Problems deploying logs account from terraform-aws-service-catalog

[yuriolive]

Hi guys,

We are trying to deploy the infrastructure-live example on the terraform-aws-service-catalog https://github.com/gruntwork-io/terraform-aws-service-catalog/tree/master/examples/for-production/infrastructure-live but we are having some issues related to ExampleAMIEncryptionKMSKeyArn not existing. Looks like this is hard coded on the account-baseline-app-base.hcl file .

Other thing, which order should we apply terragrunt, so first we should apply the logs baseline or the shared?

[rhoboat]

Hi Yuri,
Here's a response that might help with deploying the Ref Arch from scratch. It isn't the perfect solution, as we're prioritizing making deployment more efficient, which means we put less priority on the detailed guide for deploying your own Ref Arch. But at least that response lists the order of apply.

Yes, you highlighted a key point about the for-production infrastructure-live example. It's an example generated from a real Ref Arch that we deployed using dummy values. So you need to update the terragrunt.hcl files with real inputs, which we cannot know for you ahead of time. Also make note of the region that you're deploying into, as the example code there also generates all values including the AWS region.

[yuriolive]

Hi @rhoboat I have worked today on trying to fix this. For what I know the account-baseline from the shared account need to be applied before the logs, security and apps accounts because all these accounts uses the KMS encryption key created by the shared account.

And yes we can reference the KMS key before the creation, I did this today. Basically changing this line https://github.com/gruntwork-io/terraform-aws-service-catalog/blob/6c5660ca8096817e9798e77bbab2307e0af62f16/examples/for-production/infrastructure-live/_envcommon/landingzone/account-baseline-app-base.hcl#L195 to this:

"arn:aws:kms:${local.common_vars.locals.default_region}:${local.account_ids["shared"]}:alias/ami-encryption"

You also have to change this line in the security terragrunt.hcl file:

https://github.com/gruntwork-io/terraform-aws-service-catalog/blob/178765d5c10edd93957bc968a795c67844505167/examples/for-production/infrastructure-live/security/_global/account-baseline/terragrunt.hcl#L203