fix(Terraform): Bug fixes and lint tweaks

+ Remove few WARN
+ Sort keys in .hcl
+ Fix provisioning
+ Lint tweaks

Signed-off-by: pmikus <pmikus@cisco.com>
Change-Id: I6e07cb5ceb7416209185b43342dc19017f1472d8

1 files changed, 170 insertions, 89 deletions

diff --git a/fdio.infra.terraform/2n_aws_c5n/deploy/main.tf b/fdio.infra.terraform/2n_aws_c5n/deploy/main.tf
index db1463e788..4a086bf0b0 100644
--- a/fdio.infra.terraform/2n_aws_c5n/deploy/main.tf
+++ b/fdio.infra.terraform/2n_aws_c5n/deploy/main.tf
@@ -4,7 +4,11 @@ data "vault_aws_access_credentials" "creds" {
 }
 
 resource "aws_vpc" "CSITVPC" {
-  cidr_block = var.vpc_cidr_mgmt
+  assign_generated_ipv6_cidr_block = false
+  enable_dns_hostnames             = false
+  enable_dns_support               = true
+  cidr_block                       = var.vpc_cidr_mgmt
+  instance_tenancy                 = "default"
 
   tags = {
     "Name"        = "${var.resources_name_prefix}_${var.testbed_name}-vpc"
@@ -13,30 +17,36 @@ resource "aws_vpc" "CSITVPC" {
 }
 
 resource "aws_security_group" "CSITSG" {
-  name        = "${var.resources_name_prefix}_${var.testbed_name}-sg"
-  description = "Allow inbound traffic"
-  vpc_id      = aws_vpc.CSITVPC.id
-  depends_on  = [aws_vpc.CSITVPC]
+  depends_on                       = [
+    aws_vpc.CSITVPC
+  ]
+  description                      = "Allow inbound traffic"
+  name                             = "${var.resources_name_prefix}_${var.testbed_name}-sg"
+  revoke_rules_on_delete           = false
+  vpc_id                           = aws_vpc.CSITVPC.id
 
   ingress {
-    from_port   = 22
-    to_port     = 22
-    protocol    = "tcp"
-    cidr_blocks = ["0.0.0.0/0"]
+    from_port        = 22
+    to_port          = 22
+    protocol         = "tcp"
+    cidr_blocks      = ["0.0.0.0/0"]
+    ipv6_cidr_blocks = []
   }
 
   ingress {
-    from_port = 0
-    to_port   = 0
-    protocol  = -1
-    self      = true
+    from_port        = 0
+    to_port          = 0
+    protocol         = -1
+    self             = true
+    ipv6_cidr_blocks = []
   }
 
   egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
+    from_port        = 0
+    to_port          = 0
+    protocol         = "-1"
+    cidr_blocks      = ["0.0.0.0/0"]
+    ipv6_cidr_blocks = []
   }
 
   tags = {
@@ -46,57 +56,87 @@ resource "aws_security_group" "CSITSG" {
 }
 
 resource "aws_vpc_ipv4_cidr_block_association" "b" {
-  vpc_id     = aws_vpc.CSITVPC.id
+  depends_on = [
+    aws_vpc.CSITVPC
+  ]
   cidr_block = var.vpc_cidr_b
-  depends_on = [aws_vpc.CSITVPC]
+  vpc_id     = aws_vpc.CSITVPC.id
 }
+
 resource "aws_vpc_ipv4_cidr_block_association" "c" {
-  vpc_id     = aws_vpc.CSITVPC.id
+  depends_on = [
+    aws_vpc.CSITVPC
+  ]
   cidr_block = var.vpc_cidr_c
-  depends_on = [aws_vpc.CSITVPC]
+  vpc_id     = aws_vpc.CSITVPC.id
 }
+
 resource "aws_vpc_ipv4_cidr_block_association" "d" {
-  vpc_id     = aws_vpc.CSITVPC.id
+  depends_on = [
+    aws_vpc.CSITVPC
+  ]
   cidr_block = var.vpc_cidr_d
-  depends_on = [aws_vpc.CSITVPC]
+  vpc_id     = aws_vpc.CSITVPC.id
 }
 
