Rod Christiansen
06/17/2022, 4:04 PMzwass
Rod Christiansen
06/17/2022, 4:11 PMterraform show
I get:terraform apply -var-file=prod.tfvars
I get a lot of│ Error: failed creating IAM Role (fleetdm-role): EntityAlreadyExists: Role with name fleetdm-role already exists.
terraform destroy
as wellzwass
Rod Christiansen
06/17/2022, 4:31 PMzwass
terraform destroy
, does it seem to destroy everything?Rod Christiansen
06/17/2022, 4:32 PMvars
and now it can’t interact with them?zwass
Rod Christiansen
06/17/2022, 4:33 PMzwass
terraform destroy
?Rod Christiansen
06/17/2022, 4:40 PMDestroy complete! Resources: 53 destroyed.
zwass
terraform apply -var-file=prod.tfvars
Rod Christiansen
06/17/2022, 4:46 PMzwass
Rod Christiansen
06/17/2022, 4:48 PMaws_route53_record.dogfood_fleetdm_com_validation["<http://fleet.ecuad.ca|fleet.ecuad.ca>"]: Creating...
aws_route53_record.dogfood_fleetdm_com_validation["<http://fleet.ecuad.ca|fleet.ecuad.ca>"]: Still creating... [10s elapsed]
aws_route53_record.dogfood_fleetdm_com_validation["<http://fleet.ecuad.ca|fleet.ecuad.ca>"]: Still creating... [20s elapsed]
aws_route53_record.dogfood_fleetdm_com_validation["<http://fleet.ecuad.ca|fleet.ecuad.ca>"]: Still creating... [30s elapsed]
aws_route53_record.dogfood_fleetdm_com_validation["<http://fleet.ecuad.ca|fleet.ecuad.ca>"]: Still creating... [40s elapsed]
aws_route53_record.dogfood_fleetdm_com_validation["<http://fleet.ecuad.ca|fleet.ecuad.ca>"]: Still creating... [50s elapsed]
aws_route53_record.dogfood_fleetdm_com_validation["<http://fleet.ecuad.ca|fleet.ecuad.ca>"]: Creation complete after 52s [id=Z0153789AGKAV73DDKKN__3b82f3c76c9877eb0905c1f97d84050c.fleet.ecuad.ca._CNAME]
aws_acm_certificate_validation.dogfood_fleetdm_com: Creating...
aws_acm_certificate_validation.dogfood_fleetdm_com: Creation complete after 0s [id=2022-06-17 16:48:19.658 +0000 UTC]
╷
│ Warning: Argument is deprecated
│
│ with aws_s3_bucket.osquery-results,
│ on <http://firehose.tf|firehose.tf> line 7, in resource "aws_s3_bucket" "osquery-results":
│ 7: resource "aws_s3_bucket" "osquery-results" { #tfsec:ignore:aws-s3-encryption-customer-key:exp:2022-07-01 #tfsec:ignore:aws-s3-enable-versioning #tfsec:ignore:aws-s3-enable-bucket-logging:exp:2022-06-15
│
│ Use the aws_s3_bucket_lifecycle_configuration resource instead
│
│ (and 8 more similar warnings elsewhere)
╵
╷
│ Error: failed creating IAM Role (fleetdm-role): EntityAlreadyExists: Role with name fleetdm-role already exists.
│ status code: 409, request id: d2dcb2ad-bfa4-49e9-8362-6a5fb48d5fdd
│
│ with aws_iam_role.main,
│ on <http://ecs-iam.tf|ecs-iam.tf> line 74, in resource "aws_iam_role" "main":
│ 74: resource "aws_iam_role" "main" {
│
╵
╷
│ Error: error creating application Load Balancer: DuplicateLoadBalancerName: A load balancer with the same name 'fleetdm' exists, but with different settings
│ status code: 400, request id: e49a8a95-68ef-4ec6-9b04-5860b251dab2
│
│ with aws_alb.main,
│ on <http://ecs.tf|ecs.tf> line 14, in resource "aws_alb" "main":
│ 14: resource "aws_alb" "main" {
│
╵
╷
│ Error: Creating CloudWatch Log Group failed: ResourceAlreadyExistsException: The specified log group already exists: The CloudWatch Log Group 'fleetdm' already exists.
│
│ with aws_cloudwatch_log_group.backend,
│ on <http://ecs.tf|ecs.tf> line 114, in resource "aws_cloudwatch_log_group" "backend":
│ 114: resource "aws_cloudwatch_log_group" "backend" { #tfsec:ignore:aws-cloudwatch-log-group-customer-key:exp:2022-07-01
│
╵
╷
│ Error: error creating S3 Bucket (ca-ecuad-queryops-fleet-osquery-results-archive-dev): BucketAlreadyOwnedByYou: Your previous request to create the named bucket succeeded and you already own it.
