Variables are literally variables, they do not allow the creation of multiple environments.
Whole config should be wrapped in a module, and a directory-per-environment created that calls on that module.
~/P/e/t/terraform (master|✚3…1) $ cat environments/production.tfvars
region = "eu-west-2"
az_count = 2
~/P/e/t/terraform (master|✚3…1) $ diff environments/{staging,production}.tfvars
2c2
< az_count = 3
---
> az_count = 2
~/P/e/t/terraform (master|✚3…1) $ terraform plan -var-file=environments/production.tfvars
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.
data.aws_availability_zones.available: Refreshing state...
aws_vpc.main: Refreshing state... [id=vpc-0d91d222fa72a8fa8]
aws_db_parameter_group.main: Refreshing state... [id=rds-v3]
aws_eip.private_gateways[1]: Refreshing state... [id=eipalloc-0e7cb498daf460f0b]
aws_eip.private_gateways[0]: Refreshing state... [id=eipalloc-06a70f6be28944594]
aws_eip.private_gateways[2]: Refreshing state... [id=eipalloc-07b7f8ab007308da4]
aws_internet_gateway.main: Refreshing state... [id=igw-06bf51e4ada622a35]
aws_security_group.rds: Refreshing state... [id=sg-04dd409818f91e8b1]
aws_subnet.webservers[2]: Refreshing state... [id=subnet-06a8467ea081d660f]
aws_subnet.privates[0]: Refreshing state... [id=subnet-0dbda1bac4cf7dd1f]
aws_subnet.privates[1]: Refreshing state... [id=subnet-08db7526626d6e8c9]
aws_subnet.privates[2]: Refreshing state... [id=subnet-0c4aa221e97364b6c]
aws_subnet.webservers[1]: Refreshing state... [id=subnet-083ae02cbe187a447]
aws_subnet.webservers[0]: Refreshing state... [id=subnet-0c7a7b8097c4d9cb5]
aws_route_table.webserver: Refreshing state... [id=rtb-0beeaa901f5f131cc]
aws_security_group_rule.main_rds_ingress_mysql: Refreshing state... [id=sgrule-3417809429]
aws_security_group_rule.main_rds_egress_public: Refreshing state... [id=sgrule-1657045022]
aws_db_subnet_group.main: Refreshing state... [id=v3-rds]
aws_nat_gateway.privates[0]: Refreshing state... [id=nat-009f73da3e24e9638]
aws_nat_gateway.privates[1]: Refreshing state... [id=nat-0b040f70d7da905b6]
aws_nat_gateway.privates[2]: Refreshing state... [id=nat-086a08621c32522de]
aws_route_table_association.webservers[1]: Refreshing state... [id=rtbassoc-0688a55aa3f4b9b3d]
aws_route_table_association.webservers[0]: Refreshing state... [id=rtbassoc-01b9e17a5fdc63dac]
aws_route_table_association.webservers[2]: Refreshing state... [id=rtbassoc-0d3120fd2b911c2ab]
aws_route_table.privates[0]: Refreshing state... [id=rtb-05c42f7709e05cc5d]
aws_route_table.privates[1]: Refreshing state... [id=rtb-08b98341525d521bf]
aws_route_table.privates[2]: Refreshing state... [id=rtb-0268889699936c017]
aws_db_instance.main: Refreshing state... [id=v3]
aws_route_table_association.private[0]: Refreshing state... [id=rtbassoc-028f652f4b8ce5a2c]
aws_route_table_association.private[2]: Refreshing state... [id=rtbassoc-0fc4f5d2dde4cba4c]
aws_route_table_association.private[1]: Refreshing state... [id=rtbassoc-0652b975ac88818a1]
------------------------------------------------------------------------
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
~ update in-place
- destroy
-/+ destroy and then create replacement
Terraform will perform the following actions:
# aws_db_instance.main will be updated in-place
~ resource "aws_db_instance" "main" {
address = "v3.cifqm9zogop9.eu-west-2.rds.amazonaws.com"
allocated_storage = 20
arn = "arn:aws:rds:eu-west-2:169093608028:db:v3"
auto_minor_version_upgrade = true
availability_zone = "eu-west-2a"
backup_retention_period = 0
backup_window = "04:12-04:42"
ca_cert_identifier = "rds-ca-2019"
copy_tags_to_snapshot = false
db_subnet_group_name = "v3-rds"
delete_automated_backups = true
deletion_protection = false
enabled_cloudwatch_logs_exports = [
"error",
"slowquery",
]
