Answers: <p>Your locales or data objects probably evaluate to nothing. So when you run your for_each statement, it is like running a loop on an empty list, nothing happens. I would check the local.cloudwatch_logs_components to see if there is data in it.</p>
  
Answers: CC BY-SA 4.0
Answers: 2023-12-13T18:58:08.220Z
Answers: 2023-12-13T18:58:08.220Z
Answers: hasenek
Body: <p>I have deployed a Cloudwatch Log Group community module to my terraform stack (sourced from <a href="https://github.com/cloudposse/terraform-aws-components" rel="nofollow noreferrer">https://github.com/cloudposse/terraform-aws-components</a>) but I have spent more than a day trying to resolve this, unsuccessfully.</p>
  <p>When I run terraform plan, the new component is not showing as a new piece of infrastructure.</p>
  <pre><code>$ terraform plan 
  </code></pre>
  <pre><code>No changes. Your infrastructure matches the configuration.
  
  Terraform has compared your real infrastructure against your configuration and found no differences, so no changes are needed.
  </code></pre>
  <p>Could anyone please just scan my configuration to see if there are things that could be missing or misconfigured that would cause terraform from ignoring the new component. Getting terraform to run without error has been a struggle which I have just resolved but this in a new level that doesn't make sense. My configuration is set as follows:</p>
  <p><strong>test-stage-eu-west-1.yaml</strong></p>
  <pre><code>    ec2_session_manager_log:
        component: cloudwatch_logs
        vars:
          context:
            enabled: true
            name: &quot;ssm-logs&quot;
          enabled: true
          name: &quot;ec2-ssm-log-name&quot;
          retention_in_days: 7
          kms_key_arn: &quot;arn:aws:kms:eu-west-1:12345667890:key/xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx&quot;
          principals: &quot;ec2.amazonaws.com&quot;
          additional_permissions: []
          stream_names: [ &quot;app1&quot;, &quot;app2&quot; ]
          region: eu-west-1
  
      cloudwatch_logs:
        vars:
          context:
            enabled: false
  </code></pre>
  <p><strong>cloudwatch-logs module: ./module/cloudwatch-logs/main.tf</strong></p>
  <pre><code>locals {
    enabled = module.this.enabled
  }
  
  data &quot;aws_caller_identity&quot; &quot;current&quot; {
    count = local.enabled ? 1 : 0
  }
  
  data &quot;aws_partition&quot; &quot;current&quot; {
    count = local.enabled ? 1 : 0
  }
  
  module &quot;logs&quot; {
    source  = &quot;cloudposse/cloudwatch-logs/aws&quot;
    version = &quot;0.6.5&quot;
  
    name                   = var.name
    stream_names           = var.stream_names
    retention_in_days      = var.retention_in_days
    principals             = var.principals
    additional_permissions = var.additional_permissions
    kms_key_arn            = var.kms_key_arn
  }
  
  module &quot;kms_key_logs&quot; {
    source  = &quot;cloudposse/kms-key/aws&quot;
    version = &quot;0.12.1&quot;
  
    description             = &quot;KMS key for CloudWatch Logs&quot;
    deletion_window_in_days = 10
    enable_key_rotation     = true
    alias                   = &quot;alias/${module.this.id}&quot;
    policy                  = join(&quot;&quot;, data.aws_iam_policy_document.kms.*.json)
  
