Replace deprecated "template_file" resource for "templatefile" function.

examples/vault-agent/main.tf

@@ -24,7 +24,15 @@ resource "aws_instance" "example_auth_to_vault" {
     aws_security_group.auth_instance.id,
   ]
 
-  user_data            = data.template_file.user_data_auth_client.rendered
+  # The user data script that will run on the instance
+  # This script will run consul, which is used for discovering vault cluster
+  # And perform the login operation
+  user_data            = templatefile("${path.module}/user-data-auth-client.sh", {
+    consul_cluster_tag_key   = var.consul_cluster_tag_key
+    consul_cluster_tag_value = var.consul_cluster_name
+    example_role_name        = var.example_role_name
+  })
+
   iam_instance_profile = aws_iam_instance_profile.example_instance_profile.name
 
   tags = {
@@ -66,22 +74,6 @@ module "consul_iam_policies_for_client" {
   iam_role_id = aws_iam_role.example_instance_role.id
 }
 
-# ---------------------------------------------------------------------------------------------------------------------
-# THE USER DATA SCRIPT THAT WILL RUN ON THE INSTANCE
-# This script will run consul, which is used for discovering vault cluster
-# And perform the login operation
-# ---------------------------------------------------------------------------------------------------------------------
-
-data "template_file" "user_data_auth_client" {
-  template = file("${path.module}/user-data-auth-client.sh")
-
-  vars = {
-    consul_cluster_tag_key   = var.consul_cluster_tag_key
-    consul_cluster_tag_value = var.consul_cluster_name
-    example_role_name        = var.example_role_name
-  }
-}
-
 # ---------------------------------------------------------------------------------------------------------------------
 # ADDS A RULE TO OPEN PORT 8080 SINCE OUR EXAMPLE LAUNCHES A SIMPLE WEB SERVER
 # This is here just for automated tests, not something that should be done with prod
@@ -148,7 +140,18 @@ module "vault_cluster" {
   instance_type = var.vault_instance_type
 
   ami_id    = var.ami_id
-  user_data = data.template_file.user_data_vault_cluster.rendered
+
+  # The user data script that will run on each Vault server when it's booting
+  # This script will configure and start Vault
+  user_data = templatefile("${path.module}/user-data-vault.sh", {
+    consul_cluster_tag_key   = var.consul_cluster_tag_key
+    consul_cluster_tag_value = var.consul_cluster_name
+    example_role_name        = var.example_role_name
+    # Please note that normally we would never pass a secret this way
+    # This is just for test purposes so we can verify that our example instance is authenticating correctly
+    example_secret           = var.example_secret
+    aws_iam_role_arn         = aws_iam_role.example_instance_role.arn
+  })
 
   vpc_id     = data.aws_vpc.default.id
   subnet_ids = data.aws_subnet_ids.default.ids
@@ -175,25 +178,6 @@ module "consul_iam_policies_servers" {
   iam_role_id = module.vault_cluster.iam_role_id
 }
 
-# ---------------------------------------------------------------------------------------------------------------------
-# THE USER DATA SCRIPT THAT WILL RUN ON EACH VAULT SERVER WHEN IT'S BOOTING
-# This script will configure and start Vault
-# ---------------------------------------------------------------------------------------------------------------------
-
-data "template_file" "user_data_vault_cluster" {
-  template = file("${path.module}/user-data-vault.sh")
-
-  vars = {
-    consul_cluster_tag_key   = var.consul_cluster_tag_key
-    consul_cluster_tag_value = var.consul_cluster_name
-    example_role_name        = var.example_role_name
-    # Please note that normally we would never pass a secret this way
-    # This is just for test purposes so we can verify that our example instance is authenticating correctly
-    example_secret   = var.example_secret
-    aws_iam_role_arn = aws_iam_role.example_instance_role.arn
-  }
-}
-
 # ---------------------------------------------------------------------------------------------------------------------
 # PERMIT CONSUL SPECIFIC TRAFFIC IN VAULT CLUSTER
 # To allow our Vault servers consul agents to communicate with other consul agents and participate in the LAN gossip,
@@ -227,7 +211,12 @@ module "consul_cluster" {
   cluster_tag_value = var.consul_cluster_name
 
   ami_id    = var.ami_id
-  user_data = data.template_file.user_data_consul.rendered
+  # The user data script that will run o eacht consul server when it's booting
+  # This script will configure and start Consul
+  user_data = templatefile("${path.module}/user-data-consul.sh", {
+    consul_cluster_tag_key= var.consul_cluster_tag_key
+    consul_cluster_tag_value = var.consul_cluster_name
+  })
 
   vpc_id     = data.aws_vpc.default.id
   subnet_ids = data.aws_subnet_ids.default.ids
@@ -240,20 +229,6 @@ module "consul_cluster" {
   ssh_key_name                = var.ssh_key_name
 }
 