│ status code: 409, request id: 8QKQAWKMKFPG8V3T, host id: cGLTOq4ot2jEU2WRo6W7KOFHMqUUGEDol93rope13+e2btUrMvzII5SEHItCYT+99PGKR53PQcU=
│
│ with aws_s3_bucket.osquery-results,
│ on <http://firehose.tf|firehose.tf> line 7, in resource "aws_s3_bucket" "osquery-results":
│ 7: resource "aws_s3_bucket" "osquery-results" { #tfsec:ignore:aws-s3-encryption-customer-key:exp:2022-07-01 #tfsec:ignore:aws-s3-enable-versioning #tfsec:ignore:aws-s3-enable-bucket-logging:exp:2022-06-15
│
╵
╷
│ Error: error creating S3 Bucket (ca-ecuad-queryops-fleet-osquery-status-archive-dev): BucketAlreadyOwnedByYou: Your previous request to create the named bucket succeeded and you already own it.
│ status code: 409, request id: 8QKS5J9XHNHQ6939, host id: SRTEVZrLHrsc9qt4Sii5tNnZtahUO60eEhaDZdW2KcaYjFKRqMWOdLX7trgWHh4kv8Guk7hmkpY=
│
│ with aws_s3_bucket.osquery-status,
│ on <http://firehose.tf|firehose.tf> line 41, in resource "aws_s3_bucket" "osquery-status":
│ 41: resource "aws_s3_bucket" "osquery-status" { #tfsec:ignore:aws-s3-encryption-customer-key:exp:2022-07-01 #tfsec:ignore:aws-s3-enable-versioning #tfsec:ignore:aws-s3-enable-bucket-logging:exp:2022-06-15
│
╵
╷
│ Error: error creating Secrets Manager Secret: ResourceExistsException: The operation failed because the secret /fleet/database/password/master already exists.
│
│ with aws_secretsmanager_secret.database_password_secret,
│ on <http://rds.tf|rds.tf> line 7, in resource "aws_secretsmanager_secret" "database_password_secret":
│ 7: resource "aws_secretsmanager_secret" "database_password_secret" { #tfsec:ignore:aws-ssm-secret-use-customer-key:exp:2022-07-01
│
╵
╷
│ Error: Error creating DB Parameter Group: DBParameterGroupAlreadyExists: Parameter group fleetdm-aurora-db-mysql-parameter-group already exists
│ status code: 400, request id: 58d16106-fe62-4906-b133-cccfabdb4d42
│
│ with aws_db_parameter_group.example_mysql,
│ on <http://rds.tf|rds.tf> line 107, in resource "aws_db_parameter_group" "example_mysql":
│ 107: resource "aws_db_parameter_group" "example_mysql" {
│
╵
╷
│ Error: Error creating DB Cluster Parameter Group: DBParameterGroupAlreadyExists: Parameter group fleetdm-aurora-mysql-cluster-parameter-group already exists
│ status code: 400, request id: 96730c78-873b-4e42-bfca-3a34895dbcdd
│
│ with aws_rds_cluster_parameter_group.example_mysql,
│ on <http://rds.tf|rds.tf> line 113, in resource "aws_rds_cluster_parameter_group" "example_mysql":
│ 113: resource "aws_rds_cluster_parameter_group" "example_mysql" {
│
╵
╷
│ Error: error creating S3 Bucket (osquery-carve-default): BucketAlreadyExists: The requested bucket name is not available. The bucket namespace is shared by all users of the system. Please select a different name and try again.
│ status code: 409, request id: BYZ1KZ1KNRCAJ0N6, host id: 5gY0n/SnlpvTsDu0zsCishhV3c4GUrirj3knAb7cTmc8MNCEcj50oKHkiIqkNAhv7bC+rcKeFdE=
│
│ with aws_s3_bucket.osquery-carve,
│ on <http://s3.tf|s3.tf> line 9, in resource "aws_s3_bucket" "osquery-carve":
│ 9: resource "aws_s3_bucket" "osquery-carve" { #tfsec:ignore:aws-s3-enable-versioning #tfsec:ignore:aws-s3-encryption-customer-key:exp:2022-07-01 #tfsec:ignore:aws-s3-enable-bucket-logging:exp:2022-06-15
│
╵
╷
│ Error: Error creating DB Subnet Group: DBSubnetGroupAlreadyExists: The DB subnet group 'fleetdm-mysql-iam' already exists.