  }
  
  data &quot;aws_iam_policy_document&quot; &quot;kms&quot; {
    count = local.enabled ? 1 : 0
  
    statement {
      sid    = &quot;EnableRootUserPermissions&quot;
      effect = &quot;Allow&quot;
  
      actions = [
        &quot;kms:Create*&quot;,
        &quot;kms:Describe*&quot;,
        &quot;kms:Enable*&quot;,
        &quot;kms:List*&quot;,
        &quot;kms:Put*&quot;,
        &quot;kms:Update*&quot;,
        &quot;kms:Revoke*&quot;,
        &quot;kms:Disable*&quot;,
        &quot;kms:Get*&quot;,
        &quot;kms:Delete*&quot;,
        &quot;kms:Tag*&quot;,
        &quot;kms:Untag*&quot;,
        &quot;kms:ScheduleKeyDeletion&quot;,
        &quot;kms:CancelKeyDeletion&quot;
      ]
  
      resources = [
        &quot;*&quot;
      ]
  
      principals {
        type = &quot;AWS&quot;
  
        identifiers = [
          &quot;arn:${join(&quot;&quot;, data.aws_partition.current[*].partition)}:iam::${join(&quot;&quot;, data.aws_caller_identity.current[*].account_id)}:root&quot;
        ]
      }
    }
  
    statement {
      sid    = &quot;Allow CloudWatch to Encrypt with the key&quot;
      effect = &quot;Allow&quot;
  
      actions = [
        &quot;kms:Encrypt*&quot;,
        &quot;kms:Decrypt*&quot;,
        &quot;kms:ReEncrypt*&quot;,
        &quot;kms:GenerateDataKey*&quot;,
        &quot;kms:Describe*&quot;
      ]
  
      resources = [
        &quot;*&quot;
      ]
  
      principals {
        type = &quot;Service&quot;
  
        identifiers = [
          &quot;logs.${var.region}.amazonaws.com&quot;,
        ]
      }
    }
  }
  </code></pre>
  <p><strong>Root: ./main.tf:</strong></p>
  <pre><code>module &quot;cloudwatch-logs&quot; {
    source  = &quot;./modules/cloudwatch-logs&quot;
    for_each = local.cloudwatch_logs_components
  
    name                   = try(each.value.vars.name, null)
    stream_names           = try(each.value.vars.stream_names, null)
    retention_in_days      = try(each.value.vars.retention_in_days, null)
    aws_service_principal  = try(each.value.vars.principal, null)
    additional_permissions = try(each.value.vars.additional_permissions, null)
    region                 = try(each.value.vars.region, null)
    kms_key_arn            = try (each.value.vars.region, null)
    context                = try(each.value.vars.context, null)
  
  }
  </code></pre>
  
Comments: CC BY-SA 4.0
Comments: 2023-04-21T05:09:10.840Z
Comments: It sounds like there are some optional components, the one which you are expecting is one of them, which are not being enabled. I would check the module to see what variables it expects to be toggled in order to enable them.
Comments: Bruce Becker
Tags: <amazon-web-services><terraform><yaml><aws-cli><terraform-module>
Title: Terraform - No Infrastructure Changes Detected
UserDisplayName: Don Draper
ThreadText: # Terraform - No Infrastructure Changes Detected
  
  (Asked by: username_0 on 2023-04-20)
  
  I have deployed a Cloudwatch Log Group community module to my terraform stack (sourced from <https://github.com/cloudposse/terraform-aws-components>) but I have spent more than a day trying to resolve this, unsuccessfully.
  
  When I run terraform plan, the new component is not showing as a new piece of infrastructure.
  
  ```
  $ terraform plan 
  
  ```
  
  ```
  No changes. Your infrastructure matches the configuration.
  
  Terraform has compared your real infrastructure against your configuration and found no differences, so no changes are needed.
  
  ```
  
  Could anyone please just scan my configuration to see if there are things that could be missing or misconfigured that would cause terraform from ignoring the new component. Getting terraform to run without error has been a struggle which I have just resolved but this in a new level that doesn't make sense. My configuration is set as follows:
  
  **test-stage-eu-west-1.yaml**
  
  ```
      ec2_session_manager_log:
        component: cloudwatch_logs
        vars:
          context:
            enabled: true
            name: "ssm-logs"
          enabled: true
          name: "ec2-ssm-log-name"
          retention_in_days: 7
          kms_key_arn: "arn:aws:kms:eu-west-1:12345667890:key/xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx"
          principals: "ec2.amazonaws.com"
          additional_permissions: []
          stream_names: [ "app1", "app2" ]
          region: eu-west-1
  
      cloudwatch_logs:
        vars:
          context:
            enabled: false
  
  ```
  
