fix: maintenance mode deployment issues second try

[craigzour]

Summary | Résumé

• Fix for maintenance mode deployment issues on AWS

[github-actions]

⚠ Terrform update available

Terraform: 1.6.4 (using 1.4.2)
Terragrunt: 0.53.3 (using 0.46.3)

[github-actions]

Staging: load_balancer

✅   Terraform Init: success
✅   Terraform Validate: success
✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

Plan: 4 to add, 1 to change, 0 to destroy

Show summary

CHANGE	NAME
add	aws_cloudfront_distribution.maintenance_mode
	aws_route53_record.form_viewer_maintenance[0]
	aws_s3_bucket_acl.maintenance_mode
	aws_s3_bucket_website_configuration.maintenance_mode
update	aws_s3_bucket_public_access_block.maintenance_mode

Show plan

Resource actions are indicated with the following symbols:
  + create
  ~ update in-place

Terraform will perform the following actions:

  # aws_cloudfront_distribution.maintenance_mode will be created
  + resource "aws_cloudfront_distribution" "maintenance_mode" {
      + arn                            = (known after apply)
      + caller_reference               = (known after apply)
      + default_root_object            = "index.html"
      + domain_name                    = (known after apply)
      + enabled                        = true
      + etag                           = (known after apply)
      + hosted_zone_id                 = (known after apply)
      + http_version                   = "http2"
      + id                             = (known after apply)
      + in_progress_validation_batches = (known after apply)
      + is_ipv6_enabled                = false
      + last_modified_time             = (known after apply)
      + price_class                    = "PriceClass_100"
      + retain_on_delete               = false
      + status                         = (known after apply)
      + tags                           = {
          + "CostCentre" = "forms-platform-staging"
          + "Terraform"  = "true"
        }
      + tags_all                       = {
          + "CostCentre" = "forms-platform-staging"
          + "Terraform"  = "true"
        }
      + trusted_key_groups             = (known after apply)
      + trusted_signers                = (known after apply)
      + wait_for_deployment            = true

      + default_cache_behavior {
          + allowed_methods        = [
              + "GET",
              + "HEAD",
            ]
          + cached_methods         = [
              + "GET",
              + "HEAD",
            ]
          + compress               = true
          + default_ttl            = 3600
          + max_ttl                = 86400
          + min_ttl                = 0
          + target_origin_id       = "MaintenanceMode"
          + trusted_key_groups     = (known after apply)
          + trusted_signers        = (known after apply)
          + viewer_protocol_policy = "redirect-to-https"

          + forwarded_values {
              + headers                 = (known after apply)
              + query_string            = false
              + query_string_cache_keys = (known after apply)

              + cookies {
                  + forward           = "none"
                  + whitelisted_names = (known after apply)
                }
            }
        }

      + origin {
          + connection_attempts = 3
          + connection_timeout  = 10
          + domain_name         = "gc-forms-application-maintenance-page.s3.ca-central-1.amazonaws.com"
          + origin_id           = "MaintenanceMode"

          + s3_origin_config {
              + origin_access_identity = "origin-access-identity/cloudfront/E2PGE1KRH6OS33"
            }
        }

      + restrictions {
          + geo_restriction {
              + locations        = (known after apply)
              + restriction_type = "none"
            }
        }

      + viewer_certificate {
          + cloudfront_default_certificate = true
          + minimum_protocol_version       = "TLSv1"
        }
    }

  # aws_route53_record.form_viewer_maintenance[0] will be created
  + resource "aws_route53_record" "form_viewer_maintenance" {
      + allow_overwrite = (known after apply)
      + fqdn            = (known after apply)
      + id              = (known after apply)
      + name            = "forms-staging.cdssandbox.xyz"
      + set_identifier  = "form_viewer_forms-staging.cdssandbox.xyz_secondary"
      + type            = "A"
      + zone_id         = "Z05990652HOQ0SGHD81ZC"

      + alias {
          + evaluate_target_health = false
          + name                   = (known after apply)
          + zone_id                = (known after apply)
        }

      + failover_routing_policy {
          + type = "SECONDARY"
        }
    }

  # aws_s3_bucket_acl.maintenance_mode will be created
  + resource "aws_s3_bucket_acl" "maintenance_mode" {
      + acl    = "public-read"
      + bucket = "gc-forms-application-maintenance-page"
      + id     = (known after apply)
    }

  # aws_s3_bucket_public_access_block.maintenance_mode will be updated in-place
  ~ resource "aws_s3_bucket_public_access_block" "maintenance_mode" {
      ~ block_public_acls       = true -> false
      ~ block_public_policy     = true -> false
        id                      = "gc-forms-application-maintenance-page"
      ~ ignore_public_acls      = true -> false
      ~ restrict_public_buckets = true -> false
        # (1 unchanged attribute hidden)
    }

  # aws_s3_bucket_website_configuration.maintenance_mode will be created
  + resource "aws_s3_bucket_website_configuration" "maintenance_mode" {
      + bucket           = "gc-forms-application-maintenance-page"
      + id               = (known after apply)
      + routing_rules    = (known after apply)
      + website_domain   = (known after apply)
      + website_endpoint = (known after apply)

      + index_document {
          + suffix = "index.html"
        }
    }

Plan: 4 to add, 1 to change, 0 to destroy.

Warning: Argument is deprecated

  with aws_s3_bucket.firehose_waf_logs,
  on kinesis.tf line 30, in resource "aws_s3_bucket" "firehose_waf_logs":
  30: resource "aws_s3_bucket" "firehose_waf_logs" {

Use the aws_s3_bucket_server_side_encryption_configuration resource instead

(and 5 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"

Show Conftest results

WARN - plan.json - main - Missing Common Tags: ["aws_s3_bucket_object.maintenance_static_page"]
WARN - plan.json - main - Missing Common Tags: ["aws_wafv2_regex_pattern_set.forms_base_url"]
WARN - plan.json - main - Missing Common Tags: ["aws_wafv2_regex_pattern_set.valid_app_uri_paths"]

22 tests, 19 passed, 3 warnings, 0 failures, 0 exceptions