fix(Terraform): Bug fixes and lint tweaks

+ Remove few WARN
+ Sort keys in .hcl
+ Fix provisioning
+ Lint tweaks

Signed-off-by: pmikus <pmikus@cisco.com>
Change-Id: I6e07cb5ceb7416209185b43342dc19017f1472d8

1 files changed, 220 insertions, 139 deletions

diff --git a/fdio.infra.terraform/3n_aws_c5n/deploy/main.tf b/fdio.infra.terraform/3n_aws_c5n/deploy/main.tf
index 073768d5b0..05c7e32862 100644
--- a/fdio.infra.terraform/3n_aws_c5n/deploy/main.tf
+++ b/fdio.infra.terraform/3n_aws_c5n/deploy/main.tf
@@ -4,7 +4,11 @@ data "vault_aws_access_credentials" "creds" {
 }
 
 resource "aws_vpc" "CSITVPC" {
-  cidr_block = var.vpc_cidr_mgmt
+  assign_generated_ipv6_cidr_block = false
+  enable_dns_hostnames             = false
+  enable_dns_support               = true
+  cidr_block                       = var.vpc_cidr_mgmt
+  instance_tenancy                 = "default"
 
   tags = {
     "Name"        = "${var.resources_name_prefix}_${var.testbed_name}-vpc"
@@ -13,30 +17,36 @@ resource "aws_vpc" "CSITVPC" {
 }
 
 resource "aws_security_group" "CSITSG" {
-  name        = "${var.resources_name_prefix}_${var.testbed_name}-sg"
-  description = "Allow inbound traffic"
-  vpc_id      = aws_vpc.CSITVPC.id
-  depends_on  = [aws_vpc.CSITVPC]
+  depends_on                       = [
+    aws_vpc.CSITVPC
+  ]
+  description                      = "Allow inbound traffic"
+  name                             = "${var.resources_name_prefix}_${var.testbed_name}-sg"
+  revoke_rules_on_delete           = false
+  vpc_id                           = aws_vpc.CSITVPC.id
 
   ingress {
-    from_port   = 22
-    to_port     = 22
-    protocol    = "tcp"
-    cidr_blocks = ["0.0.0.0/0"]
+    from_port        = 22
+    to_port          = 22
+    protocol         = "tcp"
+    cidr_blocks      = ["0.0.0.0/0"]
+    ipv6_cidr_blocks = []
   }
 
   ingress {
-    from_port = 0
-    to_port   = 0
-    protocol  = -1
-    self      = true
+    from_port        = 0
+    to_port          = 0
+    protocol         = -1
+    self             = true
+    ipv6_cidr_blocks = []
   }
 
   egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
+    from_port        = 0
+    to_port          = 0
+    protocol         = "-1"
+    cidr_blocks      = ["0.0.0.0/0"]
+    ipv6_cidr_blocks = []
   }
 
   tags = {
@@ -46,52 +56,77 @@ resource "aws_security_group" "CSITSG" {
 }
 
 resource "aws_vpc_ipv4_cidr_block_association" "b" {
-  vpc_id     = aws_vpc.CSITVPC.id
+  depends_on = [
+    aws_vpc.CSITVPC
+  ]
   cidr_block = var.vpc_cidr_b
-  depends_on = [aws_vpc.CSITVPC]
+  vpc_id     = aws_vpc.CSITVPC.id
 }
+
 resource "aws_vpc_ipv4_cidr_block_association" "c" {
-  vpc_id     = aws_vpc.CSITVPC.id
+  depends_on = [
+    aws_vpc.CSITVPC
+  ]
   cidr_block = var.vpc_cidr_c
-  depends_on = [aws_vpc.CSITVPC]
+  vpc_id     = aws_vpc.CSITVPC.id
 }
+
 resource "aws_vpc_ipv4_cidr_block_association" "d" {
-  vpc_id     = aws_vpc.CSITVPC.id
+  depends_on = [
+    aws_vpc.CSITVPC
+  ]
   cidr_block = var.vpc_cidr_d
-  depends_on = [aws_vpc.CSITVPC]
+  vpc_id     = aws_vpc.CSITVPC.id
 }
 
