WIP experiment but failed due to: hashicorp/terraform-provider-aws#4553

modules/vault-cluster/main.tf

@@ -13,22 +13,21 @@ terraform {
 resource "aws_autoscaling_group" "autoscaling_group" {
   name_prefix = "${var.cluster_name}"
 
-  launch_configuration = "${var.use_launch_template ? 0 : aws_launch_configuration.launch_configuration.*.name[0]}"
-  launch_template      = "${var.use_launch_template ? aws_launch_template.launch_template.*.name[0] : 0}"
+  # launch_configuration = "${aws_launch_configuration.launch_configuration.name}"
 
+  launch_template {
+    id = "${aws_launch_template.launch_template.id}"
+  }
   availability_zones  = ["${var.availability_zones}"]
   vpc_zone_identifier = ["${var.subnet_ids}"]
-
   # Use a fixed-size cluster
-  min_size             = "${var.cluster_size}"
-  max_size             = "${var.cluster_size}"
-  desired_capacity     = "${var.cluster_size}"
-  termination_policies = ["${var.termination_policies}"]
-
+  min_size                  = "${var.cluster_size}"
+  max_size                  = "${var.cluster_size}"
+  desired_capacity          = "${var.cluster_size}"
+  termination_policies      = ["${var.termination_policies}"]
   health_check_type         = "${var.health_check_type}"
   health_check_grace_period = "${var.health_check_grace_period}"
   wait_for_capacity_timeout = "${var.wait_for_capacity_timeout}"
-
   tags = ["${concat(
     list(
       map("key", var.cluster_tag_key, "value", var.cluster_name, "propagate_at_launch", true)
@@ -38,11 +37,10 @@ resource "aws_autoscaling_group" "autoscaling_group" {
 }
 
 # ---------------------------------------------------------------------------------------------------------------------
-# CREATE LAUNCH CONFIGURATION TO DEFINE WHAT RUNS ON EACH INSTANCE IN THE ASG
+# CREATE LAUNCH TEMPLATE TO DEFINE WHAT RUNS ON EACH INSTANCE IN THE ASG
 # ---------------------------------------------------------------------------------------------------------------------
 
 resource "aws_launch_configuration" "launch_configuration" {
-  count         = "${var.use_launch_template ? 0 : 1}"
   name_prefix   = "${var.cluster_name}-"
   image_id      = "${var.ami_id}"
   instance_type = "${var.instance_type}"
@@ -82,11 +80,10 @@ data "aws_ami" "ami" {
 }
 
 resource "aws_launch_template" "launch_template" {
-  count         = "${var.use_launch_template ? 1 : 0}"
   name_prefix   = "${var.cluster_name}-"
   image_id      = "${var.ami_id}"
   instance_type = "${var.instance_type}"
-  user_data     = "${var.user_data}"
+  user_data     = "${base64encode(var.user_data)}"
 
   iam_instance_profile {
     name = "${aws_iam_instance_profile.instance_profile.name}"
@@ -99,29 +96,32 @@ resource "aws_launch_template" "launch_template" {
     tenancy = "${var.tenancy}"
   }
 
-  network_interfaces {
-    associate_public_ip_address = "${var.associate_public_ip_address}"
-  }
+  # network_interfaces {
+  #   associate_public_ip_address = "${var.associate_public_ip_address}"
+  #   security_groups             = ["${concat(list(aws_security_group.lc_security_group.id), var.additional_security_group_ids)}"]
+  # }
 
   ebs_optimized = "${var.root_volume_ebs_optimized}"
-
-  block_device {
-    device_name           = "${data.aws_ami.ami.root_device_name}"
-    volume_type           = "${var.root_volume_type}"
-    volume_size           = "${var.root_volume_size}"
-    delete_on_termination = "${var.root_volume_delete_on_termination}"
+  block_device_mappings {
+    device_name = "${data.aws_ami.ami.root_device_name}"
+
+    ebs {
+      encrypted             = "${var.ebs_encryption}"
+      volume_type           = "${var.root_volume_type}"
+      volume_size           = "${var.root_volume_size}"
+      delete_on_termination = "${var.root_volume_delete_on_termination}"
+    }
   }
-
+  tags = "${var.launch_template_tags}"
   tag_specifications {
-    # Instanc tags are already handled by the autoscaling group
+    # Instance tags are already handled by the autoscaling group
     resource_type = "volume"
 
