Hi All,
I got this error after running ‘terrafor plan’. I am using terraform v1.2.1 on Windows x64.
D:\AWS_LZ\abc-prod-shared-services\lz-sharedservices>terraform plan
╷
│ Error: Module is incompatible with count, for_each, and depends_on
│
│ on vpc-endpoints.tf line 7, in module "vpc_endpoints":
│ 7: count = length(var.vpc_endpoint_services)
│
│ The module at module.vpc_endpoints is a legacy module which contains its own local provider configurations, and so calls to it may not use the count,
│ for_each, or depends_on arguments.
│
│ If you also control the module "../lz-tf-modules/vpc-endpoint", consider updating this module to instead expect provider configurations to be passed by its
│ caller.
╵
╷
│ Error: Module is incompatible with count, for_each, and depends_on
│
│ on vpc-endpoints.tf line 26, in module "s3_vpc_endpoint":
│ 26: count = var.enable_s3_vpc_interface_endpoint ? 1 : 0
│
│ The module at module.s3_vpc_endpoint is a legacy module which contains its own local provider configurations, and so calls to it may not use the count,
│ for_each, or depends_on arguments.
│
│ If you also control the module "../lz-tf-modules/vpc-endpoint", consider updating this module to instead expect provider configurations to be passed by its
│ caller.
╵
provider.tf (In the root modules - abc-prod-shared-services folder )
=================
D:\AWS_LZ\abc-prod-shared-services>type provider.tf
# Provider for Shared Services
provider "aws" {
region = var.region_name
alias = "sharedservices"
default_tags {
tags = var.tags
}
}
#Provider for Network Account
provider "aws" {
region = var.region_name
alias = "networking"
shared_config_files = ["./config"]
profile = "AWSAFTExecution"
assume_role {
role_arn = "arn:aws:iam::${data.aws_ssm_parameter.network_acc_number.value}:role/AWSAFTExecution"
}
default_tags {
tags = var.tags
}
}
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 4.0"
}
}
backend "s3" {
bucket = "abc-prod-ss-infra-aft-tfstate-ap-northeast-1-008012345678"
key = "02-shared-services/terraform.tfstate"
region = "ap-northeast-1"
dynamodb_table = "abc-prod-ss-infra-aft-tf-state-lock"
encrypt = true
}
}
vpc-endpoints.tf (In the root modules - abc-prod-shared-services )
====================
D:\AWS_LZ\abc-prod-shared-services>type vpc-endpoints.tf
module "vpc_endpoints" {
count = length(var.vpc_endpoint_services)
source = "../lz-tf-modules/vpc-endpoint/"
vpc_id = module.vpc.vpc_id
vpc_endpoint_subnet_ids = local.vpc_endpoint_subnet_ids
vpc_endpoint_service_name = var.vpc_endpoint_services[count.index]
master_prefix = var.master_prefix
vpc_tags = var.vpc_tags
providers = {
aws = aws.sharedservices
}
}
module "s3_vpc_endpoint" {
count = var.enable_s3_vpc_interface_endpoint ? 1 : 0
source = "../lz-tf-modules/vpc-endpoint/"
vpc_id = module.vpc.vpc_id
vpc_endpoint_subnet_ids = local.vpc_endpoint_subnet_ids
vpc_endpoint_service_name = "s3"
master_prefix = var.master_prefix
vpc_tags = var.vpc_tags
providers = {
aws = aws.sharedservices
}
}
provider.tf (In the child module folder - lz-tf-modules\vpc-endpoint )
===============================================
D:\AWS_LZ\abc-prod-shared-services\lz-tf-modules\vpc-endpoint>dir
Volume in drive D is UserProfile
Volume Serial Number is B408-A885
Directory of D:\AWS_LZ\abc-prod-shared-services\lz-tf-modules\vpc-endpoint
04/17/2023 06:19 AM <DIR> .
04/17/2023 06:19 AM <DIR> ..
04/17/2023 06:12 AM 3,095 main.tf
04/13/2023 09:28 AM 388 outputs.tf
04/13/2023 09:54 PM 577 provider.tf
04/13/2023 09:28 AM 1,942 README.md
04/13/2023 09:28 AM 970 variables.tf
5 File(s) 6,972 bytes
2 Dir(s) 41,500,389,376 bytes free
D:\AWS_LZ\abc-prod-shared-services\lz-tf-modules\vpc-endpoint>type provider.tf
provider.tf
====================
# Provider for Shared Services
provider "aws" {
region = var.region_name
alias = "sharedservices"
}
#Provider for Network Account
provider "aws" {
region = var.region_name
alias = "networking"
shared_config_files = ["./config"]
profile = "AWSAFTExecution"
assume_role {
role_arn = "arn:aws:iam::${data.aws_ssm_parameter.network_acc_number.value}:role/AWSAFTExecution"
}
}
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 4.0"
}
}
}
After which I tried to comment the providers lines in the vpc-endpoints.tf, but got this error instead. Could anyone point out what is wrong with the code? Thanks.
╷
│ Error: Invalid provider configuration
│
│ Provider "registry.terraform.io/hashicorp/aws" requires explicit configuration. Add a provider block to the root module and configure the provider's required
│ arguments as described in the provider documentation.
