<p>Your locales or data objects probably evaluate to nothing. So when you run your for_each statement, it is like running a loop on an empty list, nothing happens. I would check the local.cloudwatch_logs_components to see if there is data in it.</p>

CC BY-SA 4.0
2023-12-13T18:58:08.220Z
2023-12-13T18:58:08.220Z
hasenek
<p>I have deployed a Cloudwatch Log Group community module to my terraform stack (sourced from <a href="https://github.com/cloudposse/terraform-aws-components" rel="nofollow noreferrer">https://github.com/cloudposse/terraform-aws-components</a>) but I have spent more than a day trying to resolve this, unsuccessfully.</p>
<p>When I run terraform plan, the new component is not showing as a new piece of infrastructure.</p>
<pre><code>$ terraform plan 
</code></pre>
<pre><code>No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration and found no differences, so no changes are needed.
</code></pre>
<p>Could anyone please just scan my configuration to see if there are things that could be missing or misconfigured that would cause terraform from ignoring the new component. Getting terraform to run without error has been a struggle which I have just resolved but this in a new level that doesn't make sense. My configuration is set as follows:</p>
<p><strong>test-stage-eu-west-1.yaml</strong></p>
<pre><code>    ec2_session_manager_log:
      component: cloudwatch_logs
      vars:
        context:
          enabled: true
          name: &quot;ssm-logs&quot;
        enabled: true
        name: &quot;ec2-ssm-log-name&quot;
        retention_in_days: 7
        kms_key_arn: &quot;arn:aws:kms:eu-west-1:12345667890:key/xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx&quot;
        principals: &quot;ec2.amazonaws.com&quot;
        additional_permissions: []
        stream_names: [ &quot;app1&quot;, &quot;app2&quot; ]
        region: eu-west-1

    cloudwatch_logs:
      vars:
        context:
          enabled: false
</code></pre>
<p><strong>cloudwatch-logs module: ./module/cloudwatch-logs/main.tf</strong></p>
<pre><code>locals {
  enabled = module.this.enabled
}

data &quot;aws_caller_identity&quot; &quot;current&quot; {
  count = local.enabled ? 1 : 0
}

data &quot;aws_partition&quot; &quot;current&quot; {
  count = local.enabled ? 1 : 0
}

module &quot;logs&quot; {
  source  = &quot;cloudposse/cloudwatch-logs/aws&quot;
  version = &quot;0.6.5&quot;

  name                   = var.name
  stream_names           = var.stream_names
  retention_in_days      = var.retention_in_days
  principals             = var.principals
  additional_permissions = var.additional_permissions
  kms_key_arn            = var.kms_key_arn
}

module &quot;kms_key_logs&quot; {
  source  = &quot;cloudposse/kms-key/aws&quot;
  version = &quot;0.12.1&quot;

  description             = &quot;KMS key for CloudWatch Logs&quot;
  deletion_window_in_days = 10
  enable_key_rotation     = true
  alias                   = &quot;alias/${module.this.id}&quot;
  policy                  = join(&quot;&quot;, data.aws_iam_policy_document.kms.*.json)

}

data &quot;aws_iam_policy_document&quot; &quot;kms&quot; {
  count = local.enabled ? 1 : 0

  statement {
    sid    = &quot;EnableRootUserPermissions&quot;
    effect = &quot;Allow&quot;

    actions = [
      &quot;kms:Create*&quot;,
      &quot;kms:Describe*&quot;,
      &quot;kms:Enable*&quot;,
      &quot;kms:List*&quot;,
      &quot;kms:Put*&quot;,
      &quot;kms:Update*&quot;,
      &quot;kms:Revoke*&quot;,
      &quot;kms:Disable*&quot;,
      &quot;kms:Get*&quot;,
      &quot;kms:Delete*&quot;,
      &quot;kms:Tag*&quot;,
      &quot;kms:Untag*&quot;,
      &quot;kms:ScheduleKeyDeletion&quot;,
      &quot;kms:CancelKeyDeletion&quot;
    ]

    resources = [
      &quot;*&quot;
    ]

    principals {
      type = &quot;AWS&quot;

      identifiers = [
        &quot;arn:${join(&quot;&quot;, data.aws_partition.current[*].partition)}:iam::${join(&quot;&quot;, data.aws_caller_identity.current[*].account_id)}:root&quot;
      ]
    }
  }

  statement {
    sid    = &quot;Allow CloudWatch to Encrypt with the key&quot;
    effect = &quot;Allow&quot;

    actions = [
      &quot;kms:Encrypt*&quot;,
      &quot;kms:Decrypt*&quot;,
      &quot;kms:ReEncrypt*&quot;,
      &quot;kms:GenerateDataKey*&quot;,
      &quot;kms:Describe*&quot;
    ]

    resources = [
      &quot;*&quot;
    ]

    principals {
      type = &quot;Service&quot;

      identifiers = [
        &quot;logs.${var.region}.amazonaws.com&quot;,
      ]
    }
  }
}
</code></pre>
<p><strong>Root: ./main.tf:</strong></p>
<pre><code>module &quot;cloudwatch-logs&quot; {
  source  = &quot;./modules/cloudwatch-logs&quot;
  for_each = local.cloudwatch_logs_components

  name                   = try(each.value.vars.name, null)
  stream_names           = try(each.value.vars.stream_names, null)
  retention_in_days      = try(each.value.vars.retention_in_days, null)
  aws_service_principal  = try(each.value.vars.principal, null)
  additional_permissions = try(each.value.vars.additional_permissions, null)
  region                 = try(each.value.vars.region, null)
  kms_key_arn            = try (each.value.vars.region, null)
  context                = try(each.value.vars.context, null)

