https://cloudposse.com logo
Join Slack
Powered by
# terraform
  • j
    Lessons learned from scaling Infrastructure as Code from 5 to 1000+ workspaces https://www.ordisi.us/posts/2026_1_scaling/
    đź’ˇ 1
  • j
  • r
    Hello. Are there any good workarounds for depends_on in data resources and cases like https://github.com/hashicorp/terraform-provider-aws/issues/29421 ? In my setup, I am trying to create a terraform aws-sso module, which not only creates AWS PS and assigns to accounts, but also creates an AD group, triggers AWS SCIM sync, and then using data resource finds the corresponding AWS SSO group id via its name. The issue is that data resource needs to depend on the AD SCIM trigger resource, which results in constant "known after apply" AWS Permission Set account assignment resource recreation due to how data resources work. I know that I can use ignore_changes lifecycle, or even separate the module into two technically, but just curious if anyone faced something similar and has some other approaches.
    l
    p
    • 3
    • 2
  • d
    What’s the reasoning behind having so many of components being pinned to < 6 for the aws provider? Lambdas need a provider version 6.21> to utilize python 3.14. We’re particularly hitting this issue with the 
    aws-datadog-lambda-forwarder
    component also having a requirement on the 
    aws-datadog-credentials
    component. I understand I can pull the latter locally and reference that way, but would like to see the upstream be operational if it can support it.
    j
    e
    • 3
    • 6
  • c
    Sharing for visibility: https://github.com/goreleaser/goreleaser/issues/6514. Newer go-releaser versions are breaking provider signing.
    ❤️ 1
    đź‘Ť 3
    e
    i
    • 3
    • 4
  • j
    Hello! I'm looking for a way to switch identity depending on the component in a stack. I have a default identity which I use store terraform state file, But the component that I'm trying to create should be on another account. I have tried using the component level identity selection, but it isn't working. it tries to create the component on the default identity no matter the config I tried.
    j
    e
    • 3
    • 3
  • s
    Hi everyone 👋 I hope you're doing well. I wanted to kindly ask if someone might be able to take a look at the following issue when they have time: https://github.com/cloudposse/terraform-aws-rds-cluster/issues/271 It’s about making the random “pet name” suffix configurable (or optionally disabled) for instance names. I’m not entirely sure if there’s already a recommended approach for this, so I’d really appreciate any guidance or help. I understand everyone has a lot on their plate, so thank you very much in advance for your time and consideration — it’s genuinely appreciated 🙏 Please let me know if I can provide any additional details. Thanks again! update: we opened PR making that suffix optional: https://github.com/cloudposse/terraform-aws-rds-cluster/pull/282
  • g
    Hey folks 👋 I'm working on an interesting problem and I feel like someone out there must have run into this before: Problem/Background • I'm currently assuming an aws role to access an s3 bucket for backend state as follows:
    Copy code
    terraform {
  backend "s3" {
    ...
    assume_role = {
      role_arn = var.backend_assume_role_arn
    }
    ...
  }
}
    • This role has permissions to read and write to the s3 bucket, and I'd like to scope down permissions so that I use a read-only role during 
    init
    and 
    plan
    phases, and switch to a read-write role for the 
    apply
    phase. Where I'm stuck • I can swap in the read-write role arn before running the 
    apply
    phase, but the problem I run into is that since the backend config changes, a 
    init -reconfigure
    is required here. • If I run 
    tofu init -reconfigure
    before the 
    apply
    , this leads to 
    Error: Inconsistent dependency lock file
     • I've also attempted 
    tofu init -reconfigure -lockfile=readonly
    , but that leads to 
    Error: Provider dependency changes detected
     • At this point, my only option is to run another 
    tofu plan
    , which is out of the question. An alternative • I can remove the 
    assume_role
    out of the 
    backend
    block entirely. • This allows me to assume a read-only role to begin with (in my terminal, pipeline, etc), and I can 
    init
    and 
    plan
    with it • Then I can assume a read-write role before running the 
    apply
    • This does work, but I'm reaching out for other ideas here. Ideally, I don't want to have to switch role in my terminal or pipeline. The pattern I'm trying to maintain is a single AWS role that can assume the read or write roles to the s3 bucket backend during 
    init/plan
    vs 
    apply
    .
    e
    y
    a
    • 4
    • 19
  • m
    Email received today… 🤔
    Your account has now been migrated from the legacy Free plan to HCP Terraform Free. This transition is complete, and you can continue using the platform on the Free tier at no cost.
    HCP Terraform Free is built to support modern infrastructure teams with stronger security, governance, and collaboration capabilities—while incurring no cost to you for up to 500 managed resources per month.
    Now that you’re on HCP Terraform Free, you can take advantage of:
    • Unlimited users – Invite your entire team and collaborate without seat limits
    • Single sign-on (SSO) – Secure access using your organization’s identity provider
    • Policy enforcement – Maintain governance and consistency across infrastructure changes
    • Run tasks – Integrate security, compliance, and other tools directly into your Terraform workflows
    • Stacks – Simplify provisioning and managing resources at scale, reducing the time and overhead of managing infrastructure
    j
    • 2
    • 3
  • m
  • m
    supply chain attack targeting the official 
    checkmarx/kics
    Docker Hub repository
  • a
    Because 
    mq.t3.micro
    is only available for ActiveMQ. For RabbitMQ, the instance types start at 
    large
    , on either the 
    m5
    or 
    m7g
    generations.