 # Subnets
 resource "aws_subnet" "mgmt" {
-  vpc_id            = aws_vpc.CSITVPC.id
-  cidr_block        = var.vpc_cidr_mgmt
-  availability_zone = var.avail_zone
-  depends_on        = [aws_vpc.CSITVPC]
+  availability_zone               = var.avail_zone
+  assign_ipv6_address_on_creation = false
+  cidr_block                      = var.vpc_cidr_mgmt
+  depends_on                      = [
+    aws_vpc.CSITVPC
+  ]
+  map_public_ip_on_launch         = false
+  vpc_id                          = aws_vpc.CSITVPC.id
 
   tags = {
     "Environment" = var.environment_name
   }
 }
+
 resource "aws_subnet" "b" {
-  vpc_id            = aws_vpc.CSITVPC.id
-  cidr_block        = var.vpc_cidr_b
-  availability_zone = var.avail_zone
-  depends_on        = [aws_vpc.CSITVPC, aws_vpc_ipv4_cidr_block_association.b]
+  availability_zone               = var.avail_zone
+  assign_ipv6_address_on_creation = false
+  cidr_block                      = var.vpc_cidr_b
+  depends_on                      = [
+    aws_vpc.CSITVPC,
+    aws_vpc_ipv4_cidr_block_association.b
+  ]
+  map_public_ip_on_launch         = false
+  vpc_id                          = aws_vpc.CSITVPC.id
 
   tags = {
     "Environment" = var.environment_name
   }
 }
+
 resource "aws_subnet" "c" {
-  vpc_id            = aws_vpc.CSITVPC.id
-  cidr_block        = var.vpc_cidr_c
-  availability_zone = var.avail_zone
-  depends_on        = [aws_vpc.CSITVPC, aws_vpc_ipv4_cidr_block_association.c]
+  availability_zone               = var.avail_zone
+  assign_ipv6_address_on_creation = false
+  cidr_block                      = var.vpc_cidr_c
+  depends_on                      = [
+    aws_vpc.CSITVPC,
+    aws_vpc_ipv4_cidr_block_association.c
+  ]
+  map_public_ip_on_launch         = false
+  vpc_id                          = aws_vpc.CSITVPC.id
 
   tags = {
     "Environment" = var.environment_name
   }
 }
+
 resource "aws_subnet" "d" {
   vpc_id            = aws_vpc.CSITVPC.id
   cidr_block        = var.vpc_cidr_d
@@ -103,9 +138,16 @@ resource "aws_subnet" "d" {
   }
 }
 
-resource "aws_internet_gateway" "CSITGW" {
-  vpc_id     = aws_vpc.CSITVPC.id
-  depends_on = [aws_vpc.CSITVPC]
+resource "aws_subnet" "d" {
+  availability_zone               = var.avail_zone
+  assign_ipv6_address_on_creation = false
+  cidr_block                      = var.vpc_cidr_d
+  depends_on                      = [
+    aws_vpc.CSITVPC,
+    aws_vpc_ipv4_cidr_block_association.d
+  ]
+  map_public_ip_on_launch         = false
+  vpc_id                          = aws_vpc.CSITVPC.id
 
   tags = {
     "Environment" = var.environment_name
@@ -115,12 +157,14 @@ resource "aws_internet_gateway" "CSITGW" {
 # SSH keypair
 # Temporary key for provisioning only
 resource "tls_private_key" "CSITTLS" {
-  algorithm = "RSA"
-  rsa_bits  = 4096
+  algorithm   = "RSA"
+  ecdsa_curve = "P521"
+  rsa_bits    = 4096
 }
+
 resource "aws_key_pair" "CSITKP" {
-  key_name   = "CSIT_3n_aws_c5n_${var.testbed_name}-key"
-  public_key = tls_private_key.CSITTLS.public_key_openssh
+  key_name   = "${var.resources_name_prefix}_${var.testbed_name}-key"
+  public_key = "${tls_private_key.CSITTLS.public_key_openssh}"
 }
 
 resource "aws_placement_group" "CSITPG" {
@@ -130,12 +174,16 @@ resource "aws_placement_group" "CSITPG" {
 
