lacework / terraform-aws-config Goto Github PK
View Code? Open in Web Editor NEWTerraform module for configuring an integration with Lacework and AWS for cloud resource configuration assessment
Terraform module for configuring an integration with Lacework and AWS for cloud resource configuration assessment
Describe the bug
Running terraform init
fails when using older specific version of the module lacework/config/aws (0.5.0) with older terraform 0.13.7.
The module loads a submodule lacework/iam-role/aws using a pessimistic version constraint of "~> 0.2" which allows it to download the latest 0.3.0 iam-role (released 3 weeks ago) which added a TF version constraint of >= 0.14. Running terraform init
has been broken for us for 3 weeks now.
Steps to reproduce
Using terraform 0.13.7, I cannot terraform init an application that loads the aws_config module:
module "aws_config" {
source = "lacework/config/aws"
version = "0.5.0"
}
Expected behavior
I pin version 0.5.0 in my module load of lacework/config/aws because it works with TF 0.13.7. I expect any submodules it loads to also allow TF 0.13.7.
Please complete the following information):
Additional context
I'd like to request a patch version 0.5.1 that loads the iam submodule using a more strict pessimistic version constraint (the version
line) :
module "lacework_cfg_iam_role" {
source = "lacework/iam-role/aws"
version = "~> 0.2.0"
create = var.use_existing_iam_role ? false : true
iam_role_name = var.iam_role_name
lacework_aws_account_id = var.lacework_aws_account_id
external_id_length = var.external_id_length
tags = var.tags
}
Making this change locally allows terraform init to succeed.
This same iam-role dependency exists in "lacework/cloudtrail/aws" (2.1.1) and "lacework/ecr/aws" (0.6.0) modules, and both are resolved by making the same change to the version
line above. If you are willing, I'd like to request a patch release for those as well (2.1.2 and 0.6.1, respectively) with the same version modification. I can create separate issue requests if necessary (and if you are willing to entertain this idea).
If you can advise some way of controlling the versioning of submodules when loading the main module, that would be great (but I don't think such a method exists as code is written.)
If the response is "we don't want to support an old version like this", then I will look at cloning your modules into my local terraform modules with the change made locally, but I'd like to avoid that if possible. (When we upgrade terraform -> 0.14 ->0.15 -> 1.x we will resolve all of these issues, but it's a complex code base.)
Describe the bug
This module only supports AWS provider v3 and v4.
Expected behavior
It should also support AWS provider v5, because folks will want to start using that.
that will include #39, thanks!
Describe the bug
This module consumes the lacework/iam-role/aws
module, but doesn't pin a specific version of that module. This means that whenever the iam-role
module ships a new version, users of the terraform-aws-config
module will inherit that new version of iam-role
without really knowing it.
Steps to reproduce
Take any terraform environment where you have used terraform-aws-config
and you have already run terraform init
before lacework/terraform-aws-iam-role#46 was merged, run terraform plan
and see no diffs.
Then run rm -rf .terraform && terraform init && terraform plan
which will pull in the new version of iam-role
and you'll see diffs.
Expected behavior
You should never see diffs without explicitly bumping a version.
Screenshots
N/A
Please complete the following information):
Describe the Feature Request
Typically, Terraform community modules should have an example module configuration listed in the default branch README.md
. In this repository there's no clear indication of how to call this module. Additionally, there's no reference to this module from the Hashicorp Terraform Registry1.
Is your feature request related to a problem? Please describe
The problem is that users of the module must determine the correct path for the source since the examples directory only reference relative paths.
In this case source = "lacework/config/aws"
works but without existing in the the registry1 one could also think it has to be called like source = "git::https://github.com/lacework/terraform-aws-config?ref=tags/<version>
.
Describe Preferred Solution
There should be a Usage
section describing a typical execution of the module.
Additional Context
See any of the modules here: https://github.com/terraform-aws-modules for reference.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.