    Copy code
    aws mq describe-broker-instance-options --engine-type ACTIVEMQ | jq -r '.BrokerInstanceOptions[] | .HostInstanceType'
mq.m5.2xlarge
mq.m5.2xlarge
mq.m5.4xlarge
mq.m5.4xlarge
mq.m5.large
mq.m5.large
mq.m5.xlarge
mq.m5.xlarge
mq.t3.micro
    Copy code
    aws mq describe-broker-instance-options --engine-type RABBITMQ | jq -r '.BrokerInstanceOptions[] | .HostInstanceType'
mq.m5.2xlarge
mq.m5.4xlarge
mq.m5.large
mq.m5.xlarge
mq.m7g.12xlarge
mq.m7g.16xlarge
mq.m7g.2xlarge
mq.m7g.4xlarge
mq.m7g.8xlarge
mq.m7g.large
mq.m7g.medium
mq.m7g.xlarge
    • 1
    • 1
  • r
    Is there a private ca terraform module/component? I swear I had found one before in the cloudposse/ or cloudposse-terraform-components/ orgs and now I cannot find it
    e
    • 2
    • 12
  • m
    e
    a
    • 3
    • 2
  • j
    just in case anyone is interested, this is going on right now https://www.iacconf.com/
  • a
    OpenTofu 1.12 is now available! - Read the full release notes here: https://github.com/opentofu/opentofu/releases/tag/v1.12.0
    e
    j
    • 3
    • 5
  • m
    Curious what the community thinks about using Terraform to manage cloudformation stacks? I deployed the AWS innovation sandbox this week but their deployment options were limited, so went with Terraform orchestrating the CF
    r
    p
    +2
    • 5
    • 10
  • m
    Checking in a year after this article on Terraform/Tofu merge queues. Is anyone using merge queues for their repos? We have it configured but haven't flipped the switch on it yet
    e
    • 2
    • 3
  • n
    Hi đź‘‹ - I wanted to see if I can get someone to take a look at this PR to add mTLS support to the CloudFront CDN module: https://github.com/cloudposse/terraform-aws-cloudfront-cdn/pull/163
    đź‘€ 1
    merged 1
    a
    e
    • 3
    • 5
  • m
    If anyone wants to see Mermaid support make it into OpenTofu, feel free to upvote this issue: https://github.com/opentofu/opentofu/issues/4299
    đź‘€ 2
    r
    • 2
    • 2
  • f
    Hey everyone glad be here finally found a related community
    🙌 3
  • m
    Hey folks! Question: have you found a tool for reverse engineering existing resources into Terraform? In the past I used Terraformer: github.com/GoogleCloudPlatform/terraformer but see that it is no longer maintained: 
    This repository was archived by the owner on Mar 16, 2026. It is now read-only.
    I’ll look around to see if any other tools might have taken its place but wondered if you might be using a different tool for reverse engineering.
    e
    m
    m
    • 4
    • 9
  • z
    s3files on the roadmap for the s3 bucket module?
    m
    e
    • 3
    • 7
  • n
    Anyone need AWS, API integration work needed
  • j
    not sure whats the best channel for this , but we're interested in the native ecs blue green & found a relevant P.R thats a bit stale github.com/cloudposse/terraform-aws-ecs-alb-service-task/pull/270#… Anything needed to get it over the edge?
    p
    e
    y
    • 4
    • 8
  • a
    Hi đź‘‹ - can someone take a look at this PR for Migration of existing regional RDS to under global RDS: github.com/cloudposse/terraform-aws-rds-cluster/pull/288
  • m
    Interesting new feature landing in 
    v1.17.0
    . It introduces a new plan flag: 
    terraform plan -minimal-refresh
    . Using 
    -minimal-refresh
    is similar in principle to #35290 (comment), per resource instance, so Terraform will first plan using the pre-refreshed state of a resource and if the change produced is a no-op, then the refresh will be skipped. If that plan does produce a change (anything but no-op), then Terraform will refresh the state for just that resource and run another plan. github.com/hashicorp/terraform/issues/35290
    e
    • 2
    • 1
  • r
    Is github.com/cloudposse/terraform-provider-awsutils still maintained? im curious if newer aws golang resources can be submitted there that aren't supported by the aws provider?
    a
    e
    • 3
    • 3
  • a
    Hi everyone, I recently came across the Elastic Beanstalk Terraform module and noticed the maintainer-needed notice. AWS also recently introduced Elastic Beanstalk Cluster Mode, which uses EKS underneath while Elastic Beanstalk manages the underlying cluster. I’m currently researching Cluster Mode and planning to build a Terraform implementation alongside a technical series I’m writing about it. I was wondering if anyone in the community has started looking at Cluster Mode support for the existing module, or if there are any plans around it. I’d also be interested in contributing if there’s an opportunity to help move the module forward Thanks!
    e
    • 2
    • 7
  • m
    In my limited free time, I enjoy maintaining and contributing to community Terraform modules. Digging through the Terraform Registry documentation and switching between the browser and terminal can be tedious, so I built 
    tfrd
    to compare the resources in a Terraform configuration with the provider schema and report unused attributes and parameters. As a community contributor, I want modules to reflect the full range of functionality providers support, and this tool helps me find gaps. github.com/RoseSecurity/tfrd
    👍🏾 1
    🚀 1
    đź‘Ť 1
    👍🏽 1
    đź‘€ 1