Issue Deploying existing.sh script for Existing Bucket Protection

[jaycrast]

Hello, hoping to get some assistance to resolve my deployment issue. I have my s3-bucket-protection root directory with all of the terraform files and the existing.sh script. I've ran this deployment in the past with no issue, but running in to the below error after trying to re-deploy in a new environment.

./existing.sh add

This script should be executed from the s3-bucket-protection root directory.

CrowdStrike API Client ID: 
CrowdStrike API Client SECRET: 
Bucket name: bucket name here
Error handling -chdir option: chdir existing: no such file or directory
Error handling -chdir option: chdir existing: no such file or directory

Here's the root directory I'm running the script out of:

s3-bucket-protection $ ls
bucket.tf		iam.tf			lambda-function.tf	ssm.tf
existing.sh		lambda			region.tf		variables.tf

[jshcodes]

Hi @jaycrast -

It looks like we're executing existing.sh within the existing folder, as opposed to the parent folder.

Another option is to remove the -chdir=existing arguments from the terraform commands in existing.sh.

Side note: I'm moving this issue over to that repository for tracking purposes. 😄

[jaycrast]

I had all of the terraform files and script only inside a directory named s3-existing-bucket, didn't realize I needed the files inside another directory named existing.

Fixed that issue and it looks like the script starts successfully until it gets to line 47 in the the lambda-funciton.tf

Warning: Deprecated
│ 
│   with data.null_data_source.wait_for_archive_delay,
│   on lambda-function.tf line 7, in data "null_data_source" "wait_for_archive_delay":
│    7: data "null_data_source" "wait_for_archive_delay" {
│ 
│ The null_data_source was historically used to construct intermediate values to re-use elsewhere in configuration, the same can now be achieved using locals
│ 
│ (and one more similar warning elsewhere)
╵
╷
│ Warning: Argument is deprecated
│ 
│   with aws_ssm_parameter.bucket_scan_client_id,
│   on ssm.tf line 6, in resource "aws_ssm_parameter" "bucket_scan_client_id":
│    6:     overwrite = true
│ 
│ this attribute has been deprecated
│ 
│ (and 5 more similar warnings elsewhere)
╵
╷
│ Error: creating Lambda Function (s3_bucket_protection): operation error Lambda: CreateFunction, https response error StatusCode: 400, RequestID: 6cfd9a22-505c-49cb-8bda-f6e927040878, InvalidParameterValueException: Uploaded file must be a non-empty zip
│ 
│   with aws_lambda_function.func,
│   on lambda-function.tf line 47, in resource "aws_lambda_function" "func":
│   47: resource "aws_lambda_function" "func" {

This error was when I manually creating the lambda directory with the falconpy-layer.zip and the rest of the python files. If I run it without the lambda directory created, I get the below error:

Error: Error in function call
│ 
│   on lambda-function.tf line 3, in resource "null_resource" "archive_delay":
│    3:         index = "${filebase64sha256("${path.cwd}/lambda/${var.falconpy_layer_filename}")}"
│     ├────────────────
│     │ while calling filebase64sha256(path)
│     │ path.cwd is "/Users/username/Documents/s3-bucket-protection"
│     │ var.falconpy_layer_filename is "falconpy-layer.zip"
│ 
│ Call to function "filebase64sha256" failed: open /Users/username/Documents/s3-bucket-protection/lambda/falconpy-layer.zip: no such file or directory.

[jaycrast]

Apologies for all of the edits, I marked this as resolved before the script finished. Made a bit of progress but I'm still messing something up :)

[jshcodes]

│ Error: creating Lambda Function (s3_bucket_protection): operation error Lambda: CreateFunction, https response error StatusCode: 400, RequestID: 6cfd9a22-505c-49cb-8bda-f6e927040878, InvalidParameterValueException: Uploaded file must be a non-empty zip

This one is because the generated zip file for the lambda is empty. (This is definitely not right.)

Side note: Deprecation warnings are annoying, and shouldn't be preventing deployment... but to be on the safe side, have you downloaded the most recent copies of the existing terraform files? There was an update to these (specifically lambda-function.tf) last month.

│ Call to function "filebase64sha256" failed: open /Users/username/Documents/s3-bucket-protection/lambda/falconpy-layer.zip: no such file or directory.

This one is because it couldn't find the falconpy-layer.zip file to attach to the lambda. You might be able to download a copy of this file from the repo and drop it in the s3-bucket-protection/lambda folder to resolve this one.

[jaycrast]

Must have been something wrong with my download of the zip file yesterday. I redownloaded it again and deployed without issue. Thank you again!

[carlosmmatos]

Hey @jaycrast - As mentioned by @jshcodes it seems like you are just running into some issues since you just grabbed some files as opposed to using the parent directory. You can follow the below to start from a clean slate to see if it helps:

# Clone or unzip the repo
git clone https://github.com/CrowdStrike/Cloud-AWS.git

# Navigate to the parent dir
cd Cloud-AWS/s3-bucket-protection

# If you need to make any changes to the terraform files (such as changing the AWS region) 
# make them in the existing directory

# From here you should be able to run the script
./existing.sh add

Let us know if that helps or if you run into any other issues.