github_actions_assume_role_policy lifecycle error: Data resources do not have lifecycle settings, so a lifecycle block is not allowed

[swb-buildarchetype]

Anyone else experience this while upgrading modules in the reference architecture?

[ecs-deploy-runner][2024-01-05T23:30:12+0000] Downloading git::git@github.com:gruntwork-io/terraform-aws-security.git?ref=v0.69.0 for kms_grants...
[ecs-deploy-runner][2024-01-05T23:30:12+0000] - kms_grants in .terraform/modules/kms_grants/modules/kms-grant-multi-region
[ecs-deploy-runner][2024-01-05T23:30:13+0000] There are some problems with the configuration, described below.
[ecs-deploy-runner][2024-01-05T23:30:13+0000] The Terraform configuration must be valid before initialization so that
[ecs-deploy-runner][2024-01-05T23:30:13+0000] Terraform can determine which modules and providers need to be installed.
[ecs-deploy-runner][2024-01-05T23:30:13+0000] ╷
[ecs-deploy-runner][2024-01-05T23:30:13+0000] │ Error: Unsupported lifecycle block
[ecs-deploy-runner][2024-01-05T23:30:13+0000] │ 
[ecs-deploy-runner][2024-01-05T23:30:13+0000] │   on .terraform/modules/iam_cross_account_roles/modules/github-actions-iam-role/main.tf line 42, in data "aws_iam_policy_document" "github_actions_assume_role_policy":
[ecs-deploy-runner][2024-01-05T23:30:13+0000] │   42:   lifecycle {
[ecs-deploy-runner][2024-01-05T23:30:13+0000] │ 
[ecs-deploy-runner][2024-01-05T23:30:13+0000] │ Data resources do not have lifecycle settings, so a lifecycle block is not
[ecs-deploy-runner][2024-01-05T23:30:13+0000] │ allowed.
[ecs-deploy-runner][2024-01-05T23:30:13+0000] ╵
[ecs-deploy-runner][2024-01-05T23:30:13+0000] 
[ecs-deploy-runner][2024-01-05T23:30:13+0000] time=2024-01-05T23:30:13Z level=error msg=1 error occurred:
[ecs-deploy-runner][2024-01-05T23:30:13+0000]   * exit status 1
[ecs-deploy-runner][2024-01-05T23:30:13+0000] [INFO] [infrastructure-deploy-script] 2024-01-05 23:30:13  "terragrunt plan" exited with code 1
[ecs-deploy-runner][2024-01-05T23:30:13+0000] Error: Could not run "terragrunt plan"
[ecs-deploy-runner][2024-01-05T23:30:13+0000] exit status 1
[ecs-deploy-runner][2024-01-05T23:30:13+0000] ERROR: exit status 1
ERROR: Deployment failed
Deploying dev/_global/route53-public

This is the key, but this is nowhere in my modules, so is clearly a deeply buried dependency:

[ecs-deploy-runner][2024-01-05T23:30:13+0000] ╷
[ecs-deploy-runner][2024-01-05T23:30:13+0000] │ Error: Unsupported lifecycle block
[ecs-deploy-runner][2024-01-05T23:30:13+0000] │ 
[ecs-deploy-runner][2024-01-05T23:30:13+0000] │   on .terraform/modules/iam_cross_account_roles/modules/github-actions-iam-role/main.tf line 42, in data "aws_iam_policy_document" "github_actions_assume_role_policy":
[ecs-deploy-runner][2024-01-05T23:30:13+0000] │   42:   lifecycle {
[ecs-deploy-runner][2024-01-05T23:30:13+0000] │ 
[ecs-deploy-runner][2024-01-05T23:30:13+0000] │ Data resources do not have lifecycle settings, so a lifecycle block is not
[ecs-deploy-runner][2024-01-05T23:30:13+0000] │ allowed.

---

Tracked in ticket #110681

[yhakbar]

Hey @swbmindcycle ,

It looks like the root cause of the issue that you're experiencing is that you're using an older version of Terraform than 1.2. Is that the case? It looks like that lifecycle block was introduced in the release of v0.69.0

This is called out in the release notes:

This release bumps up the minimum required version of Terraform to at least v1.2. This should not cause any issues in any of the modules above but would require the consumers of those modules to also bump their minimum version of Terraform in they were previously using versions before v1.2. All code changes to the modules above are backwards compatible otherwise.

[yhakbar]

From @swbmindcycle in Slack:

Thanks for that, Yousif
I'm a bit new to Terragrunt. Helping a client out with upgrades after two years of no changes. To be clear -- the RefArch instructions for updating current version of terraform includes adding a terraform-version file in each module that is deployed? Originally I went to utilize the terraform-version file at the base, but I can see now that each module is compiled separately. By default there is no terraform-version file in each module -- at least not in the repos I'm working in. Is there some way to define the version once in the reference architecture?

[yhakbar]

The .terraform-version file is used by tfenv and related tools, it's not something that Terragrunt handles directly. If you're using a different version of Terraform than what you expect, you may have to copy the .terraform-version into the directory where you run terragrunt.

[swb-buildarchetype]

Makes sense. So in the case of a 2 year old deployment of the reference architecture this would likely be each module directory within a given account. I think this is where I had a gap in understanding previously. The Circle CI config appears to run terragrunt plan on every module directory that it detects a change in. So this .terragrunt-version file should exist with every module at the same level as the terragrunt.hcl file. Does that sound right?

[yhakbar]

Yup! Note that hidden files aren't copied into the .terragrunt-cache directory created by terragrunt by default. To address that, you will need to add the following include_in_copy configuration to your terraform block:
https://terragrunt.gruntwork.io/docs/reference/config-blocks-and-attributes/

Alternatively, you can utilize the TFENV_TERRAFORM_VERSION environment variable like so:

TFENV_TERRAFORM_VERSION=1.5.7

To ensure that the desired version is used without having to duplicate the file everywhere. That would require that you update the environment variable configurations for your CircleCI config.

[swb-buildarchetype]

Got it. Given how many modules there are seems it would be easier to just set the terraform version in CircleCI config. But that wouldn't allow for versioning different modules with different TF versions. Will think on this. Thanks for your help.

[swb-buildarchetype]

Reopening -- attempted the include_in_copy addition to the terraform block in the terragrunt.hcl file at the root of the module. Also bumped ECS-cluster module to latest. Got an error indicating that the include_in_copy wasn't expected. Not sure if there is some other upstream dependency that I need to be adjusting accordingly as well? For context this is deployed via the legacy ref arch

[swb-buildarchetype]

@yhakbar can you please advise? None of the inputs you shared worked. What am I missing? tfenv_terraform_version doesn't seem to change anything when applied as an environmental variable in circle ci config. include_in_copy is unexpected by all modules I have attempted to use from the service catalog.