_event_rule_binaries_syncer
README.md:524:| <a name="input_enable_event_rule_binaries_syncer"></a> [enable\_event\_rule\_binaries\_syncer](#input\_enable\_event\_rule\_binaries\_syncer) | DEPRECATED: Replaced by `state_event_rule_binaries_syncer`. | `bool` | `null` | no |
variables.deprecated.tf:12:variable "enable_event_rule_binaries_syncer" {
variables.deprecated.tf:17:    condition     = var.enable_event_rule_binaries_syncer == null

…nabled

npalm · 2023-12-19T20:18:28Z

We almost there, you need to run a terraform init -upgrade upgrade on the terraform examples failing in CI. The version is locked on a provider version not supporting the new field.

officel · 2023-12-20T00:21:31Z

Do we need a setup-iam-permissions directory?

terraform-aws-github-runner $ gg -A 1 'hashicorp/aws' -- '**/versions.tf'
examples/arm64/versions.tf:4:      source  = "hashicorp/aws"
examples/arm64/versions.tf-5-      version = "~> 5.27.0"
--
examples/base/versions.tf:4:      source  = "hashicorp/aws"
examples/base/versions.tf-5-      version = "~> 5.27.0"
--
examples/default/versions.tf:4:      source  = "hashicorp/aws"
examples/default/versions.tf-5-      version = "~> 5.27.0"
--
examples/ephemeral/versions.tf:4:      source  = "hashicorp/aws"
examples/ephemeral/versions.tf-5-      version = "~> 5.27.0"
--
examples/multi-runner/versions.tf:4:      source  = "hashicorp/aws"
examples/multi-runner/versions.tf-5-      version = "~> 5.27.0"
--
examples/permissions-boundary/setup/versions.tf:4:      source  = "hashicorp/aws"
examples/permissions-boundary/setup/versions.tf-5-      version = "~> 5.27.0"
--
examples/permissions-boundary/versions.tf:4:      source  = "hashicorp/aws"
examples/permissions-boundary/versions.tf-5-      version = "~> 5.27.0"
--
examples/prebuilt/versions.tf:4:      source  = "hashicorp/aws"
examples/prebuilt/versions.tf-5-      version = "~> 5.27.0"
--
examples/ubuntu/versions.tf:4:      source  = "hashicorp/aws"
examples/ubuntu/versions.tf-5-      version = "~> 5.27.0"
--
examples/windows/versions.tf:4:      source  = "hashicorp/aws"
examples/windows/versions.tf-5-      version = "~> 5.27.0"
--
modules/ami-housekeeper/versions.tf:6:      source  = "hashicorp/aws"
modules/ami-housekeeper/versions.tf-7-      version = "~> 5.27.0"
--
modules/download-lambda/versions.tf:6:      source  = "hashicorp/aws"
modules/download-lambda/versions.tf-7-      version = "~> 5.27.0"
--
modules/multi-runner/versions.tf:6:      source  = "hashicorp/aws"
modules/multi-runner/versions.tf-7-      version = "~> 5.27.0"
--
modules/runner-binaries-syncer/versions.tf:6:      source  = "hashicorp/aws"
modules/runner-binaries-syncer/versions.tf-7-      version = "~> 5.27.0"
--
modules/runners/pool/versions.tf:6:      source  = "hashicorp/aws"
modules/runners/pool/versions.tf-7-      version = "~> 5.27.0"
--
modules/runners/versions.tf:6:      source  = "hashicorp/aws"
modules/runners/versions.tf-7-      version = "~> 5.27.0"
--
modules/setup-iam-permissions/versions.tf:6:      source  = "hashicorp/aws"
modules/setup-iam-permissions/versions.tf-7-      version = "~> 5.27.0"
--
modules/ssm/versions.tf:6:      source  = "hashicorp/aws"
modules/ssm/versions.tf-7-      version = "~> 5.27.0"
--
modules/webhook/versions.tf:6:      source  = "hashicorp/aws"
modules/webhook/versions.tf-7-      version = "~> 5.27.0"

npalm · 2023-12-20T06:58:59Z

Do we need a setup-iam-permissions directory?