 # Subnets
 resource "aws_subnet" "mgmt" {
-  vpc_id            = aws_vpc.CSITVPC.id
-  cidr_block        = var.vpc_cidr_mgmt
-  availability_zone = var.avail_zone
-  depends_on        = [aws_vpc.CSITVPC]
+  availability_zone               = var.avail_zone
+  assign_ipv6_address_on_creation = false
+  cidr_block                      = var.vpc_cidr_mgmt
+  depends_on                      = [
+    aws_vpc.CSITVPC
+  ]
+  map_public_ip_on_launch         = false
+  vpc_id                          = aws_vpc.CSITVPC.id
 
   tags = {
     "Environment" = var.environment_name
   }
 }
+
 resource "aws_subnet" "b" {
-  vpc_id            = aws_vpc.CSITVPC.id
-  cidr_block        = var.vpc_cidr_b
-  availability_zone = var.avail_zone
-  depends_on        = [aws_vpc.CSITVPC, aws_vpc_ipv4_cidr_block_association.b]
+  availability_zone               = var.avail_zone
+  assign_ipv6_address_on_creation = false
+  cidr_block                      = var.vpc_cidr_b
+  depends_on                      = [
+    aws_vpc.CSITVPC,
+    aws_vpc_ipv4_cidr_block_association.b
+  ]
+  map_public_ip_on_launch         = false
+  vpc_id                          = aws_vpc.CSITVPC.id
 
   tags = {
     "Environment" = var.environment_name
   }
 }
+
 resource "aws_subnet" "c" {
-  vpc_id            = aws_vpc.CSITVPC.id
-  cidr_block        = var.vpc_cidr_c
-  availability_zone = var.avail_zone
-  depends_on        = [aws_vpc.CSITVPC, aws_vpc_ipv4_cidr_block_association.c]
+  availability_zone               = var.avail_zone
+  assign_ipv6_address_on_creation = false
+  cidr_block                      = var.vpc_cidr_c
+  depends_on                      = [
+    aws_vpc.CSITVPC,
+    aws_vpc_ipv4_cidr_block_association.c
+  ]
+  map_public_ip_on_launch         = false
+  vpc_id                          = aws_vpc.CSITVPC.id
 
   tags = {
     "Environment" = var.environment_name
   }
 }
+
 resource "aws_subnet" "d" {
-  vpc_id            = aws_vpc.CSITVPC.id
-  cidr_block        = var.vpc_cidr_d
-  availability_zone = var.avail_zone
-  depends_on        = [aws_vpc.CSITVPC, aws_vpc_ipv4_cidr_block_association.d]
+  availability_zone               = var.avail_zone
+  assign_ipv6_address_on_creation = false
+  cidr_block                      = var.vpc_cidr_d
+  depends_on                      = [
+    aws_vpc.CSITVPC,
+    aws_vpc_ipv4_cidr_block_association.d
+  ]
+  map_public_ip_on_launch         = false
+  vpc_id                          = aws_vpc.CSITVPC.id
 
   tags = {
     "Environment" = var.environment_name
@@ -104,8 +144,10 @@ resource "aws_subnet" "d" {
 }
 
 resource "aws_internet_gateway" "CSITGW" {
+  depends_on = [
+    aws_vpc.CSITVPC
+  ]
   vpc_id     = aws_vpc.CSITVPC.id
-  depends_on = [aws_vpc.CSITVPC]
 
   tags = {
     "Environment" = var.environment_name
@@ -115,12 +157,14 @@ resource "aws_internet_gateway" "CSITGW" {
 # SSH keypair
 # Temporary key for provisioning only
 resource "tls_private_key" "CSITTLS" {
-  algorithm = "RSA"
-  rsa_bits  = 4096
+  algorithm   = "RSA"
+  ecdsa_curve = "P521"
+  rsa_bits    = 4096
 }
+
 resource "aws_key_pair" "CSITKP" {
   key_name   = "${var.resources_name_prefix}_${var.testbed_name}-key"
-  public_key = tls_private_key.CSITTLS.public_key_openssh
+  public_key = "${tls_private_key.CSITTLS.public_key_openssh}"
 }
 
 resource "aws_placement_group" "CSITPG" {
@@ -130,12 +174,16 @@ resource "aws_placement_group" "CSITPG" {
 