}
</code></pre>

CC BY-SA 4.0
2023-04-21T05:09:10.840Z
It sounds like there are some optional components, the one which you are expecting is one of them, which are not being enabled. I would check the module to see what variables it expects to be toggled in order to enable them.
Bruce Becker
<amazon-web-services><terraform><yaml><aws-cli><terraform-module>
Terraform - No Infrastructure Changes Detected
Don Draper
# Terraform - No Infrastructure Changes Detected

(Asked by: username_0 on 2023-04-20)

I have deployed a Cloudwatch Log Group community module to my terraform stack (sourced from https://github.com/cloudposse/terraform-aws-components) but I have spent more than a day trying to resolve this, unsuccessfully.
When I run terraform plan, the new component is not showing as a new piece of infrastructure.
$ terraform plan 

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration and found no differences, so no changes are needed.

Could anyone please just scan my configuration to see if there are things that could be missing or misconfigured that would cause terraform from ignoring the new component. Getting terraform to run without error has been a struggle which I have just resolved but this in a new level that doesn't make sense. My configuration is set as follows:
test-stage-eu-west-1.yaml
    ec2_session_manager_log:
      component: cloudwatch_logs
      vars:
        context:
          enabled: true
          name: "ssm-logs"
        enabled: true
        name: "ec2-ssm-log-name"
        retention_in_days: 7
        kms_key_arn: "arn:aws:kms:eu-west-1:12345667890:key/xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx"
        principals: "ec2.amazonaws.com"
        additional_permissions: []
        stream_names: [ "app1", "app2" ]
        region: eu-west-1

    cloudwatch_logs:
      vars:
        context:
          enabled: false

cloudwatch-logs module: ./module/cloudwatch-logs/main.tf
locals {
  enabled = module.this.enabled
}

data "aws_caller_identity" "current" {
  count = local.enabled ? 1 : 0
}

data "aws_partition" "current" {
  count = local.enabled ? 1 : 0
}

module "logs" {
  source  = "cloudposse/cloudwatch-logs/aws"
  version = "0.6.5"

  name                   = var.name
  stream_names           = var.stream_names
  retention_in_days      = var.retention_in_days
  principals             = var.principals
  additional_permissions = var.additional_permissions
  kms_key_arn            = var.kms_key_arn
}

module "kms_key_logs" {
  source  = "cloudposse/kms-key/aws"
  version = "0.12.1"

  description             = "KMS key for CloudWatch Logs"
  deletion_window_in_days = 10
  enable_key_rotation     = true
  alias                   = "alias/${module.this.id}"
  policy                  = join("", data.aws_iam_policy_document.kms.*.json)

}

data "aws_iam_policy_document" "kms" {
  count = local.enabled ? 1 : 0

  statement {
    sid    = "EnableRootUserPermissions"
    effect = "Allow"

    actions = [
      "kms:Create*",
      "kms:Describe*",
      "kms:Enable*",
      "kms:List*",
      "kms:Put*",
      "kms:Update*",
      "kms:Revoke*",
      "kms:Disable*",
      "kms:Get*",
      "kms:Delete*",
      "kms:Tag*",
      "kms:Untag*",
      "kms:ScheduleKeyDeletion",
      "kms:CancelKeyDeletion"
    ]

    resources = [
      "*"
    ]

    principals {
      type = "AWS"

      identifiers = [
        "arn:${join("", data.aws_partition.current[*].partition)}:iam::${join("", data.aws_caller_identity.current[*].account_id)}:root"
      ]
    }
  }

  statement {
    sid    = "Allow CloudWatch to Encrypt with the key"
    effect = "Allow"

    actions = [
      "kms:Encrypt*",
      "kms:Decrypt*",
      "kms:ReEncrypt*",
      "kms:GenerateDataKey*",
      "kms:Describe*"
    ]

    resources = [
      "*"
    ]

    principals {
      type = "Service"

      identifiers = [
        "logs.${var.region}.amazonaws.com",
      ]
    }
  }
}

Root: ./main.tf:
module "cloudwatch-logs" {
  source  = "./modules/cloudwatch-logs"
  for_each = local.cloudwatch_logs_components

  name                   = try(each.value.vars.name, null)
  stream_names           = try(each.value.vars.stream_names, null)
  retention_in_days      = try(each.value.vars.retention_in_days, null)
  aws_service_principal  = try(each.value.vars.principal, null)
  additional_permissions = try(each.value.vars.additional_permissions, null)
  region                 = try(each.value.vars.region, null)
  kms_key_arn            = try (each.value.vars.region, null)
  context                = try(each.value.vars.context, null)

}

**Tags:** amazon-web-services, terraform, yaml, aws-cli, terraform-module

> **Comments:**
> **username_1**: It sounds like there are some optional components, the one which you are expecting is one of them, which are not being enabled. I would check the module to see what variables it expects to be toggled in order to enable them.  

---

## 1 answers

### Answer by username_2 on 2023-12-13. Score: 0

Your locales or data objects probably evaluate to nothing. So when you run your for\_each statement, it is like running a loop on an empty list, nothing happens. I would check the local.cloudwatch\_logs\_components to see if there is data in it.


---

