Terraform Aws Tfstate Backend Versions Save

what

This PR add support for the attribute deletion_protection_enabled in the DynamoDB ressource

why

To address an issue https://github.com/cloudposse/terraform-aws-tfstate-backend/issues/143 To present or force DynamoDB table deletion

references

To address an issue https://github.com/cloudposse/terraform-aws-tfstate-backend/issues/143 https://aws.amazon.com/about-aws/whats-new/2023/03/amazon-dynamodb-table-deletion-protection/

what

• Fixes link in README that was pointing to wrong issue

why

• We don't want to lead people astray 👍

references

• This is a redo of #153 by @tripplilley. Fame, fortune, and internet points go to him 😄

what

This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

what

This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

what

The following step was returning an error:

terraform init -force-copy

Initializing the backend...

Successfully configured the backend "s3"! Terraform will automatically
use this backend unless the backend configuration changes.
Initializing modules...
Terraform encountered problems during initialisation, including problems
with the configuration, described below.

The Terraform configuration must be valid before initialization so that
Terraform can determine which modules and providers need to be installed.
╷
│ Error: Argument or block definition required
│
│   on backend.tf line 9, in terraform:
│    9:     assume_role.role_arn = ""
│
│ An argument or block definition is required here. To set an argument, use the equals sign "=" to introduce the argument value.
╵

what

This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

what

Improve TF formatting when a DynamoDB table is not specified.

why

As our CI pipeline checks formatting and we don't use a DynamoDB for locking, we keep committing changes made to the backend file which is handled by this module.

references

N/A

what

This parameter allows the user to specify policies that are applied to the S3 bucket with the policies defined by this module.

why

We want to add policies that forbid non admin users to access the bucket containing tfstates.

This commit allow us to specify a policy that implement these restriction without clobbering the policies put in place by this module.

Note that I have no problem to change the name of this new parameter if you want another.

references

Closes: #115

what

• added tfsec ignores to false positives

why

• the terraform aws_s3_bucket resource was updated some time ago to deprecate access policies, encryption and logging as arguments, instead preferring separate terraform resources. tfsec incorrectly highlights the aws_s3_bucket resource are CRITICALly vulnerable.

references

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#argument-reference

Rebuild github dir from the template

what

• Always require TLS connection to S3 bucket

why

• Restores intended behavior
• Fixes crash. Supersedes and closes #135. Thank you @dod38fr

This PR contains the following updates:

Release Notes

v1.1.0

Compare Source

v1.0.0

Compare Source

Important Notes

• Terraform version 1.3.0 and Terraform AWS version 4.9.0 or later are required
• The new bucket_key_enabled flag defaults to false for backward compatibility. At one point we recommend setting it to true for significant savings on KMS usage, but since bucket keys are only reused within a user session, it is not clear if it provides any savings at all. See AWS docs for more information.
• The new lifecycle_configuration_rules input replaces the now deprecated individual inputs for individual settings of a single lifecycle rule. See the terraform-aws-s3-bucket documentation for details on how to specify lifecycles using lifecycle_configuration_rules. This mechanism is much more flexible and closely follows the Terraform aws_s3_bucket_lifecycle_configuration resource.
• The new source_policy_documents input replaces the now deprecated policy input to match changes to the aws_iam_policy_document resource
• You can now select default values for (non-deprecated) inputs by setting them to null
• With Terraform 1.3 the manual interventions documented for upgrading to this module's versions 0.27.0 and 0.28.0 are no longer needed. You can safely upgrade from any earlier version to this one (although we always recommend leaving force_destroy at its default value of false, and if you have it set to true but want extra safety against the S3 bucket being destroyed, set it to false before upgrading).
• The force_destroy_enabled flag introduced in v0.27.0 has been removed
• In version 0.28.0, old lifecycle rule variables were deprecated and the new lifecycle_configuration_rules input was introduced. In that version, you would continue to get the old default lifecycle rule even if you supplied new rules via lifecycle_configuration_rules. Now, the default behavior is to ignore all the deprecated lifecycle inputs when the lifecycle_configuration_rules input is not empty, unless you explicitly set lifecycle_rule_enabled to true.