 # NICs
 resource "aws_network_interface" "dut1_if1" {
-  subnet_id         = aws_subnet.b.id
-  source_dest_check = false
+  depends_on        = [
+    aws_vpc.CSITVPC,
+    aws_subnet.b,
+    aws_instance.dut1
+  ]
   private_ip        = var.dut1_if1_ip
   private_ips       = [var.dut1_if1_ip]
   security_groups   = [aws_security_group.CSITSG.id]
-  depends_on        = [aws_vpc.CSITVPC, aws_subnet.b, aws_instance.dut1]
+  source_dest_check = false
+  subnet_id         = aws_subnet.b.id
 
   attachment {
     instance     = aws_instance.dut1.id
@@ -148,12 +196,16 @@ resource "aws_network_interface" "dut1_if1" {
 }
 
 resource "aws_network_interface" "dut1_if2" {
-  subnet_id         = aws_subnet.d.id
-  source_dest_check = false
+  depends_on        = [
+    aws_vpc.CSITVPC,
+    aws_subnet.d,
+    aws_instance.dut1
+  ]
   private_ip        = var.dut1_if2_ip
   private_ips       = [var.dut1_if2_ip]
   security_groups   = [aws_security_group.CSITSG.id]
-  depends_on        = [aws_vpc.CSITVPC, aws_subnet.d, aws_instance.dut1]
+  source_dest_check = false
+  subnet_id         = aws_subnet.d.id
 
   attachment {
     instance     = aws_instance.dut1.id
@@ -166,12 +218,16 @@ resource "aws_network_interface" "dut1_if2" {
 }
 
 resource "aws_network_interface" "tg_if1" {
-  subnet_id         = aws_subnet.b.id
-  source_dest_check = false
+  depends_on        = [
+    aws_vpc.CSITVPC,
+    aws_subnet.b,
+    aws_instance.tg
+  ]
   private_ip        = var.tg_if1_ip
   private_ips       = [var.tg_if1_ip]
   security_groups   = [aws_security_group.CSITSG.id]
-  depends_on        = [aws_vpc.CSITVPC, aws_subnet.b, aws_instance.tg]
+  source_dest_check = false
+  subnet_id         = aws_subnet.b.id
 
   attachment {
     instance     = aws_instance.tg.id
@@ -184,12 +240,16 @@ resource "aws_network_interface" "tg_if1" {
 }
 
 resource "aws_network_interface" "tg_if2" {
-  subnet_id         = aws_subnet.d.id
-  source_dest_check = false
+  depends_on        = [
+    aws_vpc.CSITVPC,
+    aws_subnet.d,
+    aws_instance.tg
+  ]
   private_ip        = var.tg_if2_ip
   private_ips       = [var.tg_if2_ip]
   security_groups   = [aws_security_group.CSITSG.id]
-  depends_on        = [aws_vpc.CSITVPC, aws_subnet.d, aws_instance.tg]
+  source_dest_check = false
+  subnet_id         = aws_subnet.d.id
 
   attachment {
     instance     = aws_instance.tg.id
@@ -219,23 +279,27 @@ data "aws_network_interface" "tg_if2" {
 
 # Instances
 resource "aws_instance" "tg" {
-  depends_on                           = [aws_vpc.CSITVPC, aws_placement_group.CSITPG]
+  depends_on                           = [
+    aws_vpc.CSITVPC,
+    aws_placement_group.CSITPG,
+    aws_security_group.CSITSG
+  ]
   ami                                  = var.ami_image_tg
   availability_zone                    = var.avail_zone
+  associate_public_ip_address          = true
   instance_initiated_shutdown_behavior = var.instance_initiated_shutdown_behavior
   instance_type                        = var.instance_type
   key_name                             = aws_key_pair.CSITKP.key_name
-  associate_public_ip_address          = true
-  subnet_id                            = aws_subnet.mgmt.id
-  private_ip                           = var.tg_mgmt_ip
-  vpc_security_group_ids               = [aws_security_group.CSITSG.id]
   placement_group                      = aws_placement_group.CSITPG.id
+  private_ip                           = var.tg_mgmt_ip
   source_dest_check                    = false
+  subnet_id                            = aws_subnet.mgmt.id
+  vpc_security_group_ids               = [aws_security_group.CSITSG.id]
   # host_id                            = "1"
 
