change inputs back to string from list(string) #27

mcalhoun · 2021-11-17T18:52:25Z

what

Change the optional inputs of the module to be string rather than list(string)

bridgecrew

Bridgecrew has found infrastructure configuration errors in this PR ⬇️

bridgecrew · 2021-11-17T18:53:01Z

main.tf

@@ -82,7 +82,7 @@ resource "aws_security_group" "cbd" {
  # Because we have 2 almost identical alternatives, use x == false and x == true rather than x and !x
  count = local.create_security_group && var.create_before_destroy == true ? 1 : 0

-  name_prefix = concat(var.security_group_name, ["${module.this.id}${module.this.delimiter}"])[0]
+  name_prefix = concat(var.security_group_name[*], ["${module.this.id}${module.this.delimiter}"])[0]


Ensure Security Groups are attached to EC2 instances or ENIs
Resource: aws_security_group.cbd | ID: BC_AWS_NETWORKING_51

How to Fix

resource "aws_network_interface" "test" { subnet_id = "aws_subnet.public_a.id" security_groups = [aws_security_group.ok_sg.id] } resource "aws_instance" "test" { ami = "data.aws_ami.ubuntu.id" instance_type = "t3.micro" security_groups = [aws_security_group.ok_sg.id] } resource "aws_security_group" "ok_sg" { ingress { description = "TLS from VPC" from_port = 443 to_port = 443 protocol = "tcp" cidr_blocks = 0.0.0.0/0 } }

Description
A check to ensure that orphaned Security groups aren't created. Elastic Network Interfaces (ENIs). This checks that Security Groups are attached to provisioning resources.
Dependent Resources

Path Resource Connecting Attribute

/main.tf aws_security_group_rule.keyed depends_on

bridgecrew · 2021-11-17T18:53:01Z

main.tf

@@ -25,15 +25,15 @@ resource "aws_security_group" "default" {
  # Because we have 2 almost identical alternatives, use x == false and x == true rather than x and !x
  count = local.create_security_group && var.create_before_destroy == false ? 1 : 0

-  name = concat(var.security_group_name, [module.this.id])[0]
+  name = concat(var.security_group_name[*], [module.this.id])[0]


Ensure Security Groups are attached to EC2 instances or ENIs
Resource: aws_security_group.default | ID: BC_AWS_NETWORKING_51

How to Fix

resource "aws_network_interface" "test" { subnet_id = "aws_subnet.public_a.id" security_groups = [aws_security_group.ok_sg.id] } resource "aws_instance" "test" { ami = "data.aws_ami.ubuntu.id" instance_type = "t3.micro" security_groups = [aws_security_group.ok_sg.id] } resource "aws_security_group" "ok_sg" { ingress { description = "TLS from VPC" from_port = 443 to_port = 443 protocol = "tcp" cidr_blocks = 0.0.0.0/0 } }

Description
A check to ensure that orphaned Security groups aren't created. Elastic Network Interfaces (ENIs). This checks that Security Groups are attached to provisioning resources.
Dependent Resources

Path Resource Connecting Attribute

/main.tf aws_security_group_rule.keyed depends_on

bridgecrew · 2021-11-17T18:54:04Z

main.tf

@@ -82,7 +82,7 @@ resource "aws_security_group" "cbd" {
  # Because we have 2 almost identical alternatives, use x == false and x == true rather than x and !x
  count = local.create_security_group && var.create_before_destroy == true ? 1 : 0

-  name_prefix = concat(var.security_group_name, ["${module.this.id}${module.this.delimiter}"])[0]
+  name_prefix = concat(var.security_group_name[*], ["${module.this.id}${module.this.delimiter}"])[0]


Ensure Security Groups are attached to EC2 instances or ENIs
Resource: aws_security_group.cbd | ID: BC_AWS_NETWORKING_51

How to Fix

resource "aws_network_interface" "test" { subnet_id = "aws_subnet.public_a.id" security_groups = [aws_security_group.ok_sg.id] } resource "aws_instance" "test" { ami = "data.aws_ami.ubuntu.id" instance_type = "t3.micro" security_groups = [aws_security_group.ok_sg.id] } resource "aws_security_group" "ok_sg" { ingress { description = "TLS from VPC" from_port = 443 to_port = 443 protocol = "tcp" cidr_blocks = 0.0.0.0/0 } }

Description
A check to ensure that orphaned Security groups aren't created. Elastic Network Interfaces (ENIs). This checks that Security Groups are attached to provisioning resources.
Dependent Resources

Path Resource Connecting Attribute

/main.tf aws_security_group_rule.keyed depends_on

bridgecrew · 2021-11-17T18:54:05Z

main.tf

@@ -25,15 +25,15 @@ resource "aws_security_group" "default" {
  # Because we have 2 almost identical alternatives, use x == false and x == true rather than x and !x
  count = local.create_security_group && var.create_before_destroy == false ? 1 : 0

-  name = concat(var.security_group_name, [module.this.id])[0]
+  name = concat(var.security_group_name[*], [module.this.id])[0]


