Migrate terraform modules to updated provider format

187 Views Asked by At

I inherited a codebase with all providers stored inside modules and am having a lot of trouble moving the providers out so that I can remove the resources created from modules.

The current design violates the rules outlined here: https://www.terraform.io/docs/configuration/providers.html and makes removing modules impossible.

My understanding of the migration steps is:

  1. Create a provider for use at the top-level
  2. Update module resources to use providers stored outside of the module
  3. Remove module (with top-level provider persisting)

Example module

An example /route53-alias-record/main.ts is:

variable "evaluate_target_health" {
  default = true
}

data "terraform_remote_state" "env" {
  backend = "s3"

  config = {
    bucket = "<bucket>"
    key    = "infra-${var.environment}-${var.target}.tfstate"
    region = "<region>"
  }
}

provider "aws" {
  region              = data.terraform_remote_state.env.outputs.region
  allowed_account_ids = data.terraform_remote_state.env.outputs.allowed_accounts

  assume_role {
    role_arn = data.terraform_remote_state.env.outputs.aws_account_role
  }
}

resource "aws_route53_record" "alias" {
  zone_id = data.terraform_remote_state.env.outputs.public_zone_id
  name    = var.fqdn
  type    = "A"

  alias {
    name                   = var.alias_name
    zone_id                = var.zone_id
    evaluate_target_health = var.evaluate_target_health
  }
}

Starting usage

module "api-dns-alias" {
  source      = "../environment/infra/modules/route53-alias-record"
  environment = "${var.environment}"
  zone_id     = "${module.service.lb_zone_id}"
  alias_name  = "${module.service.lb_dns_name}"
  fqdn        = "${var.environment}.example.com"
}

Provider overriding

## Same as inside module
provider "aws" {
  region              = data.terraform_remote_state.env.outputs.region
  allowed_account_ids = data.terraform_remote_state.env.outputs.allowed_accounts

  assume_role {
    role_arn = data.terraform_remote_state.env.outputs.aws_account_role
  }
}

module "api-dns-alias" {
  source      = "../environment/infra/modules/route53-alias-record"
  environment = "${var.environment}"
  zone_id     = "${module.service.lb_zone_id}"
  alias_name  = "${module.service.lb_dns_name}"
  fqdn        = "${var.environment}.example.com"

  providers = {
    aws = aws ## <-- pass in explicitly
  }
}

I was able to safely deploy with the providers set, but I do not believe that they are being used inside the module, which means the handshake still fails when I remove the module and the resources cannot be deleted.

I am looking for the steps needed to migrate to an outside provider so that I can safely remove resources.

I am currently working with terraform 0.12.24

0

There are 0 best solutions below