  **cloudwatch-logs module: ./module/cloudwatch-logs/main.tf**
  
  ```
  locals {
    enabled = module.this.enabled
  }
  
  data "aws_caller_identity" "current" {
    count = local.enabled ? 1 : 0
  }
  
  data "aws_partition" "current" {
    count = local.enabled ? 1 : 0
  }
  
  module "logs" {
    source  = "cloudposse/cloudwatch-logs/aws"
    version = "0.6.5"
  
    name                   = var.name
    stream_names           = var.stream_names
    retention_in_days      = var.retention_in_days
    principals             = var.principals
    additional_permissions = var.additional_permissions
    kms_key_arn            = var.kms_key_arn
  }
  
  module "kms_key_logs" {
    source  = "cloudposse/kms-key/aws"
    version = "0.12.1"
  
    description             = "KMS key for CloudWatch Logs"
    deletion_window_in_days = 10
    enable_key_rotation     = true
    alias                   = "alias/${module.this.id}"
    policy                  = join("", data.aws_iam_policy_document.kms.*.json)
  
  }
  
  data "aws_iam_policy_document" "kms" {
    count = local.enabled ? 1 : 0
  
    statement {
      sid    = "EnableRootUserPermissions"
      effect = "Allow"
  
      actions = [
        "kms:Create*",
        "kms:Describe*",
        "kms:Enable*",
        "kms:List*",
        "kms:Put*",
        "kms:Update*",
        "kms:Revoke*",
        "kms:Disable*",
        "kms:Get*",
        "kms:Delete*",
        "kms:Tag*",
        "kms:Untag*",
        "kms:ScheduleKeyDeletion",
        "kms:CancelKeyDeletion"
      ]
  
      resources = [
        "*"
      ]
  
      principals {
        type = "AWS"
  
        identifiers = [
          "arn:${join("", data.aws_partition.current[*].partition)}:iam::${join("", data.aws_caller_identity.current[*].account_id)}:root"
        ]
      }
    }
  
    statement {
      sid    = "Allow CloudWatch to Encrypt with the key"
      effect = "Allow"
  
      actions = [
        "kms:Encrypt*",
        "kms:Decrypt*",
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*",
        "kms:Describe*"
      ]
  
      resources = [
        "*"
      ]
  
      principals {
        type = "Service"
  
        identifiers = [
          "logs.${var.region}.amazonaws.com",
        ]
      }
    }
  }
  
  ```
  
  **Root: ./main.tf:**
  
  ```
  module "cloudwatch-logs" {
    source  = "./modules/cloudwatch-logs"
    for_each = local.cloudwatch_logs_components
  
    name                   = try(each.value.vars.name, null)
    stream_names           = try(each.value.vars.stream_names, null)
    retention_in_days      = try(each.value.vars.retention_in_days, null)
    aws_service_principal  = try(each.value.vars.principal, null)
    additional_permissions = try(each.value.vars.additional_permissions, null)
    region                 = try(each.value.vars.region, null)
    kms_key_arn            = try (each.value.vars.region, null)
    context                = try(each.value.vars.context, null)
  
  }
  
  ```
  
  **Tags:** amazon-web-services, terraform, yaml, aws-cli, terraform-module
  
  > **Comments:**
  > **username_1**: It sounds like there are some optional components, the one which you are expecting is one of them, which are not being enabled. I would check the module to see what variables it expects to be toggled in order to enable them.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2023-12-13. Score: 0
  
  Your locales or data objects probably evaluate to nothing. So when you run your for\_each statement, it is like running a loop on an empty list, nothing happens. I would check the local.cloudwatch\_logs\_components to see if there is data in it.
  
  
  ---
  
  