Answers: <p>In my question I have this code snipet:</p>
  <pre><code>AcmCertificateExpirationCheck:
      Properties:
        ConfigRuleName: acm-certificate-expiration-check
        InputParameters:
          daysToExpiration:
            Fn::If:
            - acmCertificateExpirationCheckParamDaysToExpiration
            - Ref: AcmCertificateExpirationCheckParamDaysToExpiration
            - Ref: AWS::NoValue
        Scope:
          ComplianceResourceTypes:
          - AWS::ACM::Certificate
        Source:
          Owner: AWS
          SourceIdentifier: ACM_CERTIFICATE_EXPIRATION_CHECK
      Type: AWS::Config::ConfigRule
  </code></pre>
  <p>This section:</p>
  <pre><code>InputParameters:
          daysToExpiration:
            Fn::If:
            - acmCertificateExpirationCheckParamDaysToExpiration
            - Ref: AcmCertificateExpirationCheckParamDaysToExpiration
            - Ref: AWS::NoValue
  </code></pre>
  <p>can be written as:</p>
  <pre><code>InputParameters:
          daysToExpiration: ${local.AcmCertificateExpirationCheckParamDaysToExpiration ? var.acm_certificate_expiration_check_param_days_to_expiration : null}
  </code></pre>
  <p>I tested this on AWS and it deployed successfully</p>
  
Answers: CC BY-SA 4.0
Answers: 2023-07-09T08:39:25.677Z
Answers: 2023-07-09T08:39:25.677Z
Answers: George Udosen
Body: <p>I am trying to apply aws conformance pack to my aws account using terraform. I am using the sample aws config rules in cloudformation syntax provided in the awslabs repository.</p>
  <p>Now from an example conformance pack provided on AWS documentation we have this:</p>
  <pre><code>resource &quot;aws_config_conformance_pack&quot; &quot;s3conformancepack&quot; {
    name = &quot;s3conformancepack&quot;
  