Ensure Security Groups are attached to EC2 instances or ENIs
Resource: aws_security_group.default | ID: BC_AWS_NETWORKING_51

How to Fix

resource "aws_network_interface" "test" { subnet_id = "aws_subnet.public_a.id" security_groups = [aws_security_group.ok_sg.id] } resource "aws_instance" "test" { ami = "data.aws_ami.ubuntu.id" instance_type = "t3.micro" security_groups = [aws_security_group.ok_sg.id] } resource "aws_security_group" "ok_sg" { ingress { description = "TLS from VPC" from_port = 443 to_port = 443 protocol = "tcp" cidr_blocks = 0.0.0.0/0 } }

Description
A check to ensure that orphaned Security groups aren't created. Elastic Network Interfaces (ENIs). This checks that Security Groups are attached to provisioning resources.
Dependent Resources

Path Resource Connecting Attribute

/main.tf aws_security_group_rule.keyed depends_on

bridgecrew

⚠️ Due to 116c41d - Auto Format - 2 new errors were added

Change details

Error ID	Change	Path	Resource
BC_AWS_NETWORKING_51	Added	/main.tf	aws_security_group.cbd
BC_AWS_NETWORKING_51	Added	/main.tf	aws_security_group.default

Nuru · 2021-11-17T19:13:34Z

/test bats

Nuru · 2021-11-17T19:15:42Z

/test readme terratest

bridgecrew · 2021-11-18T01:13:31Z

main.tf

@@ -25,15 +25,15 @@ resource "aws_security_group" "default" {
  # Because we have 2 almost identical alternatives, use x == false and x == true rather than x and !x
  count = local.create_security_group && var.create_before_destroy == false ? 1 : 0

-  name = concat(var.security_group_name, [module.this.id])[0]
+  name = concat(var.security_group_name[*], [module.this.id])[0]


Ensure Security Groups are attached to EC2 instances or ENIs
Resource: aws_security_group.default | ID: BC_AWS_NETWORKING_51

How to Fix

resource "aws_network_interface" "test" { subnet_id = "aws_subnet.public_a.id" security_groups = [aws_security_group.ok_sg.id] } resource "aws_instance" "test" { ami = "data.aws_ami.ubuntu.id" instance_type = "t3.micro" security_groups = [aws_security_group.ok_sg.id] } resource "aws_security_group" "ok_sg" { ingress { description = "TLS from VPC" from_port = 443 to_port = 443 protocol = "tcp" cidr_blocks = 0.0.0.0/0 } }

Description
A check to ensure that orphaned Security groups aren't created. Elastic Network Interfaces (ENIs). This checks that Security Groups are attached to provisioning resources.
Dependent Resources

Path Resource Connecting Attribute

/main.tf aws_security_group_rule.keyed depends_on

bridgecrew · 2021-11-18T01:13:32Z

main.tf

@@ -82,7 +82,7 @@ resource "aws_security_group" "cbd" {
  # Because we have 2 almost identical alternatives, use x == false and x == true rather than x and !x
  count = local.create_security_group && var.create_before_destroy == true ? 1 : 0

-  name_prefix = concat(var.security_group_name, ["${module.this.id}${module.this.delimiter}"])[0]
+  name_prefix = concat(var.security_group_name[*], ["${module.this.id}${module.this.delimiter}"])[0]


Ensure Security Groups are attached to EC2 instances or ENIs
Resource: aws_security_group.cbd | ID: BC_AWS_NETWORKING_51

How to Fix

resource "aws_network_interface" "test" { subnet_id = "aws_subnet.public_a.id" security_groups = [aws_security_group.ok_sg.id] } resource "aws_instance" "test" { ami = "data.aws_ami.ubuntu.id" instance_type = "t3.micro" security_groups = [aws_security_group.ok_sg.id] } resource "aws_security_group" "ok_sg" { ingress { description = "TLS from VPC" from_port = 443 to_port = 443 protocol = "tcp" cidr_blocks = 0.0.0.0/0 } }

Description
A check to ensure that orphaned Security groups aren't created. Elastic Network Interfaces (ENIs). This checks that Security Groups are attached to provisioning resources.
Dependent Resources

Path Resource Connecting Attribute

/main.tf aws_security_group_rule.keyed depends_on

bridgecrew

⚠️ Due to 41c2d8b - Update test to illustrate Terraform issue 29973 - 2 new errors were added

Change details

Error ID	Change	Path	Resource
BC_AWS_NETWORKING_51	Added	/main.tf	aws_security_group.cbd
BC_AWS_NETWORKING_51	Added	/main.tf	aws_security_group.default

Nuru · 2021-11-18T01:17:06Z

@mcalhoun While these changes do avoid the "count" value depends on resource attributes that cannot be determined until apply... error, it looks like they do that by exploiting a bug in Terraform. See hashicorp/terraform#29973

I updated the test to surface the error. The first apply fails, although a second apply will succeed. I don't want to recreate cloudposse/terraform-aws-elasticache-redis#121

Nuru · 2021-11-18T01:17:45Z

/test all

mcalhoun · 2021-11-18T16:16:54Z

@mcalhoun While these changes do avoid the "count" value depends on resource attributes that cannot be determined until apply... error, it looks like they do that by exploiting a bug in Terraform. See hashicorp/terraform#29973

I updated the test to surface the error. The first apply fails, although a second apply will succeed. I don't want to recreate cloudposse/terraform-aws-elasticache-redis#121

I see the problem and the issue you opened. I guess we can't use this method until the underlying bug is fixed. Should we ask Hashcorp on that issue what a workaround is instead of turning string into list(string)?

