flaconi/terraform-aws-microservice

Boilerplate Terraform Module for creating resources for typical micro services.

terraform-aws-microservice's Issues

Potential overwrite of resources with dynamodb and dynamodb2_name

Finding found by @ronny-panknin-flaconi :

Description

Looking at the dynamodb.tf and dynamodb2.tf configuration, there seems to be an issue with name collision :

1/2 building locals

dynamodb.tf

locals {
  dynamodb_name = length(var.dynamodb_name_override) > 0 ? var.dynamodb_name_override : var.name
}

dynamodb2.tf

locals {
  dynamodb2_name = length(var.dynamodb2_name_override) > 0 ? var.dynamodb2_name_override : var.name
}

2/2 local name assignment

dynamodb.tf

module "dynamodb" {
  ...
  namespace = ""
  stage     = ""
  name      = local.dynamodb_name
  ...

dynamodb2.tf

module "dynamodb2" {
  ...
  namespace = ""
  stage     = ""
  name      = local.dynamodb2_name

Issue

If neither var.dynamodb_name_override nor var.dynamodb2_name_override are specified, which are optional, the one which gets rolled out later would/could overwrite the first one.

How to resolve?

This is tricky and there are multiple solutions to it, the big question is how do we make it consistent and easily understandable? Current consistency is to use var.name as the single point of truth for resource names.

Only thing I could come up with is to make dynamodb(2)?_name_override required, which however (will be inconsistent with other services provided.

@maartenvanderhoef any thoughts on this one?

Misssing rds parameters

Following RDS parameters are required for some services:

• auto_minor_version_upgrade
• copy_tags_to_snapshot
• enabled_cloudwatch_logs_exports

Dependabot can't parse your dynamodb.tf

Dependabot couldn't parse the dynamodb.tf found at /dynamodb.tf.

You can mention @dependabot in the comments below to contact the Dependabot team.

If `rds_enable_s3_dump` is `false`, we shouldn't need to pass dummy value for `rds_s3_dump_role_arn`

In order to avoid the creation of resources required for setting up the RDS-S3 dumps, we should be able to set rds_enable_s3_dump to false and by doing so avoid the need to pass any value for rds_s3_dump_role_arn.