    template_body = &lt;&lt;EOT
  
  Resources:
    S3BucketPublicReadProhibited:
      Type: AWS::Config::ConfigRule
      Properties:
        ConfigRuleName: S3BucketPublicReadProhibited
        Description: &gt;- 
          Checks that your Amazon S3 buckets do not allow public read access.
          The rule checks the Block Public Access settings, the bucket policy, and the
          bucket access control list (ACL).
        Scope:
          ComplianceResourceTypes:
          - &quot;AWS::S3::Bucket&quot;
        Source:
          Owner: AWS
          SourceIdentifier: S3_BUCKET_PUBLIC_READ_PROHIBITED
        MaximumExecutionFrequency: Six_Hours
    S3BucketPublicWriteProhibited: 
      Type: &quot;AWS::Config::ConfigRule&quot;
      Properties: 
        ConfigRuleName: S3BucketPublicWriteProhibited
        Description: &quot;Checks that your Amazon S3 buckets do not allow public write access. The rule checks the Block Public Access settings, the bucket policy, and the bucket access control list (ACL).&quot;
        Scope: 
          ComplianceResourceTypes: 
          - &quot;AWS::S3::Bucket&quot;
        Source: 
          Owner: AWS
          SourceIdentifier: S3_BUCKET_PUBLIC_WRITE_PROHIBITED
        MaximumExecutionFrequency: Six_Hours
    S3BucketReplicationEnabled: 
      Type: &quot;AWS::Config::ConfigRule&quot;
      Properties: 
        ConfigRuleName: S3BucketReplicationEnabled
        Description: &quot;Checks whether the Amazon S3 buckets have cross-region replication enabled.&quot;
        Scope: 
          ComplianceResourceTypes: 
          - &quot;AWS::S3::Bucket&quot;
        Source: 
          Owner: AWS
          SourceIdentifier: S3_BUCKET_REPLICATION_ENABLED
    S3BucketSSLRequestsOnly: 
      Type: &quot;AWS::Config::ConfigRule&quot;
      Properties: 
        ConfigRuleName: S3BucketSSLRequestsOnly
        Description: &quot;Checks whether S3 buckets have policies that require requests to use Secure Socket Layer (SSL).&quot;
        Scope: 
          ComplianceResourceTypes: 
          - &quot;AWS::S3::Bucket&quot;
        Source: 
          Owner: AWS
          SourceIdentifier: S3_BUCKET_SSL_REQUESTS_ONLY
    ServerSideEncryptionEnabled: 
      Type: &quot;AWS::Config::ConfigRule&quot;
      Properties: 
        ConfigRuleName: ServerSideEncryptionEnabled
        Description: &quot;Checks that your Amazon S3 bucket either has S3 default encryption enabled or that the S3 bucket policy explicitly denies put-object requests without server side encryption.&quot;
        Scope: 
          ComplianceResourceTypes: 
          - &quot;AWS::S3::Bucket&quot;
        Source: 
          Owner: AWS
          SourceIdentifier: S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED
    S3BucketLoggingEnabled: 
      Type: &quot;AWS::Config::ConfigRule&quot;
      Properties: 
        ConfigRuleName: S3BucketLoggingEnabled
        Description: &quot;Checks whether logging is enabled for your S3 buckets.&quot;
        Scope: 
          ComplianceResourceTypes: 
          - &quot;AWS::S3::Bucket&quot;
        Source: 
          Owner: AWS
          SourceIdentifier: S3_BUCKET_LOGGING_ENABLED
  EOT
  }
  </code></pre>
  <p>Now in my terraform code I will pick one of the config rules in the example provided in the awslabs repo, which is this</p>
  <pre><code>AcmCertificateExpirationCheck:
      Properties:
        ConfigRuleName: acm-certificate-expiration-check
        InputParameters:
          daysToExpiration:
            Fn::If:
            - acmCertificateExpirationCheckParamDaysToExpiration
            - Ref: AcmCertificateExpirationCheckParamDaysToExpiration
            - Ref: AWS::NoValue
        Scope:
          ComplianceResourceTypes:
          - AWS::ACM::Certificate
        Source:
          Owner: AWS
          SourceIdentifier: ACM_CERTIFICATE_EXPIRATION_CHECK
      Type: AWS::Config::ConfigRule
  </code></pre>
  <p>Now I have a section in the above snippet where we have an <strong>if statement</strong> that checks for the <strong>variable acmCertificateExpirationCheckParamDaysToExpiration</strong>, then is passed the value <strong>Ref: AcmCertificateExpirationCheckParamDaysToExpiration</strong> that references a <strong>parameter</strong>:</p>
  <pre><code>AcmCertificateExpirationCheckParamDaysToExpiration:
      Default: '90'
      Type: String
  </code></pre>
  <p>Now in my terraform code this <strong>parameter</strong> would be set like this:</p>
  <pre><code>locals {
   AcmCertificateExpirationCheckParamDaysToExpiration = var.acm_certificate_expiration_check_param_days_to_expiration != &quot;&quot;
  
  }
  
  variable acm_certificate_expiration_check_param_days_to_expiration {
    type = string
    default = &quot;90&quot;
  }
  </code></pre>
  <p>Now I want to use this in the <strong>conformance pack</strong> resource in terraform. So how do I use the if section in a <strong>terraform</strong> way:</p>
  <pre><code>resource &quot;aws_config_conformance_pack&quot; &quot;s3conformancepack&quot; {
    name = &quot;s3conformancepack&quot;
  
    template_body = &lt;&lt;EOT
  
  Resources:
    AcmCertificateExpirationCheck:
      Properties:
        ConfigRuleName: acm-certificate-expiration-check
        InputParameters:
          daysToExpiration:
            Fn::If:
            - acmCertificateExpirationCheckParamDaysToExpiration
            - Ref: AcmCertificateExpirationCheckParamDaysToExpiration  &lt;======[ How to pass the locals variable into this as done on cloudformation or is this ${local.AcmCertificateExpirationCheckParamDaysToExpiration} sufficient ]
            - Ref: AWS::NoValue
        Scope:
          ComplianceResourceTypes:
          - AWS::ACM::Certificate
        Source:
          Owner: AWS
          SourceIdentifier: ACM_CERTIFICATE_EXPIRATION_CHECK
      Type: AWS::Config::ConfigRule
  </code></pre>
  
