Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

bug(terraform): false positive of "CloudWatch Without Retention Period Specified" #7254

Open
stevebosman opened this issue Sep 12, 2024 · 1 comment
Open

bug(terraform): false positive of "CloudWatch Without Retention Period Specified" #7254

stevebosman opened this issue Sep 12, 2024 · 1 comment
Labels
aws PR related with AWS Cloud bug Something isn't working community Community contribution terraform Terraform query

Comments

@stevebosman
Copy link

stevebosman commented Sep 12, 2024 •
edited
Loading

When retention-in-days is set using a variable (in my case a map) I get the warning "CloudWatch Without Retention Period Specified"

Expected Behavior

No warning as retention period is set to a valid value

Actual Behavior

Warning "CloudWatch Without Retention Period Specified"

Steps to Reproduce the Problem

variable "cloudwatch_log_retention_period" {
  description = "Cloudwatch log retention period in days"
  type        = map(string)
  default    = {
    feature    = 1
    dev        = 5
    test       = 5
    stage      = 30
    production = 90
  }
}

locals {
  environment = "dev"
}

resource "aws_cloudwatch_log_group" "negative2" {
  name = "Yada"

  tags = {
    Environment = "production"
    Application = "serviceA"
  }

  retention_in_days = var.cloudwatch_log_retention_period[local.environment]
}

Specifications

N/A
@stevebosman stevebosman added bug Something isn't working community Community contribution labels Sep 12, 2024
@github-actions github-actions bot added terraform Terraform query aws PR related with AWS Cloud labels Sep 12, 2024
@stevebosman
Copy link
Author

stevebosman commented Sep 13, 2024 •
edited
Loading

I don't know if this will help, but from my terraform logs the plan is:

Terraform will perform the following actions:
  # aws_cloudwatch_log_group.negative2 will be created
  + resource "aws_cloudwatch_log_group" "negative2" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + log_group_class   = (known after apply)
      + name              = "Yada"
      + name_prefix       = (known after apply)
      + retention_in_days = 5
      + skip_destroy      = false
      + tags              = {
          + "Application" = "serviceA"
          + "Environment" = "production"
        }
      + tags_all          = {
          + "Application" = "serviceA"
          + "Environment" = "production"
        }
    }
Plan: 1 to add, 0 to change, 0 to destroy.

The generated plan

{
  "format_version": "1.2",
  "terraform_version": "1.9.5",
  "variables": {
    "cloudwatch_log_retention_period": {
      "value": {
        "dev": "5",
        "feature": "1",
        "production": "90",
        "stage": "30",
        "test": "5"
      }
    }
  },
  "planned_values": {
    "root_module": {
      "resources": [
        {
          "address": "aws_cloudwatch_log_group.negative2",
          "mode": "managed",
          "type": "aws_cloudwatch_log_group",
          "name": "negative2",
          "provider_name": "registry.terraform.io/hashicorp/aws",
          "schema_version": 0,
          "values": {
            "kms_key_id": null,
            "name": "Yada",
            "retention_in_days": 5,
            "skip_destroy": false,
            "tags": {
              "Application": "serviceA",
              "Environment": "production"
            },
            "tags_all": {
              "Application": "serviceA",
              "Environment": "production"
            }
          },
          "sensitive_values": {
            "tags": {},
            "tags_all": {}
          }
        }
      ]
    }
  },
  "resource_changes": [
    {
      "address": "aws_cloudwatch_log_group.negative2",
      "mode": "managed",
      "type": "aws_cloudwatch_log_group",
      "name": "negative2",
      "provider_name": "registry.terraform.io/hashicorp/aws",
      "change": {
        "actions": [
          "create"
        ],
        "before": null,
        "after": {
          "kms_key_id": null,
          "name": "Yada",
          "retention_in_days": 5,
          "skip_destroy": false,
          "tags": {
            "Application": "serviceA",
            "Environment": "production"
          },
          "tags_all": {
            "Application": "serviceA",
            "Environment": "production"
          }
        },
        "after_unknown": {
          "arn": true,
          "id": true,
          "log_group_class": true,
          "name_prefix": true,
          "tags": {},
          "tags_all": {}
        },
        "before_sensitive": false,
        "after_sensitive": {
          "tags": {},
          "tags_all": {}
        }
      }
    }
  ],
  "configuration": {
    "provider_config": {
      "aws": {
        "name": "aws",
        "full_name": "registry.terraform.io/hashicorp/aws",
        "version_constraint": "5.66.0",
        "expressions": {
          "region": {
            "constant_value": "eu-west-2"
          }
        }
      }
    },
    "root_module": {
      "resources": [
        {
          "address": "aws_cloudwatch_log_group.negative2",
          "mode": "managed",
          "type": "aws_cloudwatch_log_group",
          "name": "negative2",
          "provider_config_key": "aws",
          "expressions": {
            "name": {
              "constant_value": "Yada"
            },
            "retention_in_days": {
              "references": [
                "var.cloudwatch_log_retention_period",
                "local.environment"
              ]
            },
            "tags": {
              "constant_value": {
                "Application": "serviceA",
                "Environment": "production"
              }
            }
          },
          "schema_version": 0
        }
      ],
      "variables": {
        "cloudwatch_log_retention_period": {
          "default": {
            "dev": "5",
            "feature": "1",
            "production": "90",
            "stage": "30",
            "test": "5"
          },
          "description": "Cloudwatch log retention period in days"
        }
      }
    }
  },
  "timestamp": "2024-09-13T07:47:38Z",
  "applyable": true,
  "complete": true,
  "errored": false
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
aws PR related with AWS Cloud bug Something isn't working community Community contribution terraform Terraform query
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@stevebosman