 # NICs
 resource "aws_network_interface" "dut1_if1" {
-  subnet_id         = aws_subnet.b.id
-  source_dest_check = false
+  depends_on        = [
+    aws_vpc.CSITVPC,
+    aws_subnet.b,
+    aws_instance.dut1
+  ]
   private_ip        = var.dut1_if1_ip
   private_ips       = [var.dut1_if1_ip]
   security_groups   = [aws_security_group.CSITSG.id]
-  depends_on        = [aws_vpc.CSITVPC, aws_subnet.b, aws_instance.dut1]
+  source_dest_check = false
+  subnet_id         = aws_subnet.b.id
 
   attachment {
     instance     = aws_instance.dut1.id
@@ -148,12 +196,16 @@ resource "aws_network_interface" "dut1_if1" {
 }
 
 resource "aws_network_interface" "dut1_if2" {
-  subnet_id         = aws_subnet.c.id
-  source_dest_check = false
+  depends_on        = [
+    aws_vpc.CSITVPC,
+    aws_subnet.c,
+    aws_instance.dut1
+  ]
   private_ip        = var.dut1_if2_ip
   private_ips       = [var.dut1_if2_ip]
   security_groups   = [aws_security_group.CSITSG.id]
-  depends_on        = [aws_vpc.CSITVPC, aws_subnet.c, aws_instance.dut1]
+  source_dest_check = false
+  subnet_id         = aws_subnet.c.id
 
   attachment {
     instance     = aws_instance.dut1.id
@@ -166,16 +218,20 @@ resource "aws_network_interface" "dut1_if2" {
 }
 
 resource "aws_network_interface" "dut2_if1" {
-  subnet_id         = aws_subnet.c.id
-  source_dest_check = false
-  private_ip        = var.dut2_if1_ip
-  private_ips       = [var.dut2_if1_ip]
+  depends_on        = [
+    aws_vpc.CSITVPC,
+    aws_subnet.c,
+    aws_instance.dut2
+  ]
+  private_ip        = var.dut2_if2_ip
+  private_ips       = [var.dut2_if2_ip]
   security_groups   = [aws_security_group.CSITSG.id]
-  depends_on        = [aws_vpc.CSITVPC, aws_subnet.c, aws_instance.dut2]
+  source_dest_check = false
+  subnet_id         = aws_subnet.c.id
 
   attachment {
     instance     = aws_instance.dut2.id
-    device_index = 1
+    device_index = 2
   }
 
   tags = {
@@ -184,12 +240,16 @@ resource "aws_network_interface" "dut2_if1" {
 }
 
 resource "aws_network_interface" "dut2_if2" {
-  subnet_id         = aws_subnet.d.id
-  source_dest_check = false
+  depends_on        = [
+    aws_vpc.CSITVPC,
+    aws_subnet.d,
+    aws_instance.dut2
+  ]
   private_ip        = var.dut2_if2_ip
   private_ips       = [var.dut2_if2_ip]
   security_groups   = [aws_security_group.CSITSG.id]
-  depends_on        = [aws_vpc.CSITVPC, aws_subnet.d, aws_instance.dut2]
+  source_dest_check = false
+  subnet_id         = aws_subnet.d.id
 
   attachment {
     instance     = aws_instance.dut2.id
@@ -202,12 +262,16 @@ resource "aws_network_interface" "dut2_if2" {
 }
 
 resource "aws_network_interface" "tg_if1" {
-  subnet_id         = aws_subnet.b.id
-  source_dest_check = false
+  depends_on        = [
+    aws_vpc.CSITVPC,
+    aws_subnet.b,
+    aws_instance.tg
+  ]
   private_ip        = var.tg_if1_ip
   private_ips       = [var.tg_if1_ip]
   security_groups   = [aws_security_group.CSITSG.id]
-  depends_on        = [aws_vpc.CSITVPC, aws_subnet.b, aws_instance.tg]
+  source_dest_check = false
+  subnet_id         = aws_subnet.b.id
 
   attachment {
     instance     = aws_instance.tg.id
@@ -220,12 +284,16 @@ resource "aws_network_interface" "tg_if1" {
 }
 
 resource "aws_network_interface" "tg_if2" {
-  subnet_id         = aws_subnet.d.id
-  source_dest_check = false
+  depends_on        = [
+    aws_vpc.CSITVPC,
+    aws_subnet.d,
+    aws_instance.tg
+  ]
   private_ip        = var.tg_if2_ip
   private_ips       = [var.tg_if2_ip]
   security_groups   = [aws_security_group.CSITSG.id]
-  depends_on        = [aws_vpc.CSITVPC, aws_subnet.d, aws_instance.tg]
+  source_dest_check = false
+  subnet_id         = aws_subnet.d.id
 
   attachment {
     instance     = aws_instance.tg.id
@@ -263,27 +331,27 @@ data "aws_network_interface" "tg_if2" {
 