│
╵
╷
│ Error: configuring Terraform AWS Provider: validating provider credentials: retrieving caller identity from STS: operation error STS: GetCallerIdentity, failed to resolve service endpoint, an AWS region is required, but was not found
│
│ with provider["registry.terraform.io/hashicorp/aws"],
│ on <empty> line 0:
│ (source code not available)
│
provider.tf (In the root modules - abc-prod-shared-services )
=================
# Provider for Shared Services
provider "aws" {
region = var.region_name
alias = "sharedservices"
default_tags {
tags = var.tags
}
}
provider "aws" {
region = var.region_name
alias = "networking"
shared_config_files = ["./config"]
profile = "AWSAFTExecution"
assume_role {
role_arn = "arn:aws:iam::${data.aws_ssm_parameter.network_acc_number.value}:role/AWSAFTExecution"
}
default_tags {
tags = var.tags
}
}
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 4.0"
}
}
backend "s3" {
bucket = "abc-prod-ss-infra-aft-tfstate-ap-northeast-1-008012345678"
key = "02-shared-services/terraform.tfstate"
region = "ap-northeast-1"
dynamodb_table = "abc-prod-ss-infra-aft-tf-state-lock"
encrypt = true
}
}
vpc-endpoints.tf (In the root modules - abc-prod-shared-services )
===================
module "vpc_endpoints" {
count = length(var.vpc_endpoint_services)
source = "../lz-tf-modules/vpc-endpoint/"
vpc_id = module.vpc.vpc_id
vpc_endpoint_subnet_ids = local.vpc_endpoint_subnet_ids
vpc_endpoint_service_name = var.vpc_endpoint_services[count.index]
master_prefix = var.master_prefix
vpc_tags = var.vpc_tags
# providers = {
# aws = aws.sharedservices
# }
}
module "s3_vpc_endpoint" {
count = var.enable_s3_vpc_interface_endpoint ? 1 : 0
source = "../lz-tf-modules/vpc-endpoint/"
vpc_id = module.vpc.vpc_id
vpc_endpoint_subnet_ids = local.vpc_endpoint_subnet_ids
vpc_endpoint_service_name = "s3"
master_prefix = var.master_prefix
vpc_tags = var.vpc_tags
# providers = {
# aws = aws.sharedservices
# }
}
*** provider.tf removed from child module folder ***
D:\AWS_LZ\abc-prod-shared-services\lz-tf-modules\vpc-endpoint>dir
Directory of D:\AWS_LZ\abc-prod-shared-services\lz-tf-modules\vpc-endpoint
04/17/2023 06:09 AM <DIR> .
04/17/2023 06:09 AM <DIR> ..
04/17/2023 06:12 AM 3,095 main.tf
04/13/2023 09:28 AM 388 outputs.tf
04/13/2023 09:28 AM 1,942 README.md
04/13/2023 09:28 AM 970 variables.tf
4 File(s) 6,395 bytes
2 Dir(s) 41,500,405,760 bytes free
main.tf in child module folder
========
data "aws_region" "current" {}
resource "aws_security_group" "vpc_endpoint_sec_group" {
name = format("%s-%s-%s-vpc-endpoint-%s", var.master_prefix, var.env_prefix, var.app_prefix, var.vpc_endpoint_service_name)
description = format("Security Group for VPC Endpoint com.amazonaws.%s.%s", data.aws_region.current.name, var.vpc_endpoint_service_name)
vpc_id = var.vpc_id
egress {
description = "Outbound to vpc endpoints"
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["172.29.0.0/16","172.29.0.0/16"]
}
ingress {
description = "Inbound to vpc endpoints"
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["172.29.0.0/16","172.29.0.0/16"]
}
}
resource "aws_vpc_endpoint" "vpce" {
vpc_id = var.vpc_id
service_name = format("com.amazonaws.%s.%s", data.aws_region.current.name, var.vpc_endpoint_service_name)
vpc_endpoint_type = "Interface"
security_group_ids = [aws_security_group.vpc_endpoint_sec_group.id]
subnet_ids = var.vpc_endpoint_subnet_ids
private_dns_enabled = false
tags = merge(
{
"Name" = format("%s-%s-%s-vpce-%s", var.master_prefix, var.env_prefix, var.app_prefix, var.vpc_endpoint_service_name)
},
var.tags, var.vpc_tags
)
}
resource "aws_route53_zone" "phz_vpc_endpoints" {
name = format("%s.%s.amazonaws.com", var.vpc_endpoint_service_name, data.aws_region.current.name)
comment = format("Private hosted zone for VPC Endpoint %s.%s.amazonaws.com", var.vpc_endpoint_service_name, data.aws_region.current.name)
vpc {
vpc_id = var.vpc_id
}
tags = merge(
{
"Name" = format("%s-%s-%s-vpce-%s", var.master_prefix, var.env_prefix, var.app_prefix, var.vpc_endpoint_service_name)
},
var.tags, var.vpc_tags
)
lifecycle {
ignore_changes = [
# The private hosted zone will be attached to multiple VPCs.
# These associations must be retained. Hence ignore changes to the vpc argument. If removed will cause drift and lead to disassociing the VPC
vpc
]
}
}
resource "aws_route53_record" "r53_alias_vpc_endpoint" {
zone_id = aws_route53_zone.phz_vpc_endpoints.zone_id
name = format("%s.%s.amazonaws.com", var.vpc_endpoint_service_name, data.aws_region.current.name)
type = "A"
alias {
name = aws_vpc_endpoint.vpce.dns_entry[0].dns_name
zone_id = aws_vpc_endpoint.vpce.dns_entry[0].hosted_zone_id
evaluate_target_health = true
}
}
=======================================================================
variable "vpc_endpoint_services" { type = list(string) description = "List of services for which VPC Endpoints nad their Route 53 Private Hosted Zones will be created" }
vpc_endpoint_services = ["ssmmessages", "ssm", "ec2messages", "secretsmanager", "git-codecommit", "datasync", "kms", "logs", "sts", "email-smtp"]