Tags: <amazon-web-services><terraform><aws-cloudformation>
Title: How to pass terraform locals variables into AWS resource template body
UserDisplayName: George Udosen
ThreadText: # How to pass terraform locals variables into AWS resource template body
  
  (Asked by: username_0 on 2023-07-07)
  
  I am trying to apply aws conformance pack to my aws account using terraform. I am using the sample aws config rules in cloudformation syntax provided in the awslabs repository.
  
  Now from an example conformance pack provided on AWS documentation we have this:
  
  ```
  resource "aws_config_conformance_pack" "s3conformancepack" {
    name = "s3conformancepack"
  
    template_body = <<EOT
  
  Resources:
    S3BucketPublicReadProhibited:
      Type: AWS::Config::ConfigRule
      Properties:
        ConfigRuleName: S3BucketPublicReadProhibited
        Description: >- 
          Checks that your Amazon S3 buckets do not allow public read access.
          The rule checks the Block Public Access settings, the bucket policy, and the
          bucket access control list (ACL).
        Scope:
          ComplianceResourceTypes:
          - "AWS::S3::Bucket"
        Source:
          Owner: AWS
          SourceIdentifier: S3_BUCKET_PUBLIC_READ_PROHIBITED
        MaximumExecutionFrequency: Six_Hours
    S3BucketPublicWriteProhibited: 
      Type: "AWS::Config::ConfigRule"
      Properties: 
        ConfigRuleName: S3BucketPublicWriteProhibited
        Description: "Checks that your Amazon S3 buckets do not allow public write access. The rule checks the Block Public Access settings, the bucket policy, and the bucket access control list (ACL)."
        Scope: 
          ComplianceResourceTypes: 
          - "AWS::S3::Bucket"
        Source: 
          Owner: AWS
          SourceIdentifier: S3_BUCKET_PUBLIC_WRITE_PROHIBITED
        MaximumExecutionFrequency: Six_Hours
    S3BucketReplicationEnabled: 
      Type: "AWS::Config::ConfigRule"
      Properties: 
        ConfigRuleName: S3BucketReplicationEnabled
        Description: "Checks whether the Amazon S3 buckets have cross-region replication enabled."
        Scope: 
          ComplianceResourceTypes: 
          - "AWS::S3::Bucket"
        Source: 
          Owner: AWS
          SourceIdentifier: S3_BUCKET_REPLICATION_ENABLED
    S3BucketSSLRequestsOnly: 
      Type: "AWS::Config::ConfigRule"
      Properties: 
        ConfigRuleName: S3BucketSSLRequestsOnly
        Description: "Checks whether S3 buckets have policies that require requests to use Secure Socket Layer (SSL)."
        Scope: 
          ComplianceResourceTypes: 
          - "AWS::S3::Bucket"
        Source: 
          Owner: AWS
          SourceIdentifier: S3_BUCKET_SSL_REQUESTS_ONLY
    ServerSideEncryptionEnabled: 
      Type: "AWS::Config::ConfigRule"
      Properties: 
        ConfigRuleName: ServerSideEncryptionEnabled
        Description: "Checks that your Amazon S3 bucket either has S3 default encryption enabled or that the S3 bucket policy explicitly denies put-object requests without server side encryption."
        Scope: 
          ComplianceResourceTypes: 
          - "AWS::S3::Bucket"
        Source: 
          Owner: AWS
          SourceIdentifier: S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED
    S3BucketLoggingEnabled: 
      Type: "AWS::Config::ConfigRule"
      Properties: 
        ConfigRuleName: S3BucketLoggingEnabled
        Description: "Checks whether logging is enabled for your S3 buckets."
        Scope: 
          ComplianceResourceTypes: 
          - "AWS::S3::Bucket"
        Source: 
          Owner: AWS
          SourceIdentifier: S3_BUCKET_LOGGING_ENABLED
  EOT
  }
  
  ```
  
