From 432b776ce7e2ed9cc78a1b46fe0d3c16efb9a5cd Mon Sep 17 00:00:00 2001 From: David Moran <23364162+wavemoran@users.noreply.github.com> Date: Wed, 25 Mar 2026 09:03:54 -0700 Subject: [PATCH 1/3] fix: use can(index()) to handle null proxy_client_password_auth_type Terraform's contains() throws "Invalid function argument" when the value is null, even when guarded by an == null check, because both sides of || are evaluated. Replace with can(index()) which returns false for null or non-matching values without erroring. Co-Authored-By: Claude Opus 4.6 --- src/variables.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/variables.tf b/src/variables.tf index 92d9f4b..f006046 100644 --- a/src/variables.tf +++ b/src/variables.tf @@ -538,7 +538,7 @@ variable "proxy_client_password_auth_type" { description = "The type of authentication the proxy uses for connections from clients. Valid values: MYSQL_NATIVE_PASSWORD, POSTGRES_SCRAM_SHA_256, POSTGRES_MD5, SQL_SERVER_AUTHENTICATION" validation { - condition = var.proxy_client_password_auth_type == null || contains(["MYSQL_NATIVE_PASSWORD", "POSTGRES_SCRAM_SHA_256", "POSTGRES_MD5", "SQL_SERVER_AUTHENTICATION"], var.proxy_client_password_auth_type) + condition = var.proxy_client_password_auth_type == null || can(index(["MYSQL_NATIVE_PASSWORD", "POSTGRES_SCRAM_SHA_256", "POSTGRES_MD5", "SQL_SERVER_AUTHENTICATION"], var.proxy_client_password_auth_type)) error_message = "Valid values for proxy_client_password_auth_type are: MYSQL_NATIVE_PASSWORD, POSTGRES_SCRAM_SHA_256, POSTGRES_MD5, SQL_SERVER_AUTHENTICATION." } } From ca0c55127334c178e2f3fc9b8a4d8d02368b1d03 Mon Sep 17 00:00:00 2001 From: David Moran <23364162+wavemoran@users.noreply.github.com> Date: Wed, 25 Mar 2026 10:16:40 -0700 Subject: [PATCH 2/3] fix: upgrade stack-config to 2.0.0 to resolve cloudposse/utils provider conflict stack-config v1.8.0 requires cloudposse/utils >= 1.7.1, < 2.0.0 while account-map pulls in stack-config v2.0.0 which requires >= 2.0.0, < 3.0.0. These constraints are mutually exclusive, causing terraform init to fail. Upgrading all four remote-state module references to v2.0.0 aligns the utils constraint to >= 2.0.0, < 3.0.0 across the full dependency tree. The remote-state module interface is identical between v1.8.0 and v2.0.0. Co-Authored-By: Claude Opus 4.6 --- src/remote-state.tf | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/remote-state.tf b/src/remote-state.tf index 2ea5975..25a5d06 100644 --- a/src/remote-state.tf +++ b/src/remote-state.tf @@ -1,6 +1,6 @@ module "vpc" { source = "cloudposse/stack-config/yaml//modules/remote-state" - version = "1.8.0" + version = "2.0.0" component = var.vpc_component_name @@ -9,7 +9,7 @@ module "vpc" { module "vpc_ingress" { source = "cloudposse/stack-config/yaml//modules/remote-state" - version = "1.8.0" + version = "2.0.0" for_each = { for i, account in var.allow_ingress_from_vpc_accounts : @@ -27,7 +27,7 @@ module "vpc_ingress" { module "eks" { source = "cloudposse/stack-config/yaml//modules/remote-state" - version = "1.8.0" + version = "2.0.0" for_each = local.eks_security_group_enabled ? var.eks_component_names : toset([]) component = each.value @@ -38,7 +38,7 @@ module "eks" { module "dns_gbl_delegated" { source = "cloudposse/stack-config/yaml//modules/remote-state" - version = "1.8.0" + version = "2.0.0" component = "dns-delegated" environment = var.dns_gbl_delegated_environment_name From dfceebccb2dd60632f87e2f825e50725c9095ff9 Mon Sep 17 00:00:00 2001 From: David Moran <23364162+wavemoran@users.noreply.github.com> Date: Wed, 15 Apr 2026 08:32:42 -0700 Subject: [PATCH 3/3] fix: use GitHub source for iam_roles module to resolve CI init failures Replace relative path reference to account-map with a pinned GitHub source so terraform init succeeds without the CI-only account-map copy workaround. Co-Authored-By: Claude Opus 4.6 --- src/providers.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/providers.tf b/src/providers.tf index ef923e1..95ab87f 100644 --- a/src/providers.tf +++ b/src/providers.tf @@ -14,6 +14,6 @@ provider "aws" { } module "iam_roles" { - source = "../account-map/modules/iam-roles" + source = "github.com/cloudposse-terraform-components/aws-account-map//src/modules/iam-roles?ref=v1.537.2" context = module.this.context }