-  root_block_device {
-    volume_size = 50
-  }
+#  root_block_device {
+#    volume_size = 50
+#  }
 
   tags = {
     "Name"        = "${var.resources_name_prefix}_${var.testbed_name}-tg"
@@ -244,23 +308,28 @@ resource "aws_instance" "tg" {
 }
 
 resource "aws_instance" "dut1" {
-  depends_on                           = [aws_vpc.CSITVPC, aws_placement_group.CSITPG, aws_instance.tg]
+  depends_on                           = [
+    aws_vpc.CSITVPC,
+    aws_placement_group.CSITPG,
+    aws_security_group.CSITSG,
+    aws_instance.tg
+  ]
   ami                                  = var.ami_image_sut
   availability_zone                    = var.avail_zone
+  associate_public_ip_address          = true
   instance_initiated_shutdown_behavior = var.instance_initiated_shutdown_behavior
   instance_type                        = var.instance_type
   key_name                             = aws_key_pair.CSITKP.key_name
-  associate_public_ip_address          = true
-  subnet_id                            = aws_subnet.mgmt.id
-  private_ip                           = var.dut1_mgmt_ip
-  vpc_security_group_ids               = [aws_security_group.CSITSG.id]
   placement_group                      = aws_placement_group.CSITPG.id
+  private_ip                           = var.dut1_mgmt_ip
   source_dest_check                    = false
+  subnet_id                            = aws_subnet.mgmt.id
+  vpc_security_group_ids               = [aws_security_group.CSITSG.id]
   # host_id                            = "2"
 
-  root_block_device {
-    volume_size = 50
-  }
+#  root_block_device {
+#    volume_size = 50
+#  }
 
   tags = {
     "Name"        = "${var.resources_name_prefix}_${var.testbed_name}-dut1"
@@ -270,24 +339,33 @@ resource "aws_instance" "dut1" {
 
 # Routes
 resource "aws_route" "CSIT-igw" {
-  route_table_id         = aws_vpc.CSITVPC.main_route_table_id
-  gateway_id             = aws_internet_gateway.CSITGW.id
+  depends_on             = [
+    aws_vpc.CSITVPC,
+    aws_internet_gateway.CSITGW
+  ]
   destination_cidr_block = "0.0.0.0/0"
-  depends_on             = [aws_vpc.CSITVPC, aws_internet_gateway.CSITGW]
+  gateway_id             = aws_internet_gateway.CSITGW.id
+  route_table_id         = aws_vpc.CSITVPC.main_route_table_id
 }
 
 resource "aws_route" "dummy-trex-port-0" {
-  route_table_id         = aws_vpc.CSITVPC.main_route_table_id
-  network_interface_id   = aws_instance.tg.primary_network_interface_id
+  depends_on             = [
+    aws_vpc.CSITVPC,
+    aws_instance.dut1
+  ]
   destination_cidr_block = var.trex_dummy_cidr_port_0
-  depends_on             = [aws_vpc.CSITVPC, aws_instance.dut1]
+  network_interface_id   = aws_instance.tg.primary_network_interface_id
+  route_table_id         = aws_vpc.CSITVPC.main_route_table_id
 }
 
 resource "aws_route" "dummy-trex-port-1" {
-  route_table_id         = aws_vpc.CSITVPC.main_route_table_id
-  network_interface_id   = aws_instance.tg.primary_network_interface_id
+  depends_on             = [
+    aws_vpc.CSITVPC,
+    aws_instance.dut1
+  ]
   destination_cidr_block = var.trex_dummy_cidr_port_1
-  depends_on             = [aws_vpc.CSITVPC, aws_instance.dut1]
+  network_interface_id   = aws_instance.tg.primary_network_interface_id
+  route_table_id         = aws_vpc.CSITVPC.main_route_table_id
 }
 
 # Deployment/Ansible
@@ -307,10 +385,10 @@ resource "null_resource" "deploy_tg" {
     private_key = tls_private_key.CSITTLS.private_key_pem
   }
 
-#  provisioner "remote-exec" {
-#    inline = var.first_run_commands
-#  }
-#
+  provisioner "remote-exec" {
+    inline = var.first_run_commands
+  }
+
 #  provisioner "ansible" {
 #    plays {
 #      playbook {
@@ -348,10 +426,10 @@ resource "null_resource" "deploy_dut1" {
     private_key = tls_private_key.CSITTLS.private_key_pem
   }
 
-#  provisioner "remote-exec" {
-#    inline = var.first_run_commands
-#  }
-#
+  provisioner "remote-exec" {
+    inline = var.first_run_commands
+  }
+
 #  provisioner "ansible" {
 #    plays {
 #      playbook {
@@ -374,7 +452,10 @@ resource "null_resource" "deploy_dut1" {
 }
 
 resource "null_resource" "deploy_topology" {
-  depends_on = [aws_instance.tg, aws_instance.dut1]
+  depends_on = [
+    aws_instance.tg,
+    aws_instance.dut1
+  ]
 
   provisioner "ansible" {
     plays {