     tags = "${merge(
       map("key", var.cluster_tag_key, "value", var.cluster_name),
       var.volume_extra_tags)
     }"
   }
-
   # Important note: whenever using a launch configuration with an auto scaling group, you must set
   # create_before_destroy = true. However, as soon as you set create_before_destroy = true in one resource, you must
   # also set it in every resource that it depends on, or you'll get an error about cyclic dependencies (especially when

modules/vault-cluster/outputs.tf

@@ -14,12 +14,8 @@ output "cluster_size" {
   value = "${aws_autoscaling_group.autoscaling_group.desired_capacity}"
 }
 
-output "launch_config_name" {
-  value = "${var.use_launch_template ? "" : aws_launch_configuration.launch_configuration.*.name[0]}"
-}
-
 output "launch_template_name" {
-  value = "${var.use_launch_template ? aws_launch_template.launch_template.*.name[0] : ""}"
+  value = "${aws_launch_template.launch_template.name}"
 }
 
 output "iam_role_arn" {

modules/vault-cluster/variables.tf

@@ -5,49 +5,40 @@
 
 variable "cluster_name" {
   description = "The name of the Vault cluster (e.g. vault-stage). This variable is used to namespace all resources created by this module."
-  default = "fred"
 }
 
 variable "ami_id" {
   description = "The ID of the AMI to run in this cluster. Should be an AMI that had Vault installed and configured by the install-vault module."
-  default = "123"
 }
 
 variable "instance_type" {
   description = "The type of EC2 Instances to run for each node in the cluster (e.g. t2.micro)."
-  default = "t2.micro"
 }
 
 variable "vpc_id" {
   description = "The ID of the VPC in which to deploy the cluster"
-  default = "123"
 }
 
 variable "allowed_inbound_cidr_blocks" {
   description = "A list of CIDR-formatted IP address ranges from which the EC2 Instances will allow connections to Vault"
   type        = "list"
-  default = []
 }
 
 variable "allowed_inbound_security_group_ids" {
   description = "A list of security group IDs that will be allowed to connect to Vault"
   type        = "list"
-  default = []
 }
 
 variable "allowed_inbound_security_group_count" {
   description = "The number of entries in var.allowed_inbound_security_group_ids. Ideally, this value could be computed dynamically, but we pass this variable to a Terraform resource's 'count' property and Terraform requires that 'count' be computed with literals or data sources only."
-  default = 0
 }
 
 variable "user_data" {
   description = "A User Data script to execute while the server is booting. We recommend passing in a bash script that executes the run-vault script, which should have been installed in the AMI by the install-vault module."
-  default = "#!/bin/bash"
 }
 
 variable "cluster_size" {
   description = "The number of nodes to have in the cluster. We strongly recommend setting this to 3 or 5."
-  default = 1
 }
 
 # ---------------------------------------------------------------------------------------------------------------------
@@ -207,9 +198,10 @@ variable "force_destroy_s3_bucket" {
   default     = false
 }
 
-variable "use_launch_template" {
-  description = "Use aws_launch_template resource instead of aws_launch_configuration. Enables volume_extra_tags."
-  default     = false
+variable "launch_template_tags" {
+  description = "A list of tags to add to the launch template."
+  type        = "map"
+  default     = {}
 }
 
 variable "volume_extra_tags" {
@@ -218,3 +210,7 @@ variable "volume_extra_tags" {
   default     = {}
 }
 
+variable "ebs_encryption" {
+  description = "Value of 'encrypted' attribute on the launch template's block device definition."
+  default     = false
+}