 # Instances
 resource "aws_instance" "tg" {
+  depends_on                           = [
+    aws_vpc.CSITVPC,
+    aws_placement_group.CSITPG,
+    aws_security_group.CSITSG
+  ]
   ami                                  = var.ami_image_tg
   availability_zone                    = var.avail_zone
+  associate_public_ip_address          = true
   instance_initiated_shutdown_behavior = var.instance_initiated_shutdown_behavior
   instance_type                        = var.instance_type
   key_name                             = aws_key_pair.CSITKP.key_name
-  associate_public_ip_address          = true
-  subnet_id                            = aws_subnet.mgmt.id
-  private_ip                           = var.tg_mgmt_ip
-  vpc_security_group_ids               = [aws_security_group.CSITSG.id]
   placement_group                      = aws_placement_group.CSITPG.id
+  private_ip                           = var.tg_mgmt_ip
   source_dest_check                    = false
+  subnet_id                            = aws_subnet.mgmt.id
+  vpc_security_group_ids               = [aws_security_group.CSITSG.id]
   # host_id                            = "1"
 
-  depends_on = [
-    aws_vpc.CSITVPC,
-    aws_placement_group.CSITPG,
-  ]
-
-  root_block_device {
-    volume_size = 50
-  }
+#  root_block_device {
+#    volume_size = 50
+#  }
 
   tags = {
     "Name"        = "${var.resources_name_prefix}_${var.testbed_name}-tg"
@@ -292,28 +360,27 @@ resource "aws_instance" "tg" {
 }
 
 resource "aws_instance" "dut1" {
+  depends_on = [
+    aws_vpc.CSITVPC,
+    aws_placement_group.CSITPG,
+    aws_instance.tg
+  ]
   ami                                  = var.ami_image_sut
   availability_zone                    = var.avail_zone
+  associate_public_ip_address          = true
   instance_initiated_shutdown_behavior = var.instance_initiated_shutdown_behavior
   instance_type                        = var.instance_type
   key_name                             = aws_key_pair.CSITKP.key_name
-  associate_public_ip_address          = true
-  subnet_id                            = aws_subnet.mgmt.id
-  private_ip                           = var.dut1_mgmt_ip
-  vpc_security_group_ids               = [aws_security_group.CSITSG.id]
   placement_group                      = aws_placement_group.CSITPG.id
+  private_ip                           = var.dut1_mgmt_ip
   source_dest_check                    = false
+  subnet_id                            = aws_subnet.mgmt.id
+  vpc_security_group_ids               = [aws_security_group.CSITSG.id]
   # host_id                            = "2"
 
-  depends_on = [
-    aws_vpc.CSITVPC,
-    aws_placement_group.CSITPG,
-    aws_instance.tg
-  ]
-
-  root_block_device {
-    volume_size = 50
-  }
+#  root_block_device {
+#    volume_size = 50
+#  }
 
   tags = {
     "Name"        = "${var.resources_name_prefix}_${var.testbed_name}-dut1"
@@ -322,29 +389,28 @@ resource "aws_instance" "dut1" {
 }
 
 resource "aws_instance" "dut2" {
+  depends_on = [
+    aws_vpc.CSITVPC,
+    aws_placement_group.CSITPG,
+    aws_instance.tg,
+    aws_instance.dut1
+  ]
   ami                                  = var.ami_image_sut
   availability_zone                    = var.avail_zone
+  associate_public_ip_address          = true
   instance_initiated_shutdown_behavior = var.instance_initiated_shutdown_behavior
   instance_type                        = var.instance_type
   key_name                             = aws_key_pair.CSITKP.key_name
-  associate_public_ip_address          = true
-  subnet_id                            = aws_subnet.mgmt.id
-  private_ip                           = var.dut2_mgmt_ip
-  vpc_security_group_ids               = [aws_security_group.CSITSG.id]
   placement_group                      = aws_placement_group.CSITPG.id
+  private_ip                           = var.dut2_mgmt_ip
   source_dest_check                    = false
+  subnet_id                            = aws_subnet.mgmt.id
+  vpc_security_group_ids               = [aws_security_group.CSITSG.id]
   # host_id                            = "3"
 
-  depends_on = [
-    aws_vpc.CSITVPC,
-    aws_placement_group.CSITPG,
-    aws_instance.tg,
-    aws_instance.dut1
-  ]
-
-  root_block_device {
-    volume_size = 50
-  }
+#  root_block_device {
+#    volume_size = 50
+#  }
 
   tags = {
     "Name"        = "${var.resources_name_prefix}_${var.testbed_name}-dut2"
@@ -354,22 +420,33 @@ resource "aws_instance" "dut2" {
 