│ status code: 400, request id: 4ec6cead-a4a7-45a2-a46b-50af416b34fb
│
│ with module.aurora_mysql.aws_db_subnet_group.this[0],
│ on .terraform/modules/aurora_mysql/main.tf line 38, in resource "aws_db_subnet_group" "this":
│ 38: resource "aws_db_subnet_group" "this" {
│
╵
╷
│ Error: Error creating DB Subnet Group: DBSubnetGroupAlreadyExists: The DB subnet group 'fleet-vpc' already exists.
│ status code: 400, request id: 6785406d-6e31-4016-b3ba-61df708bb2ec
│
│ with module.vpc.aws_db_subnet_group.database[0],
│ on .terraform/modules/vpc/main.tf line 458, in resource "aws_db_subnet_group" "database":
│ 458: resource "aws_db_subnet_group" "database" {
│
╵
╷
│ Error: creating ElastiCache Subnet Group (fleet-vpc): CacheSubnetGroupAlreadyExists: Cache subnet group fleet-vpc already exists.
│ status code: 400, request id: 1d124b61-29b4-46e1-a372-fc2e5fcb4b77
│
│ with module.vpc.aws_elasticache_subnet_group.elasticache[0],
│ on .terraform/modules/vpc/main.tf line 542, in resource "aws_elasticache_subnet_group" "elasticache":
│ 542: resource "aws_elasticache_subnet_group" "elasticache" {
│
╵
╷
│ Error: Error creating EIP: AddressLimitExceeded: The maximum number of addresses has been reached.
│ status code: 400, request id: a840976c-a6a1-45fe-8f1e-c155a458d6b1
│
│ with module.vpc.aws_eip.nat[0],
│ on .terraform/modules/vpc/main.tf line 1001, in resource "aws_eip" "nat":
│ 1001: resource "aws_eip" "nat" {
│
╵
Releasing state lock. This may take a few moments...
rod@RodChristiansen aws %
zwass
Rod Christiansen
06/17/2022, 5:16 PMBenjamin Edwards
06/17/2022, 5:27 PMRod Christiansen
06/17/2022, 5:42 PMBenjamin Edwards
06/17/2022, 7:23 PM<http://main.tf|main.tf>
edit the terraform block to look like:
terraform {
# backend "s3" {
# bucket = "fleet-terraform-remote-state"
# region = "us-east-2"
# key = "fleet"
# dynamodb_table = "fleet-terraform-state-lock"
# }
required_providers {
aws = {
source = "hashicorp/aws"
version = "3.63.0"
}
tls = {
source = "hashicorp/tls"
version = "3.3.0"
}
}
}
Then make sure you follow this step of the guide:
We’ll also need afile to make some environment-specific variable overrides. Create a file in the same directory namedtfvars
and paste the contents (note the bucket names will have to be unique for your environment):prod.tfvars
fleet_backend_cpu = 1024
fleet_backend_mem = 4096 //software inventory requires 4GB
redis_instance = "cache.t3.micro"
domain_fleetdm = "<http://fleet.queryops.com|fleet.queryops.com>" // YOUR DOMAIN HERE
osquery_results_s3_bucket = "foo-results-bucket" // UNIQUE BUCKET NAME
osquery_status_s3_bucket = "bar-status-bucket" // UNIQUE BUCKET NAME
file_carve_bucket = "qux-file-carve-bucket" // UNIQUE BUCKET NAME
If you run into trouble, maybe we can screen share on zoom and get it sorted out?Rod Christiansen
06/17/2022, 7:29 PMBenjamin Edwards
06/17/2022, 8:01 PMRod Christiansen
06/20/2022, 5:58 AM╷
│ Error: error creating ElastiCache Replication Group (fleetdm-redis): waiting for completion: RequestError: send request failed
│ caused by: Post "<https://elasticache.ca-central-1.amazonaws.com/>": read tcp 192.168.1.137:55529->52.94.100.101:443: read: connection reset by peer
│
│ with aws_elasticache_replication_group.default,
│ on <http://redis.tf|redis.tf> line 13, in resource "aws_elasticache_replication_group" "default":
│ 13: resource "aws_elasticache_replication_group" "default" {
│
╵
zwass
Rod Christiansen
06/21/2022, 4:02 AMzwass
Rod Christiansen
06/21/2022, 4:08 AMzwass
Rod Christiansen
06/21/2022, 4:16 AMBenjamin Edwards
06/21/2022, 2:49 PMRod Christiansen
06/21/2022, 6:27 PMzwass
Rod Christiansen
06/21/2022, 6:29 PMBenjamin Edwards
06/21/2022, 6:29 PMRod Christiansen
06/21/2022, 7:12 PMterraform apply -destroy
• warning about unique naming for the buckets/dynamo since they are global
• warning on the migration step about docker limit like I hit and how to retry
• the hashicorp/aws
version needs to match
•