terraform-aws-github-runner $ gg -A 1 'hashicorp/aws' -- '**/versions.tf'
examples/arm64/versions.tf:4:      source  = "hashicorp/aws"
examples/arm64/versions.tf-5-      version = "~> 5.27.0"
--
examples/base/versions.tf:4:      source  = "hashicorp/aws"
examples/base/versions.tf-5-      version = "~> 5.27.0"
--
examples/default/versions.tf:4:      source  = "hashicorp/aws"
examples/default/versions.tf-5-      version = "~> 5.27.0"
--
examples/ephemeral/versions.tf:4:      source  = "hashicorp/aws"
examples/ephemeral/versions.tf-5-      version = "~> 5.27.0"
--
examples/multi-runner/versions.tf:4:      source  = "hashicorp/aws"
examples/multi-runner/versions.tf-5-      version = "~> 5.27.0"
--
examples/permissions-boundary/setup/versions.tf:4:      source  = "hashicorp/aws"
examples/permissions-boundary/setup/versions.tf-5-      version = "~> 5.27.0"
--
examples/permissions-boundary/versions.tf:4:      source  = "hashicorp/aws"
examples/permissions-boundary/versions.tf-5-      version = "~> 5.27.0"
--
examples/prebuilt/versions.tf:4:      source  = "hashicorp/aws"
examples/prebuilt/versions.tf-5-      version = "~> 5.27.0"
--
examples/ubuntu/versions.tf:4:      source  = "hashicorp/aws"
examples/ubuntu/versions.tf-5-      version = "~> 5.27.0"
--
examples/windows/versions.tf:4:      source  = "hashicorp/aws"
examples/windows/versions.tf-5-      version = "~> 5.27.0"
--
modules/ami-housekeeper/versions.tf:6:      source  = "hashicorp/aws"
modules/ami-housekeeper/versions.tf-7-      version = "~> 5.27.0"
--
modules/download-lambda/versions.tf:6:      source  = "hashicorp/aws"
modules/download-lambda/versions.tf-7-      version = "~> 5.27.0"
--
modules/multi-runner/versions.tf:6:      source  = "hashicorp/aws"
modules/multi-runner/versions.tf-7-      version = "~> 5.27.0"
--
modules/runner-binaries-syncer/versions.tf:6:      source  = "hashicorp/aws"
modules/runner-binaries-syncer/versions.tf-7-      version = "~> 5.27.0"
--
modules/runners/pool/versions.tf:6:      source  = "hashicorp/aws"
modules/runners/pool/versions.tf-7-      version = "~> 5.27.0"
--
modules/runners/versions.tf:6:      source  = "hashicorp/aws"
modules/runners/versions.tf-7-      version = "~> 5.27.0"
--
modules/setup-iam-permissions/versions.tf:6:      source  = "hashicorp/aws"
modules/setup-iam-permissions/versions.tf-7-      version = "~> 5.27.0"
--
modules/ssm/versions.tf:6:      source  = "hashicorp/aws"
modules/ssm/versions.tf-7-      version = "~> 5.27.0"
--
modules/webhook/versions.tf:6:      source  = "hashicorp/aws"
modules/webhook/versions.tf-7-      version = "~> 5.27.0"

iam premission module is only an example if you would like to setup permission budnaries

…nabled

npalm · 2023-12-20T12:00:29Z

Can you run this script in the root of the repo will will fix all the lock files

for dir in $(find . -name ".terraform.lock.hcl" -exec dirname {} \;); do
    echo "Upgrading modules in $dir"
    (cd "$dir" && terraform init -upgrade)
done

officel · 2023-12-20T13:25:58Z

@npalm

Sorry.
We usually don't maintain .terraform.lock.hcl at our workplace and always run it with init -upgrade, so i forgot it existed... 🙇

npalm · 2023-12-20T13:31:50Z

CI is 😄

npalm

@officel thx for your effort

officel · 2023-12-20T13:55:28Z

@npalm
Thank you very much, too.
I learned a lot. 👍

🤖 I have created a release *beep* *boop* --- ## [5.6.0](v5.5.2...v5.6.0) (2023-12-20) > Release can require upgrade your AWS Terraform provider ### Features * upgrade lambda runtime from 18x to 20x ([#3682](#3682)) ([02dd3e6](02dd3e6)) ### Bug Fixes * **lambda:** bump @aws-lambda-powertools/tracer from 1.16.0 to 1.17.0 in /lambdas ([#3675](#3675)) ([b3536f7](b3536f7)) * **lambda:** bump the aws group in /lambdas with 5 updates ([#3671](#3671)) ([677965d](677965d)) * **lambda:** bump the octokit group in /lambdas with 1 update ([#3672](#3672)) ([67facac](67facac)) * Replace deprecate aws_cloudwatch_event_rule.is_enabled, requires provide upgrade ([#3655](#3655)) ([3c78f65](3c78f65)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: forest-releaser[bot] <80285352+forest-releaser[bot]@users.noreply.github.com>

jizi · 2024-01-02T10:53:43Z

versions.tf

@@ -4,7 +4,7 @@ terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
-      version = "~> 5.2"
+      version = "~> 5.27.0"


@npalm Was this really required? Didn't you actually mean ~> 5.27?

or actually @officel ?

@jizi maybe yes?

