33

I would like to use the same terraform template for several dev and production environments.

My approach: As I understand it, the resource name needs to be unique, and terraform stores the state of the resource internally. I therefore tried to use variables for the resource names - but it seems to be not supported. I get an error message:

$ terraform plan
var.env1
  Enter a value: abc

Error asking for user input: Error parsing address 'aws_sqs_queue.SqsIntegrationOrderIn${var.env1}': invalid resource address "aws_sqs_queue.SqsIntegrationOrderIn${var.env1}"

My terraform template:

variable "env1" {}

provider "aws" {
        region = "ap-southeast-2"
}

resource "aws_sqs_queue" "SqsIntegrationOrderIn${var.env1}" {
        name = "Integration_Order_In__${var.env1}"
        message_retention_seconds = 86400
        receive_wait_time_seconds = 5
}

I think, either my approach is wrong, or the syntax. Any ideas?

2
  • 4
    manage with terraform modules, you needn't dynamicly redefine the resource name.
    – BMW
    Commented Sep 21, 2017 at 23:19
  • You should mark Farid's answer as correct. The similar question linked to in that answer is spot on.
    – Davos
    Commented Nov 5, 2018 at 15:46

2 Answers 2

13

You can't interpolate inside the resource name. Instead what you should do is as @BMW have mentioned in the comments, you should make a terraform module that contains that SqsIntegrationOrderIn inside and takes env variable. Then you can use the module twice, and they simply won't clash. You can also have a look at a similar question I answered.

5
  • 1
    Going further, the OP should use different AWS Accounts for different environments then name clashes are not a thing.
    – Davos
    Commented Nov 5, 2018 at 15:48
  • Using separate accounts is the way to go. Agreed and easy to implement using AWS organizations. Commented May 20, 2019 at 19:09
  • @Davos can you point at a good example of this (cross) account deployment setup? I am using the .aws/config and ./aws/credentials entries of another account, and specifying AWS_PROFILE=dev_admin for example, but resource owners are still showing as the main org's Management Account #. I've had no luck with the provider "profile" either...
    – d8aninja
    Commented Oct 7, 2021 at 18:42
  • 1
    @d8aninja Sounds like a new question and not enough info to give you a decent answer. You can set up roles in different accounts and assume them, or cross-account roles or different users in different accounts. This learn.hashicorp.com/tutorials/terraform/organize-configuration describes the different setups. Check out aws_caller_identity, and also the assume_role attribute of the aws provider, and registry.terraform.io/providers/hashicorp/aws/latest/…
    – Davos
    Commented Oct 8, 2021 at 8:49
  • @Davos can you post your suggestions here? stackoverflow.com/questions/69508090/…
    – d8aninja
    Commented Oct 9, 2021 at 15:23
8

I recommend using a different workspace for each environment. This allows you to specify your configuration like this:

variable "env1" {}

provider "aws" {
        region = "ap-southeast-2"
}

resource "aws_sqs_queue" "SqsIntegrationOrderIn" {
        name = "Integration_Order_In__${var.env1}"
        message_retention_seconds = 86400
        receive_wait_time_seconds = 5
}

Make sure to make the name of the "aws_sqs_queue" resource depending on the environment (e.g. by including it in the name) to avoid name conflicts in AWS.

1
  • 5
    The docs specifically say that workspaces are "not a suitable tool for system decomposition" and , regarding "different development stages (e.g. staging vs. production)" it is "not a suitable isolation mechanism" see terraform.io/docs/state/… Instead, you should use modules and import them into different terraform init directories for dev, staging, prod etc and do special enviroment things in those interfaces. Best practice is also using different AWS accounts, so name conflicts aren't an issue.
    – Davos
    Commented Nov 5, 2018 at 15:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.