endpoint = "v3.cifqm9zogop9.eu-west-2.rds.amazonaws.com:3306"
engine = "mysql"
engine_version = "5.7.26"
~ final_snapshot_identifier = "v3-2020-06-14-15-42-30" -> (known after apply)
hosted_zone_id = "Z1TTGA775OQIYO"
iam_database_authentication_enabled = false
id = "v3"
identifier = "v3"
instance_class = "db.t3.micro"
iops = 0
license_model = "general-public-license"
maintenance_window = "wed:02:26-wed:02:56"
max_allocated_storage = 0
monitoring_interval = 0
multi_az = false
name = "exercism_v3"
option_group_name = "default:mysql-5-7"
parameter_group_name = "rds-v3"
password = (sensitive value)
performance_insights_enabled = false
performance_insights_retention_period = 0
port = 3306
publicly_accessible = false
replicas = []
resource_id = "db-VYKKITLQB2SXO7IKUSL7SVAEPQ"
security_group_names = []
skip_final_snapshot = false
status = "available"
storage_encrypted = false
storage_type = "gp2"
tags = {
"Name" = "v3"
}
username = "exercism_v3"
vpc_security_group_ids = [
"sg-04dd409818f91e8b1",
]
}
# aws_db_subnet_group.main will be updated in-place
~ resource "aws_db_subnet_group" "main" {
arn = "arn:aws:rds:eu-west-2:169093608028:subgrp:v3-rds"
description = "Managed by Terraform"
id = "v3-rds"
name = "v3-rds"
~ subnet_ids = [
- "subnet-06a8467ea081d660f",
- "subnet-083ae02cbe187a447",
- "subnet-0c7a7b8097c4d9cb5",
] -> (known after apply)
tags = {
"Name" = "v3"
}
}
# aws_eip.private_gateways[2] will be destroyed
- resource "aws_eip" "private_gateways" {
- association_id = "eipassoc-f86bb904" -> null
- domain = "vpc" -> null
- id = "eipalloc-07b7f8ab007308da4" -> null
- network_interface = "eni-0f6cb79fe277146fc" -> null
- private_dns = "ip-10-1-8-22.eu-west-2.compute.internal" -> null
- private_ip = "10.1.8.22" -> null
- public_dns = "ec2-35-178-143-190.eu-west-2.compute.amazonaws.com" -> null
- public_ip = "35.178.143.190" -> null
- public_ipv4_pool = "amazon" -> null
- tags = {
- "Name" = "v3 private eu-west-2c"
} -> null
- vpc = true -> null
}
# aws_nat_gateway.privates[0] must be replaced
-/+ resource "aws_nat_gateway" "privates" {
allocation_id = "eipalloc-06a70f6be28944594"
~ id = "nat-009f73da3e24e9638" -> (known after apply)
~ network_interface_id = "eni-096cdc536971cb673" -> (known after apply)
~ private_ip = "10.1.6.239" -> (known after apply)
~ public_ip = "18.132.112.62" -> (known after apply)
~ subnet_id = "subnet-0dbda1bac4cf7dd1f" -> (known after apply) # forces replacement
tags = {
"Name" = "v3 private eu-west-2a"
}
}
# aws_nat_gateway.privates[1] must be replaced
-/+ resource "aws_nat_gateway" "privates" {
allocation_id = "eipalloc-0e7cb498daf460f0b"
~ id = "nat-0b040f70d7da905b6" -> (known after apply)
~ network_interface_id = "eni-0efee13a5ba1aa889" -> (known after apply)
~ private_ip = "10.1.7.96" -> (known after apply)
~ public_ip = "3.9.163.245" -> (known after apply)
~ subnet_id = "subnet-08db7526626d6e8c9" -> (known after apply) # forces replacement
tags = {
"Name" = "v3 private eu-west-2b"
}
}
# aws_nat_gateway.privates[2] will be destroyed
- resource "aws_nat_gateway" "privates" {
- allocation_id = "eipalloc-07b7f8ab007308da4" -> null
- id = "nat-086a08621c32522de" -> null
- network_interface_id = "eni-0f6cb79fe277146fc" -> null
- private_ip = "10.1.8.22" -> null
- public_ip = "35.178.143.190" -> null
- subnet_id = "subnet-0c4aa221e97364b6c" -> null
- tags = {
- "Name" = "v3 private eu-west-2c"
} -> null
}
# aws_route_table.privates[0] will be updated in-place
~ resource "aws_route_table" "privates" {
id = "rtb-05c42f7709e05cc5d"
owner_id = "169093608028"
propagating_vgws = []
~ route = [
- {
- cidr_block = "0.0.0.0/0"
- egress_only_gateway_id = ""
- gateway_id = ""
- instance_id = ""
- ipv6_cidr_block = ""
- nat_gateway_id = "nat-009f73da3e24e9638"
- network_interface_id = ""
- transit_gateway_id = ""