  Now in my terraform code I will pick one of the config rules in the example provided in the awslabs repo, which is this
  
  ```
  AcmCertificateExpirationCheck:
      Properties:
        ConfigRuleName: acm-certificate-expiration-check
        InputParameters:
          daysToExpiration:
            Fn::If:
            - acmCertificateExpirationCheckParamDaysToExpiration
            - Ref: AcmCertificateExpirationCheckParamDaysToExpiration
            - Ref: AWS::NoValue
        Scope:
          ComplianceResourceTypes:
          - AWS::ACM::Certificate
        Source:
          Owner: AWS
          SourceIdentifier: ACM_CERTIFICATE_EXPIRATION_CHECK
      Type: AWS::Config::ConfigRule
  
  ```
  
  Now I have a section in the above snippet where we have an **if statement** that checks for the **variable acmCertificateExpirationCheckParamDaysToExpiration**, then is passed the value **Ref: AcmCertificateExpirationCheckParamDaysToExpiration** that references a **parameter**:
  
  ```
  AcmCertificateExpirationCheckParamDaysToExpiration:
      Default: '90'
      Type: String
  
  ```
  
  Now in my terraform code this **parameter** would be set like this:
  
  ```
  locals {
   AcmCertificateExpirationCheckParamDaysToExpiration = var.acm_certificate_expiration_check_param_days_to_expiration != ""
  
  }
  
  variable acm_certificate_expiration_check_param_days_to_expiration {
    type = string
    default = "90"
  }
  
  ```
  
  Now I want to use this in the **conformance pack** resource in terraform. So how do I use the if section in a **terraform** way:
  
  ```
  resource "aws_config_conformance_pack" "s3conformancepack" {
    name = "s3conformancepack"
  
    template_body = <<EOT
  
  Resources:
    AcmCertificateExpirationCheck:
      Properties:
        ConfigRuleName: acm-certificate-expiration-check
        InputParameters:
          daysToExpiration:
            Fn::If:
            - acmCertificateExpirationCheckParamDaysToExpiration
            - Ref: AcmCertificateExpirationCheckParamDaysToExpiration  <======[ How to pass the locals variable into this as done on cloudformation or is this ${local.AcmCertificateExpirationCheckParamDaysToExpiration} sufficient ]
            - Ref: AWS::NoValue
        Scope:
          ComplianceResourceTypes:
          - AWS::ACM::Certificate
        Source:
          Owner: AWS
          SourceIdentifier: ACM_CERTIFICATE_EXPIRATION_CHECK
      Type: AWS::Config::ConfigRule
  
  ```
  
  **Tags:** amazon-web-services, terraform, aws-cloudformation
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2023-07-09. Score: 0
  
  In my question I have this code snipet:
  
  ```
  AcmCertificateExpirationCheck:
      Properties:
        ConfigRuleName: acm-certificate-expiration-check
        InputParameters:
          daysToExpiration:
            Fn::If:
            - acmCertificateExpirationCheckParamDaysToExpiration
            - Ref: AcmCertificateExpirationCheckParamDaysToExpiration
            - Ref: AWS::NoValue
        Scope:
          ComplianceResourceTypes:
          - AWS::ACM::Certificate
        Source:
          Owner: AWS
          SourceIdentifier: ACM_CERTIFICATE_EXPIRATION_CHECK
      Type: AWS::Config::ConfigRule
  
  ```
  
  This section:
  
  ```
  InputParameters:
          daysToExpiration:
            Fn::If:
            - acmCertificateExpirationCheckParamDaysToExpiration
            - Ref: AcmCertificateExpirationCheckParamDaysToExpiration
            - Ref: AWS::NoValue
  
  ```
  
  can be written as:
  
  ```
  InputParameters:
          daysToExpiration: ${local.AcmCertificateExpirationCheckParamDaysToExpiration ? var.acm_certificate_expiration_check_param_days_to_expiration : null}
  
  ```
  
  I tested this on AWS and it deployed successfully
  
  
  ---
  
  