-# ---------------------------------------------------------------------------------------------------------------------
-# THE USER DATA SCRIPT THAT WILL RUN ON EACH CONSUL SERVER WHEN IT'S BOOTING
-# This script will configure and start Consul
-# ---------------------------------------------------------------------------------------------------------------------
-
-data "template_file" "user_data_consul" {
-  template = file("${path.module}/user-data-consul.sh")
-
-  vars = {
-    consul_cluster_tag_key   = var.consul_cluster_tag_key
-    consul_cluster_tag_value = var.consul_cluster_name
-  }
-}
-
 # ---------------------------------------------------------------------------------------------------------------------
 # DEPLOY THE CLUSTERS IN THE DEFAULT VPC AND AVAILABILITY ZONES
 # Using the default VPC and subnets makes this example easy to run and test, but it means Consul and Vault are
@@ -272,4 +247,3 @@ data "aws_subnet_ids" "default" {
 
 data "aws_region" "current" {
 }
-

examples/vault-auto-unseal/main.tf

@@ -27,7 +27,15 @@ module "vault_cluster" {
   instance_type = var.vault_instance_type
 
   ami_id    = var.ami_id
-  user_data = data.template_file.user_data_vault_cluster.rendered
+
+  # The user data script that will run on each vault server when it's booting
+  # This script will configure and start Vault
+  user_data = templatefile("${path.module}/user-data-vault.sh", {
+    consul_cluster_tag_key   = var.consul_cluster_tag_key
+    consul_cluster_tag_value = var.consul_cluster_name
+    kms_key_id               = data.aws_kms_alias.vault-example.target_key_id
+    aws_region               = data.aws_region.current.name
+  })
 
   vpc_id     = data.aws_vpc.default.id
   subnet_ids = data.aws_subnet_ids.default.ids
@@ -60,22 +68,6 @@ module "consul_iam_policies_servers" {
   iam_role_id = module.vault_cluster.iam_role_id
 }
 
-# ---------------------------------------------------------------------------------------------------------------------
-# THE USER DATA SCRIPT THAT WILL RUN ON EACH VAULT SERVER WHEN IT'S BOOTING
-# This script will configure and start Vault
-# ---------------------------------------------------------------------------------------------------------------------
-
-data "template_file" "user_data_vault_cluster" {
-  template = file("${path.module}/user-data-vault.sh")
-
-  vars = {
-    consul_cluster_tag_key   = var.consul_cluster_tag_key
-    consul_cluster_tag_value = var.consul_cluster_name
-    kms_key_id               = data.aws_kms_alias.vault-example.target_key_id
-    aws_region               = data.aws_region.current.name
-  }
-}
-
 # ---------------------------------------------------------------------------------------------------------------------
 # PERMIT CONSUL SPECIFIC TRAFFIC IN VAULT CLUSTER
 # To allow our Vault servers consul agents to communicate with other consul agents and participate in the LAN gossip,
@@ -109,7 +101,13 @@ module "consul_cluster" {
   cluster_tag_value = var.consul_cluster_name
 
   ami_id    = var.ami_id
-  user_data = data.template_file.user_data_consul.rendered
+
+  # The user data script that will run on eacht consul server when it's booting
+  # This script will configure and start Consul
+  user_data = templatefile("${path.module}/user-data-consul.sh", {
+    consul_cluster_tag_key   = var.consul_cluster_tag_key
+    consul_cluster_tag_value = var.consul_cluster_name
+  })
 
   vpc_id     = data.aws_vpc.default.id
   subnet_ids = data.aws_subnet_ids.default.ids
@@ -122,20 +120,6 @@ module "consul_cluster" {
   ssh_key_name                = var.ssh_key_name
 }
 
-# ---------------------------------------------------------------------------------------------------------------------
-# THE USER DATA SCRIPT THAT WILL RUN ON EACH CONSUL SERVER WHEN IT'S BOOTING
-# This script will configure and start Consul
-# ---------------------------------------------------------------------------------------------------------------------
-
-data "template_file" "user_data_consul" {
-  template = file("${path.module}/user-data-consul.sh")
-
-  vars = {
-    consul_cluster_tag_key   = var.consul_cluster_tag_key
-    consul_cluster_tag_value = var.consul_cluster_name
-  }
-}
-
 # ---------------------------------------------------------------------------------------------------------------------
 # DEPLOY THE CLUSTERS IN THE DEFAULT VPC AND AVAILABILITY ZONES
 # Using the default VPC and subnets makes this example easy to run and test, but it means Consul and Vault are
@@ -154,4 +138,3 @@ data "aws_subnet_ids" "default" {
 
 data "aws_region" "current" {
 }
-

examples/vault-cluster-private/main.tf

@@ -23,7 +23,14 @@ module "vault_cluster" {
   instance_type = var.vault_instance_type
 
   ami_id    = var.ami_id
-  user_data = data.template_file.user_data_vault_cluster.rendered
+
+  # The user data script that will run on each vault server when it's booting
+  # This script will configure and start Vault
+  user_data = templatefile("${path.module}/user-data-vault.sh", {
+    aws_region               = data.aws_region.current.name
+    consul_cluster_tag_key   = var.consul_cluster_tag_key
+    consul_cluster_tag_value = var.consul_cluster_name
+  })
 
   vpc_id     = data.aws_vpc.default.id
   subnet_ids = data.aws_subnet_ids.default.ids
@@ -50,21 +57,6 @@ module "consul_iam_policies_servers" {
   iam_role_id = module.vault_cluster.iam_role_id
 }
 