- vpc_peering_connection_id = ""
},
{
cidr_block = "0.0.0.0/0"
egress_only_gateway_id = ""
gateway_id = ""
instance_id = ""
ipv6_cidr_block = ""
nat_gateway_id = (known after apply)
network_interface_id = ""
transit_gateway_id = ""
vpc_peering_connection_id = ""
},
]
tags = {
"Name" = "v3 private eu-west-2a"
}
vpc_id = "vpc-0d91d222fa72a8fa8"
}
# aws_route_table.privates[1] will be updated in-place
~ resource "aws_route_table" "privates" {
id = "rtb-08b98341525d521bf"
owner_id = "169093608028"
propagating_vgws = []
~ route = [
- {
- cidr_block = "0.0.0.0/0"
- egress_only_gateway_id = ""
- gateway_id = ""
- instance_id = ""
- ipv6_cidr_block = ""
- nat_gateway_id = "nat-0b040f70d7da905b6"
- network_interface_id = ""
- transit_gateway_id = ""
- vpc_peering_connection_id = ""
},
{
cidr_block = "0.0.0.0/0"
egress_only_gateway_id = ""
gateway_id = ""
instance_id = ""
ipv6_cidr_block = ""
nat_gateway_id = (known after apply)
network_interface_id = ""
transit_gateway_id = ""
vpc_peering_connection_id = ""
},
]
tags = {
"Name" = "v3 private eu-west-2b"
}
vpc_id = "vpc-0d91d222fa72a8fa8"
}
# aws_route_table.privates[2] will be destroyed
- resource "aws_route_table" "privates" {
- id = "rtb-0268889699936c017" -> null
- owner_id = "169093608028" -> null
- propagating_vgws = [] -> null
- route = [
- {
- cidr_block = "0.0.0.0/0"
- egress_only_gateway_id = ""
- gateway_id = ""
- instance_id = ""
- ipv6_cidr_block = ""
- nat_gateway_id = "nat-086a08621c32522de"
- network_interface_id = ""
- transit_gateway_id = ""
- vpc_peering_connection_id = ""
},
] -> null
- tags = {
- "Name" = "v3 private eu-west-2c"
} -> null
- vpc_id = "vpc-0d91d222fa72a8fa8" -> null
}
# aws_route_table_association.private[0] must be replaced
-/+ resource "aws_route_table_association" "private" {
~ id = "rtbassoc-028f652f4b8ce5a2c" -> (known after apply)
route_table_id = "rtb-05c42f7709e05cc5d"
~ subnet_id = "subnet-0dbda1bac4cf7dd1f" -> (known after apply) # forces replacement
}
# aws_route_table_association.private[1] must be replaced
-/+ resource "aws_route_table_association" "private" {
~ id = "rtbassoc-0652b975ac88818a1" -> (known after apply)
route_table_id = "rtb-08b98341525d521bf"
~ subnet_id = "subnet-08db7526626d6e8c9" -> (known after apply) # forces replacement
}
# aws_route_table_association.private[2] will be destroyed
- resource "aws_route_table_association" "private" {
- id = "rtbassoc-0fc4f5d2dde4cba4c" -> null
- route_table_id = "rtb-0268889699936c017" -> null
- subnet_id = "subnet-0c4aa221e97364b6c" -> null
}
# aws_route_table_association.webservers[0] must be replaced
-/+ resource "aws_route_table_association" "webservers" {
~ id = "rtbassoc-01b9e17a5fdc63dac" -> (known after apply)
route_table_id = "rtb-0beeaa901f5f131cc"
~ subnet_id = "subnet-0c7a7b8097c4d9cb5" -> (known after apply) # forces replacement
}
# aws_route_table_association.webservers[1] must be replaced
-/+ resource "aws_route_table_association" "webservers" {
~ id = "rtbassoc-0688a55aa3f4b9b3d" -> (known after apply)
route_table_id = "rtb-0beeaa901f5f131cc"
~ subnet_id = "subnet-083ae02cbe187a447" -> (known after apply) # forces replacement
}
# aws_route_table_association.webservers[2] will be destroyed
- resource "aws_route_table_association" "webservers" {
- id = "rtbassoc-0d3120fd2b911c2ab" -> null
- route_table_id = "rtb-0beeaa901f5f131cc" -> null
- subnet_id = "subnet-06a8467ea081d660f" -> null
}
# aws_subnet.privates[0] must be replaced
-/+ resource "aws_subnet" "privates" {
~ arn = "arn:aws:ec2:eu-west-2:169093608028:subnet/subnet-0dbda1bac4cf7dd1f" -> (known after apply)
assign_ipv6_address_on_creation = false
availability_zone = "eu-west-2a"
~ availability_zone_id = "euw2-az2" -> (known after apply)
~ cidr_block = "10.1.6.0/24" -> "10.1.4.0/24" # forces replacement
