modernisation-platform
modernisation-platform copied to clipboard
Fix issue with baselines module throwing an error if default VPC resources don't exist
The ministryofjustice/modernisation-platform-terraform-baselines module attempts to tag default VPC resources when it is run.
If an account no longer has default VPC resources, it throws an error:
Error: InvalidGroup.NotFound: The security group 'sg-123' does not exist
status code: 400, request id: 123
In the future, we'd like to delete these during the account bootstrap step so users don't get confused with our core network strategy and the VPCs configured as part of that; though Terraform doesn't currently support the full lifecycle of these resources, so for now, we should check if a default resource exists, and then tag it, or ignore it if not.
It is not possible to (easily) check if a default VPC exists. We have this issue with the analytical platform account as they have deleted their default VPC, so we are skipping the baseline for this account for now. Once the aws provider supports deleting default vpcs we will delete for all accounts and remove from the baselines.
Support for full lifecycle management in terraform of default vpcs is coming in Version 4.0 of the AWS Provider
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/guides/version-4-upgrade#full-resource-lifecycle-of-default-resources
All of our customers are now using AWS Provider V4 so this can be progressed
Removed this one from the sprint as @davidkelliott is working on this as time allows, and as it is not tied to any specific sprint goal.
The delete code has been created, still need to deal with regions and how to not manage in terraform once deleted
This issue is stale because it has been open 90 days with no activity.
Currently not an issue - as we have implemented a workaround