 # Routes
 resource "aws_route" "CSIT-igw" {
-  route_table_id         = aws_vpc.CSITVPC.main_route_table_id
-  gateway_id             = aws_internet_gateway.CSITGW.id
+  depends_on             = [
+    aws_vpc.CSITVPC,
+    aws_internet_gateway.CSITGW
+  ]
   destination_cidr_block = "0.0.0.0/0"
-  depends_on             = [aws_vpc.CSITVPC, aws_internet_gateway.CSITGW]
+  gateway_id             = aws_internet_gateway.CSITGW.id
+  route_table_id         = aws_vpc.CSITVPC.main_route_table_id
 }
+
 resource "aws_route" "dummy-trex-port-0" {
-  route_table_id         = aws_vpc.CSITVPC.main_route_table_id
-  network_interface_id   = aws_instance.tg.primary_network_interface_id
+  depends_on             = [
+    aws_vpc.CSITVPC,
+    aws_instance.dut1
+  ]
   destination_cidr_block = var.trex_dummy_cidr_port_0
-  depends_on             = [aws_vpc.CSITVPC, aws_instance.dut1]
+  network_interface_id   = aws_instance.tg.primary_network_interface_id
+  route_table_id         = aws_vpc.CSITVPC.main_route_table_id
 }
+
 resource "aws_route" "dummy-trex-port-1" {
-  route_table_id         = aws_vpc.CSITVPC.main_route_table_id
-  network_interface_id   = aws_instance.tg.primary_network_interface_id
+  depends_on             = [
+    aws_vpc.CSITVPC,
+    aws_instance.dut1
+  ]
   destination_cidr_block = var.trex_dummy_cidr_port_1
-  depends_on             = [aws_vpc.CSITVPC, aws_instance.dut1]
+  network_interface_id   = aws_instance.tg.primary_network_interface_id
+  route_table_id         = aws_vpc.CSITVPC.main_route_table_id
 }
 
 # Deployment/Ansible
@@ -396,25 +473,25 @@ resource "null_resource" "deploy_tg" {
     inline = var.first_run_commands
   }
 
-  provisioner "ansible" {
-    plays {
-      playbook {
-        file_path      = var.ansible_file_path
-        force_handlers = true
-      }
-      hosts = ["tg_aws"]
-      extra_vars = {
-        ansible_ssh_pass           = var.ansible_provision_pwd
-        ansible_python_interpreter = var.ansible_python_executable
-        aws                        = true
-      }
-    }
-  }
-
-  provisioner "remote-exec" {
-    on_failure = continue
-    inline     = ["sudo reboot"]
-  }
+#  provisioner "ansible" {
+#    plays {
+#      playbook {
+#        file_path      = var.ansible_file_path
+#        force_handlers = true
+#      }
+#      hosts = ["tg_aws"]
+#      extra_vars = {
+#        ansible_ssh_pass           = var.ansible_provision_pwd
+#        ansible_python_interpreter = var.ansible_python_executable
+#        aws                        = true
+#      }
+#    }
+#  }
+#
+#  provisioner "remote-exec" {
+#    on_failure = continue
+#    inline     = ["sudo reboot"]
+#  }
 }
 
 resource "null_resource" "deploy_dut1" {
@@ -436,10 +513,10 @@ resource "null_resource" "deploy_dut1" {
     private_key = tls_private_key.CSITTLS.private_key_pem
   }
 
-#  provisioner "remote-exec" {
-#    inline = var.first_run_commands
-#  }
-#
+  provisioner "remote-exec" {
+    inline = var.first_run_commands
+  }
+
 #  provisioner "ansible" {
 #    plays {
 #      playbook {
@@ -480,10 +557,10 @@ resource "null_resource" "deploy_dut2" {
     private_key = tls_private_key.CSITTLS.private_key_pem
   }
 
-#  provisioner "remote-exec" {
-#    inline = var.first_run_commands
-#  }
-#
+  provisioner "remote-exec" {
+    inline = var.first_run_commands
+  }
+
 #  provisioner "ansible" {
 #    plays {
 #      playbook {
@@ -506,7 +583,11 @@ resource "null_resource" "deploy_dut2" {
 }
 
 resource "null_resource" "deploy_topology" {
-  depends_on = [aws_instance.tg, aws_instance.dut1, aws_instance.dut2]
+  depends_on = [
+    aws_instance.tg,
+    aws_instance.dut1,
+    aws_instance.dut2
+  ]
 
   provisioner "ansible" {
     plays {