2

I'm trying to use a dependency block for the first time, but get aws s3 list object permission denied issues and have trouble debugging the issue.

The setup is as follows, using an s3 backend for storing terraform state:

A git repo containing the terraform modules:

archive
s3_inventory

Instantiations of the above:

prod/eu/archive/terragrunt.hcl:

terraform {
  source = "git::ssh://git@my_server//archive?ref=v1.0.0"
}

include {
  path = find_in_parent_folders()
}

dependency "s3-inventory" {
  config_path = "../s3-inventory/"
}

prod/eu/s3_inventory/terragrunt.hcl:

terraform {
  source = "git::ssh://git@my_server//s3_inventory?ref=v1.0.0"
}

include {
  path = find_in_parent_folders()
}

Running terragrunt apply in prod/eu/archive works just fine when I remove the dependency block from the hcl file. It fails when I add the dependency block in.

Running terragrunt output -json in prod/eu/s3-inventory also works just fine.

With debugging flags on I still don't seem to get enough info as to why it's failing.

terragrunt apply --terragrunt-log-level debug --terragrunt-debug in prod/eu/archive results in something like this:

...<omitted>...
DEBU[0000] Detected module /Users/tim.kersten/prod/eu/s3-inventory/terragrunt.hcl is already init-ed. Retrieving outputs directly from working directory.  prefix=[/Users/tim.kersten/prod/eu/s3-inventory]
DEBU[0000] Running command: terraform output -json       prefix=[/Users/tim.kersten/prod/eu/s3-inventory]
Failed to load state: AccessDenied: Access Denied
    status code: 403, request id: ABC123DEF456GHI, host id: WW91J3JlIHRlcnJpYmx5IG5vc2UgZm9yIHRyeWluZyB0byBsb29rIGF0IG15IGhvc3QK
ERRO[0003] exit status 1

Something is clearly different, but the debugging options I set on terragrunt don't seem to give me enough info to understand what's different.

Anyone understand what's going on here?

Edit: terragrunt version: 0.28.6

Tim Kersten
  • 579
  • 3
  • 13
  • 1
    One possible explanation: I'm using a different AWS profile for managing state to the one used by the terraform modules. This has never been a problem in the past, but this is the first time I'm using a `dependency` block. Perhaps it doesn't handle that situation well? – Tim Kersten Mar 25 '21 at 11:11

0 Answers0