Enhancements

v0.28.3: Not recommended, use v0.26.0 or v1.x instead

Compare Source

Update: This version no longer recommended

With the release of version 1.0.0 of this module, use of this version is no longer recommended. When you are able to use Terraform v1.3.0 or later and Terraform AWS provider v4.9.0 or later, upgrade directly to v1.0.0 or later of this module.

🤖 Automatic Updates

v0.28.2: Action required if updating from prior to v0.28.0

Compare Source

Update: This version no longer recommended

With the release of version 1.0.0 of this module, use of this version is no longer recommended. When you are able to use Terraform v1.3.0 or later and Terraform AWS provider v4.9.0 or later, upgrade directly to v1.0.0 or later of this module.

v0.28.0 introduced breaking changes with high risk of permanent data loss. See release notes there. This is only a safe upgrade if upgrading from v0.28.0.

We will convert to semantic versioning (incrementing the major version number for breaking changes), but having missed the opportunity to do that for earlier versions of this module, we are waiting for the next major change, expected to be soon after Terraform v1.3 is released.

🤖 Automatic Updates

v0.28.1: accidental release, do not use

Compare Source

v0.28.0 introduced breaking changes with high risk of permanent data loss. See release notes there. This is only a safe upgrade if upgrading from v0.28.0.

We will convert to semantic versioning (incrementing the major version number for breaking changes), but having missed the opportunity to do that for earlier versions of this module, we are waiting for the next major change, expected to be soon after Terraform v1.3 is released.

🤖 Automatic Updates

v0.28.0: (Action Needed) Support AWS v4 provider

Compare Source

WARNING, DATA LOSS LIKELY if you do not follow upgrade instructions:

• Upgrade instructions: v0.27.0 to v0.28.0
• Upgrade instructions: versions prior to v0.27.0 to v0.27.0

🚀 Enhancements

v0.27.0: (WARNING: Potential Data Loss) Prepare for AWS provider v4

Compare Source

Update: This version no longer recommended

With the release of version 1.0.0 of this module, use of this version is no longer recommended. When you are able to use Terraform v1.3.0 or later and Terraform AWS provider v4.9.0 or later, upgrade directly to v1.0.0 or later of this module.

Warning: Potential total data loss

This release is a refactoring in preparation for supporting Terraform AWS Provider v4. One feature was removed, but otherwise there are no changes to inputs or behavior. However, the Terraform "addresses" of resources have changed, so you are need to run several terraform state mv commands.

Warning: failure to run the required terraform state mv commands will cause Terraform to delete your existing S3 bucket and create a new one, deleting all the data stored in the bucket in the process.

Details on how to safely upgrade are in this repository's Wiki here

Support for "MFA delete" removed

In #​54 a contributor added support for MFA delete via the versioning_mfa_delete_enabled. In AWS provider version 3.x this argument was documented with the caveat

This cannot be used to toggle this setting but is available to allow managed buckets to reflect the state in AWS.

With AWS provider version 4.0, this argument now does toggle the setting. Unfortunately, that adds the requirement then when it is enabled, you must supply a current MFA token every time you run terraform apply. That is not compatible with automation, and therefore we have no intention to support it and have removed the versioning_mfa_delete_enabled input.

🚀 Enhancements

Breaking Changes

This PR introduces breaking changes to the module.

Different method of shortening names (RISK OF DATA LOSS)

Previous versions shortened some names where AWS imposes length restrictions of 63 or 64 characters by simply truncating them. This module now uses null-label to shorten generated names when necessary. It shortens names by replacing the last characters of the string with a hash of them. This reduces the likelihood of name collisions while enforcing length limits.

If this module previously truncated a generated name, the name will now change, and Terraform will try to destroy and replace existing resources. If this happens to your S3 bucket, you can specify the existing name in s3_bucket_name. If this happens in the replication role or policy name, you can safely let Terraform make the change.

Access Logging (RISK OF DATA LOSS)

The input logging_bucket_enabled has been removed

The input logging_bucket_enabled has been removed, and this module no longer creates an S3 bucket to receive logs. This is because configuring an S3 bucket, particularly lifecycle rules, is too complex to be included in this module.