-# ---------------------------------------------------------------------------------------------------------------------
-# THE USER DATA SCRIPT THAT WILL RUN ON EACH VAULT SERVER WHEN IT'S BOOTING
-# This script will configure and start Vault
-# ---------------------------------------------------------------------------------------------------------------------
-
-data "template_file" "user_data_vault_cluster" {
-  template = file("${path.module}/user-data-vault.sh")
-
-  vars = {
-    aws_region               = data.aws_region.current.name
-    consul_cluster_tag_key   = var.consul_cluster_tag_key
-    consul_cluster_tag_value = var.consul_cluster_name
-  }
-}
-
 # ---------------------------------------------------------------------------------------------------------------------
 # PERMIT CONSUL SPECIFIC TRAFFIC IN VAULT CLUSTER
 # To allow our Vault servers consul agents to communicate with other consul agents and participate in the LAN gossip,
@@ -98,8 +90,14 @@ module "consul_cluster" {
   cluster_tag_value = var.consul_cluster_name
 
   ami_id    = var.ami_id
-  user_data = data.template_file.user_data_consul.rendered
 
+  # The user data script that will run on each consul server when it's booting
+  # This script will configure and start Consul
+  user_data = templatefile("${path.module}/user-data-consul.sh", {
+    consul_cluster_tag_key   = var.consul_cluster_tag_key
+    consul_cluster_tag_value = var.consul_cluster_name
+  })
+
   vpc_id     = data.aws_vpc.default.id
   subnet_ids = data.aws_subnet_ids.default.ids
 
@@ -111,20 +109,6 @@ module "consul_cluster" {
   ssh_key_name                = var.ssh_key_name
 }
 
-# ---------------------------------------------------------------------------------------------------------------------
-# THE USER DATA SCRIPT THAT WILL RUN ON EACH CONSUL SERVER WHEN IT'S BOOTING
-# This script will configure and start Consul
-# ---------------------------------------------------------------------------------------------------------------------
-
-data "template_file" "user_data_consul" {
-  template = file("${path.module}/user-data-consul.sh")
-
-  vars = {
-    consul_cluster_tag_key   = var.consul_cluster_tag_key
-    consul_cluster_tag_value = var.consul_cluster_name
-  }
-}
-
 # ---------------------------------------------------------------------------------------------------------------------
 # DEPLOY THE CLUSTERS IN THE DEFAULT VPC AND AVAILABILITY ZONES
 # Using the default VPC and subnets makes this example easy to run and test, but it means Consul and Vault are
@@ -143,4 +127,3 @@ data "aws_subnet_ids" "default" {
 
 data "aws_region" "current" {
 }
-

examples/vault-dynamodb-backend/main.tf

@@ -34,7 +34,14 @@ module "vault_cluster" {
   instance_type = var.vault_instance_type
 
   ami_id    = var.ami_id
-  user_data = data.template_file.user_data_vault_cluster.rendered
+
+  # The user data script that will run on each vault server when it's booting
+  # This script will configure and start Vault
+  user_data = templatefile("${path.module}/user-data-vault.sh", {
+    aws_region        = data.aws_region.current.name
+    dynamo_table_name = var.dynamo_table_name
+    s3_bucket_name    = var.s3_bucket_name
+  })
 
   # Enable S3 storage backend
   enable_s3_backend       = true
@@ -58,21 +65,6 @@ module "vault_cluster" {
   dynamo_table_name     = var.dynamo_table_name
 }
 
-# ---------------------------------------------------------------------------------------------------------------------
-# THE USER DATA SCRIPT THAT WILL RUN ON EACH VAULT SERVER WHEN IT'S BOOTING
-# This script will configure and start Vault
-# ---------------------------------------------------------------------------------------------------------------------
-
-data "template_file" "user_data_vault_cluster" {
-  template = file("${path.module}/user-data-vault.sh")
-
-  vars = {
-    aws_region        = data.aws_region.current.name
-    dynamo_table_name = var.dynamo_table_name
-    s3_bucket_name    = var.s3_bucket_name
-  }
-}
-
 # ---------------------------------------------------------------------------------------------------------------------
 # DEPLOY THE CLUSTERS IN THE DEFAULT VPC AND AVAILABILITY ZONES
 # Using the default VPC and subnets makes this example easy to run and test, but it means Vault is
@@ -91,4 +83,3 @@ data "aws_subnet_ids" "default" {
 
 data "aws_region" "current" {
 }
-