This PR was satisfied where at a minimum the state property indicated a valid version.
You may be right.

yeah, but upgrading to the latest github-runner module version actually downgraded the aws module which is probably not what you wanted

officel and others added 2 commits December 7, 2023 15:29

fix: deprecate aws_cloudwatch_event_rule.is_enabled

2f00719

see #3652

docs: auto update terraform docs

ec93d75

npalm self-requested a review December 7, 2023 21:25

npalm reviewed Dec 8, 2023

View reviewed changes

npalm requested changes Dec 8, 2023

View reviewed changes

modules/ami-housekeeper/main.tf Outdated Show resolved Hide resolved

officel and others added 4 commits December 9, 2023 05:49

docs: auto update terraform docs

725c9e6

fix: use state for aws_cloudwatch_event_rule.syncer

f88cbb4

Like this?

docs: auto update terraform docs

a107d48

officel and others added 3 commits December 11, 2023 22:32

fix: rename variable cloudwatch_event_rule_state to state_event_rule_…

5c7a8d0

…ami_housekeeper

fix: use ssm_housekeeper.state instead of ssm_housekeeper.enable

67ad8a9

docs: auto update terraform docs

751101e

Merge branch 'main' into fix/deprecate_aws_cloudwatch_event_rule.is_e…

096b711

…nabled

npalm requested changes Dec 16, 2023

View reviewed changes

modules/runner-binaries-syncer/variables.tf Show resolved Hide resolved

officel and others added 3 commits December 16, 2023 22:09

fix: DEPRECATED enable_event_rule_binaries_syncer on top-level module

a6e1903

I'm sorry I didn't check it out better. - Written similar to `variables.deprecated.tf` - top-level `versions.tf` did not know if it should be corrected...

docs: auto update terraform docs

4cfbe39

Merge branch 'main' into fix/deprecate_aws_cloudwatch_event_rule.is_e…

9cfd6ed

…nabled

officel and others added 2 commits December 19, 2023 10:28

fix: DEPRECATED enable_event_rule_binaries_syncer in modules/multi-ru…

a151167

…nner

docs: auto update terraform docs

5efee46

Merge branch 'main' into fix/deprecate_aws_cloudwatch_event_rule.is_e…

0e02155

…nabled

officel and others added 2 commits December 20, 2023 08:58

fix: require aws provider version ~>5.27.0

2206895

docs: auto update terraform docs

91ce04c

Merge branch 'main' into fix/deprecate_aws_cloudwatch_event_rule.is_e…

3345c99

…nabled

fix: terraform init -upgrade for .terraform.lock.hcl

b3a533e

npalm approved these changes Dec 20, 2023

View reviewed changes

npalm changed the title ~~fix: deprecate aws_cloudwatch_event_rule.is_enabled~~ fix: Replace deprecate aws_cloudwatch_event_rule.is_enabled, requires provide upgrade Dec 20, 2023

npalm merged commit 3c78f65 into philips-labs:main Dec 20, 2023
36 checks passed

forest-releaser bot mentioned this pull request Dec 20, 2023

chore(main): release 5.5.3 #3678

Closed

forest-releaser bot mentioned this pull request Dec 20, 2023

chore(main): release 5.6.0 #3684

Merged

jizi reviewed Jan 2, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: Replace deprecate aws_cloudwatch_event_rule.is_enabled, requires provide upgrade #3655

fix: Replace deprecate aws_cloudwatch_event_rule.is_enabled, requires provide upgrade #3655

officel commented Dec 7, 2023

npalm left a comment

npalm commented Dec 8, 2023

npalm left a comment

officel commented Dec 8, 2023

officel commented Dec 11, 2023

npalm left a comment

npalm commented Dec 18, 2023

officel commented Dec 19, 2023

npalm commented Dec 19, 2023

officel commented Dec 20, 2023

npalm commented Dec 20, 2023

npalm commented Dec 20, 2023

officel commented Dec 20, 2023

npalm commented Dec 20, 2023

npalm left a comment

officel commented Dec 20, 2023

jizi Jan 2, 2024

jizi Jan 4, 2024

officel Jan 4, 2024

jizi Jan 4, 2024

fix: Replace deprecate aws_cloudwatch_event_rule.is_enabled, requires provide upgrade #3655

fix: Replace deprecate aws_cloudwatch_event_rule.is_enabled, requires provide upgrade #3655

Conversation

officel commented Dec 7, 2023

npalm left a comment

Choose a reason for hiding this comment

npalm commented Dec 8, 2023

npalm left a comment

Choose a reason for hiding this comment

officel commented Dec 8, 2023

officel commented Dec 11, 2023

npalm left a comment

Choose a reason for hiding this comment

npalm commented Dec 18, 2023

officel commented Dec 19, 2023

npalm commented Dec 19, 2023

officel commented Dec 20, 2023

npalm commented Dec 20, 2023

npalm commented Dec 20, 2023

officel commented Dec 20, 2023

npalm commented Dec 20, 2023

npalm left a comment

Choose a reason for hiding this comment

officel commented Dec 20, 2023

jizi Jan 2, 2024

Choose a reason for hiding this comment

jizi Jan 4, 2024

Choose a reason for hiding this comment

officel Jan 4, 2024

Choose a reason for hiding this comment

jizi Jan 4, 2024

Choose a reason for hiding this comment