If you previously had logging_bucket_enabled = true, upgrading to this version will cause Terraform to attempt to delete the logging bucket previously created. You will need to use terraform state rm to remove the S3 bucket from the state in order to keep Terraform from trying to delete it. You can use a module like s3-log-storage or s3-bucket to continue to manage the bucket, just import the bucket into the state using terraform import.

The logging input type has changed

The logging input type has changed from an object to a list of objects. This is the new Cloud Posse standard for optional inputs that are used to determine count, in order to avoid problems evaluating dynamic values during the planning phase. If you are providing a value, just put it in a list. If you are not providing a value, accept the default or pass in an empty list ([]). Do not pass in null.

Encryption no longer optional (RISK OF DATA LOSS)

AWS S3 buckets and DynamoDB tables are now always encrypted at rest, with no option to leave them unencrypted. Therefore the enable_server_side_encryption input has been removed. If you had set enable_server_side_encryption = false, then use terraform state mv to move ...aws_dynamodb_table.without_server_side_encryption[0] to ...aws_dynamodb_table.with_server_side_encryption[0] or else Terraform will delete your existing DynamoDB table and create a new one, causing a complete loss of DynamoDB table data.

Note that all the DynamoDB table data is only advisory, so a complete data loss will not cause a significant problem, but you still probably want to avoid it.

DynamoDB default billing mode changed from "provisioned" to "pay per request"

Due to both the low traffic in normal operations and the potentially high traffic in certain automated operations, the default billing mode has changed from "provisioned" to "pay per request". You can retain the previous mode by setting billing_mode = "PROVISIONED", which will also restore the previous read and write capacity defaults.

Bucket object ownership now defaults to BucketOwnerEnforced

AWS now recommends (and takes as default) setting "bucket object ownership" to BucketOwnerEnforced, which overrides and disables ACLs. This module now defaults to the same setting. You can continue to use ACLs by setting the new input bucket_ownership_enforced_enabled to false, but it is not recommended.

Generation of backend configuration file deprecated, default changed

The generation of a backend configuration file is deprecated and will be removed in a future release. Meanwhile, the default for terraform_version, which sets, in the generated backend configuration file, the value of the minimum version of Terraform to be allowed, has been changed to 1.0.0.

what

• Updated to support and require AWS provider version 4 or later
• Generate valid identifiers for replication resources when not providing null-label inputs
• The input logging_bucket_enabled has been removed
• The input logging was changed from an object type to a list of the same object type
• The input enable_server_side_encryption has been removed (encryption cannot be disabled)
• DynamoDB default billing mode changed from "provisioned" to "pay per request"
• Bucket object ownership for the creates S3 bucket now defaults to BucketOwnerEnforced
• The default value for input terraform_version has changed to "1.0.0"
• Add tags to created IAM Policy and Role for replication
• Add output of replication role ARN

why

• Version 4.0 introduced breaking changes (reverted in 4.9.0) that will be reintroduced in announced version 5.0 (no release date given). This update removes the use of deprecated features and is expected to work with version 5.0 when it is released.
• See details under "Breaking Changes" above.

references

• Supersedes and closes #125
• Supersedes and closes #124
• Obsoletes and closes #123
• Obsoletes and closes #121
• Supersedes and closes #119
• Closes #118
• Supersedes and closes #114
• Supersedes and closes #113
• Closes #111
• Closes #109
• Supersedes and closes #108
• Supersedes and closes #107
• Obsoletes and closes #106

This is my first PR to Cloudposse projects. Thanks for all the good contributions and please let me know if there's any adjustments needed.

what

• This will add support for setting a permission boundary for the IAM role
• This is needed for master payer accounts through resellers that restricts access to the master payer accunt.
• The value is optional

why

• This is needed for master payer accounts through resellers that restricts access to the master payer account and require the permissions boundary to be set on all new IAM roles to restrict access to certain resources.

references

• AWS documentation: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html
• https://registry.terraform.io/providers/hashicorp/aws%20%20/latest/docs/resources/iam_role#permissions_boundary

what

• Do not auto-publish from release branches

why

• When release-drafter auto-publishes, it sets the release as "latest", which is not what we want for updates to release branches.

what

• Update workflows and other framework to current versions

why

• Add support for release branches

what and why

Change all references to git.io/build-harness into cloudposse.tools/build-harness, since git.io redirects will stop working on April 29th, 2022.

References

• DEV-143