belt 0.6.1 → 0.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 66c35b71a47f74ba7805bce24b37eb02fa6ded7246872df30a951a35be22d21f
-  data.tar.gz: 5ddc3bb756fdf782da5074abb72bd0c7275c6a90f4ba98c81963b92cb9cd6bb9
+  metadata.gz: 05d5db875d229ad413bf8af05004a92961776b347db0884ded768f35fcfe245e
+  data.tar.gz: d6f1590f52f2a04b9457b82cf0c0cad094b96b8e04e112672df37d1e5ccf173b
 SHA512:
-  metadata.gz: 44320ad96e29e29a6bb9b88d2de94822f982dad01e92bc639204c38d2bb7a306463b7b570ac8c35cbf13cc00a223a55442b52171ac64f3357de98a9662a5e3e9
-  data.tar.gz: 8e176982bec58892623685d2b3bfd02cde1ab22d9fcac2c6eb1bfe58f5ae27f02d28b708cced560b803379b36bcd2bea5463fce749bde4ebd9b169cbfff878ba
+  metadata.gz: 5b9c29157f8d7b698c8f68c807564299f881b220473ef4a51194352092f5a8967dfce0495fb12bc24a813b4ab2e077358c3800151ccf8737059888560a62ad97
+  data.tar.gz: 6629a4a02a92e571d1e835ba0f12894f8bad945eb89bf79a2bc4696538378f45dfd7b5f5e3fc4090d9e61120c51d032b2fab5d5e2bdc17cfdfe81d25950061db

data/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.6.2
+
+### Fixed
+
+- **First deploy of a new env with a `domain` no longer fails at plan.** The generated
+  module keyed `aws_route53_record.cert_validation` by the ACM validation CNAME name,
+  which is unknown until the cert exists, so `belt plan`/`belt deploy` on a brand-new
+  standalone env failed with `Invalid for_each argument` and needed a `-target` apply
+  of the cert first. The record is now `aws_route53_record.acm_validation`, keyed by
+  the env's domain (known at plan). A `removed` block forgets old `cert_validation`
+  instances without deleting the live CNAME. The module now needs Terraform >= 1.7.
+  Existing apps: see [UPGRADING.md](UPGRADING.md#acm-validation-record-062).
+
 ## 0.6.1
 
 ### Fixed

data/lib/belt/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Belt
-  VERSION = '0.6.1'
+  VERSION = '0.6.2'
 
   # Ruby version new apps run on in Lambda. Rendered into the conveyor-belt
   # provider block (`ruby_version`) by `belt new` / `belt generate environment`.

data/lib/templates/module/dns.tf.erb

@@ -62,33 +62,45 @@ resource "aws_acm_certificate" "app" {
   }
 }
 
-# DNS validation record for the certificate
-# Key by resource_record_name (not domain_name) because ACM uses the same
-# validation CNAME for both base domain and wildcard — keying by domain_name
-# creates duplicate records that Route 53 rejects.
-# Use ellipsis (...) to group duplicates, then take the first element since
-# they're identical anyway.
-resource "aws_route53_record" "cert_validation" {
-  for_each = local.dns_enabled && !local.is_nested ? {
-    for dvo in aws_acm_certificate.app[0].domain_validation_options : dvo.resource_record_name => {
-      name   = dvo.resource_record_name
-      type   = dvo.resource_record_type
-      record = dvo.resource_record_value
-    }...
-  } : {}
+# DNS validation record for the certificate.
+# ACM issues one identical validation CNAME for both the base domain and the
+# wildcard, so one record covers the cert. Key it by app_domain (known at plan)
+# rather than by anything from domain_validation_options: those values are
+# unknown until the cert exists, and for_each over them fails the first plan
+# of a new env with "Invalid for_each argument".
+resource "aws_route53_record" "acm_validation" {
+  for_each = local.dns_enabled && !local.is_nested ? toset([local.app_domain]) : toset([])
 
   zone_id         = aws_route53_zone.app[0].zone_id
-  name            = each.value[0].name
-  type            = each.value[0].type
+  name            = local.acm_validation_options[each.key].resource_record_name
+  type            = local.acm_validation_options[each.key].resource_record_type
   ttl             = 300
-  records         = [each.value[0].record]
+  records         = [local.acm_validation_options[each.key].resource_record_value]
   allow_overwrite = true
 }
 
+locals {
+  acm_validation_options = local.dns_enabled && !local.is_nested ? {
+    for dvo in aws_acm_certificate.app[0].domain_validation_options : dvo.domain_name => dvo
+  } : {}
+}
+
+# Older Belt modules created this record as cert_validation, keyed by the
+# validation CNAME name. Forget those instances without deleting them:
+# acm_validation upserts the same CNAME (allow_overwrite), and a delete would
+# pull the record ACM needs for renewal. No-op for envs that never had it.
+removed {
+  from = aws_route53_record.cert_validation
+
+  lifecycle {
+    destroy = false
+  }
+}
+
 resource "aws_acm_certificate_validation" "app" {
   count                   = local.dns_enabled && !local.is_nested ? 1 : 0
   certificate_arn         = aws_acm_certificate.app[0].arn
-  validation_record_fqdns = [for record in aws_route53_record.cert_validation : record.fqdn]
+  validation_record_fqdns = [for record in aws_route53_record.acm_validation : record.fqdn]
 }
 
 # =============================================================================

data/lib/templates/module/main.tf.erb

@@ -2,6 +2,9 @@
 # Environments call this module with different variables.
 
 terraform {
+  # >= 1.7 for the removed block in dns.tf
+  required_version = ">= 1.7"
+
   required_providers {
     aws = {
       source  = "hashicorp/aws"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: belt
 version: !ruby/object:Gem::Version
-  version: 0.6.1
+  version: 0.6.2
 platform: ruby
 authors:
 - Stowzilla