Nuru · 2021-11-22T00:27:41Z

@mcalhoun said:

I see the problem and the issue you opened. I guess we can't use this method until the underlying bug is fixed. Should we ask Hashcorp on that issue what a workaround is instead of turning string into list(string)?

Turning string into list(string) is Hashicorp's solution to the problem of detecting the presence of optional inputs when the values are unknown. When #29973 is fixed, I expect the fix will be that unknown[*] will throw the same error we get for count and for_each, not that it will magically work the way we want it to.

Nuru · 2021-12-01T21:48:17Z

@mcalhoun Indeed, as I expected, hashicorp/terraform#29973 has been fixed by ensuring "unknown values upgraded to a collection via a splat expression result in a DynamicVal (unknown value of unknown type), because the resulting type may be a tuple with 0 or 1 elements."

mergify · 2021-12-29T02:42:47Z

This pull request is now in conflict. Could you fix it @mcalhoun? 🙏

change inputs back to string from list(string)

f418f5a

bridgecrew bot reviewed Nov 17, 2021

View reviewed changes

Auto Format

116c41d

bridgecrew bot reviewed Nov 17, 2021

View reviewed changes

Update test to illustrate Terraform issue 29973

41c2d8b

bridgecrew bot reviewed Nov 18, 2021

View reviewed changes

Nuru added do not merge Do not merge this PR, doing so would cause problems invalid This doesn't seem right labels Nov 18, 2021

mcalhoun closed this Mar 18, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

change inputs back to string from list(string) #27

change inputs back to string from list(string) #27

mcalhoun commented Nov 17, 2021

bridgecrew bot left a comment

bridgecrew bot Nov 17, 2021 •

edited

Loading

bridgecrew bot Nov 17, 2021 •

edited

Loading

bridgecrew bot Nov 17, 2021 •

edited

Loading

bridgecrew bot Nov 17, 2021 •

edited

Loading

bridgecrew bot left a comment

Nuru commented Nov 17, 2021

Nuru commented Nov 17, 2021

bridgecrew bot Nov 18, 2021 •

edited

Loading

bridgecrew bot Nov 18, 2021 •

edited

Loading

bridgecrew bot left a comment

Nuru commented Nov 18, 2021

Nuru commented Nov 18, 2021

mcalhoun commented Nov 18, 2021

Nuru commented Nov 22, 2021 •

edited

Loading

Nuru commented Dec 1, 2021

mergify bot commented Dec 29, 2021

change inputs back to string from list(string) #27

change inputs back to string from list(string) #27

Conversation

mcalhoun commented Nov 17, 2021

what

bridgecrew bot left a comment

Choose a reason for hiding this comment

bridgecrew bot Nov 17, 2021 • edited Loading

Choose a reason for hiding this comment

How to Fix

Description

bridgecrew bot Nov 17, 2021 • edited Loading

Choose a reason for hiding this comment

How to Fix

Description

bridgecrew bot Nov 17, 2021 • edited Loading

Choose a reason for hiding this comment

How to Fix

Description

bridgecrew bot Nov 17, 2021 • edited Loading

Choose a reason for hiding this comment

How to Fix

Description

bridgecrew bot left a comment

Choose a reason for hiding this comment

Nuru commented Nov 17, 2021

Nuru commented Nov 17, 2021

bridgecrew bot Nov 18, 2021 • edited Loading

Choose a reason for hiding this comment

How to Fix

Description

bridgecrew bot Nov 18, 2021 • edited Loading

Choose a reason for hiding this comment

How to Fix

Description

bridgecrew bot left a comment

Choose a reason for hiding this comment

Nuru commented Nov 18, 2021

Nuru commented Nov 18, 2021

mcalhoun commented Nov 18, 2021

Nuru commented Nov 22, 2021 • edited Loading

Nuru commented Dec 1, 2021

mergify bot commented Dec 29, 2021

bridgecrew bot Nov 17, 2021 •

edited

Loading

bridgecrew bot Nov 17, 2021 •

edited

Loading

bridgecrew bot Nov 17, 2021 •

edited

Loading

bridgecrew bot Nov 17, 2021 •

edited

Loading

bridgecrew bot Nov 18, 2021 •

edited

Loading

bridgecrew bot Nov 18, 2021 •

edited

Loading

Nuru commented Nov 22, 2021 •

edited

Loading