Hello, I am currently seeing a Error: Cycle: message after making some additions to an application load balancer module to create access logs. We are using a remote backend of Terraform Cloud. The error cycle message of dependencies is too large to view in a terraform graph.
The error has been seen locally during a plan, and also in Terraform Cloud during a CLI plan and apply. However this error only happens “sometimes” other times the plan and applies are healthy. And sometimes, after receiving the cycle error in Terraform Cloud via CLI , it will still plan and apply successfully via the UI. I looking for some possible solutions to try.
Any help and guidance would be greatly appreciated, thank you!
the Error Cycle error is attached via document because it is too long to post.
Terraform-Cycle-Error.txt (22.3 KB)
Here is the terraform configuration:
The two arguments and references that are unique to our infrastructure are the calling of the s3 module to create the bucket and the data sources to call the aws region identity and to create the iam policy. We typically do not use data sources.
#alb-access-logs-bucket
module "access_logs_bucket" {
source = "app.terraform.io/MyApplication/s3-module/aws"
version = "~> 1.1.1"
count = var.access_logs ? 1 : 0
name = "${var.project}-access-logs"
environment = var.environment
}
#alb-access-logs-aws-caller-identity
data "aws_caller_identity" "current" {}
#alb-access-logs-service-account
data "aws_elb_service_account" "elb_account_id" {}
#alb-access-logs-iam-policy-document
data "aws_iam_policy_document" "allow_lb" {
count = var.access_logs ? 1 : 0
statement {
effect = "Allow"
resources = [
"${module.access_logs_bucket[0].bucket_arn}/AWSLogs/${data.aws_caller_identity.current.account_id}/*",
]
actions = ["s3:PutObject", "s3:PutObjectAcl"]
principals {
type = "AWS"
identifiers = [data.aws_elb_service_account.elb_account_id.arn]
}
}
statement {
effect = "Allow"
resources = [
"${module.access_logs_bucket[0].bucket_arn}/AWSLogs/${data.aws_caller_identity.current.account_id}/*",
]
actions = ["s3:PutObject"]
principals {
type = "Service"
identifiers = ["delivery.logs.amazonaws.com"]
}
condition {
test = "StringEquals"
variable = "s3:x-amz-acl"
values = ["bucket-owner-full-control"]
}
}
statement {
effect = "Allow"
resources = ["${module.access_logs_bucket[0].bucket_arn}"]
actions = ["s3:GetBucketAcl"]
principals {
type = "Service"
identifiers = ["delivery.logs.amazonaws.com"]
}
}
}
#alb-access-logs-iam-policy-to-s3
resource "aws_s3_bucket_policy" "lb_logs" {
count = var.access_logs ? 1 : 0
bucket = element(module.access_logs_bucket.*.bucket_name, 0)
policy = data.aws_iam_policy_document.allow_lb[0].json
}
resource "aws_alb" "environment_lb" {
name = "${var.project}-${var.environment}"
internal = var.internal
access_logs {
bucket = var.access_logs ? module.access_logs_bucket[0].bucket_name : ""
enabled = var.access_logs
}