~ id = "subnet-0dbda1bac4cf7dd1f" -> (known after apply)
+ ipv6_cidr_block = (known after apply)
+ ipv6_cidr_block_association_id = (known after apply)
map_public_ip_on_launch = false
~ owner_id = "169093608028" -> (known after apply)
tags = {
"Name" = "v3 private eu-west-2a"
}
vpc_id = "vpc-0d91d222fa72a8fa8"
}
# aws_subnet.privates[1] must be replaced
-/+ resource "aws_subnet" "privates" {
~ arn = "arn:aws:ec2:eu-west-2:169093608028:subnet/subnet-08db7526626d6e8c9" -> (known after apply)
assign_ipv6_address_on_creation = false
availability_zone = "eu-west-2b"
~ availability_zone_id = "euw2-az3" -> (known after apply)
~ cidr_block = "10.1.7.0/24" -> "10.1.5.0/24" # forces replacement
~ id = "subnet-08db7526626d6e8c9" -> (known after apply)
+ ipv6_cidr_block = (known after apply)
+ ipv6_cidr_block_association_id = (known after apply)
map_public_ip_on_launch = false
~ owner_id = "169093608028" -> (known after apply)
tags = {
"Name" = "v3 private eu-west-2b"
}
vpc_id = "vpc-0d91d222fa72a8fa8"
}
# aws_subnet.privates[2] will be destroyed
- resource "aws_subnet" "privates" {
- arn = "arn:aws:ec2:eu-west-2:169093608028:subnet/subnet-0c4aa221e97364b6c" -> null
- assign_ipv6_address_on_creation = false -> null
- availability_zone = "eu-west-2c" -> null
- availability_zone_id = "euw2-az1" -> null
- cidr_block = "10.1.8.0/24" -> null
- id = "subnet-0c4aa221e97364b6c" -> null
- map_public_ip_on_launch = false -> null
- owner_id = "169093608028" -> null
- tags = {
- "Name" = "v3 private eu-west-2c"
} -> null
- vpc_id = "vpc-0d91d222fa72a8fa8" -> null
}
# aws_subnet.webservers[0] must be replaced
-/+ resource "aws_subnet" "webservers" {
~ arn = "arn:aws:ec2:eu-west-2:169093608028:subnet/subnet-0c7a7b8097c4d9cb5" -> (known after apply)
assign_ipv6_address_on_creation = false
availability_zone = "eu-west-2a"
~ availability_zone_id = "euw2-az2" -> (known after apply)
~ cidr_block = "10.1.3.0/24" -> "10.1.2.0/24" # forces replacement
~ id = "subnet-0c7a7b8097c4d9cb5" -> (known after apply)
+ ipv6_cidr_block = (known after apply)
+ ipv6_cidr_block_association_id = (known after apply)
map_public_ip_on_launch = false
~ owner_id = "169093608028" -> (known after apply)
tags = {
"Name" = "private 0"
}
vpc_id = "vpc-0d91d222fa72a8fa8"
}
# aws_subnet.webservers[1] must be replaced
-/+ resource "aws_subnet" "webservers" {
~ arn = "arn:aws:ec2:eu-west-2:169093608028:subnet/subnet-083ae02cbe187a447" -> (known after apply)
assign_ipv6_address_on_creation = false
availability_zone = "eu-west-2b"
~ availability_zone_id = "euw2-az3" -> (known after apply)
~ cidr_block = "10.1.4.0/24" -> "10.1.3.0/24" # forces replacement
~ id = "subnet-083ae02cbe187a447" -> (known after apply)
+ ipv6_cidr_block = (known after apply)
+ ipv6_cidr_block_association_id = (known after apply)
map_public_ip_on_launch = false
~ owner_id = "169093608028" -> (known after apply)
tags = {
"Name" = "private 1"
}
vpc_id = "vpc-0d91d222fa72a8fa8"
}
# aws_subnet.webservers[2] will be destroyed
- resource "aws_subnet" "webservers" {
- arn = "arn:aws:ec2:eu-west-2:169093608028:subnet/subnet-06a8467ea081d660f" -> null
- assign_ipv6_address_on_creation = false -> null
- availability_zone = "eu-west-2c" -> null
- availability_zone_id = "euw2-az1" -> null
- cidr_block = "10.1.5.0/24" -> null
- id = "subnet-06a8467ea081d660f" -> null
- map_public_ip_on_launch = false -> null
- owner_id = "169093608028" -> null
- tags = {
- "Name" = "private 2"
} -> null
- vpc_id = "vpc-0d91d222fa72a8fa8" -> null
}
Plan: 10 to add, 4 to change, 17 to destroy.
------------------------------------------------------------------------
Note: You didn't specify an "-out" parameter to save this plan, so Terraform
can't guarantee that exactly these actions will be performed if
"terraform apply" is subsequently run.