How to update an existing cloudflare_record in terraform and github actions

user_5031905 0
Viewed 832

I creaed my project with code from Hashicorp tutorial "Host a static website with S3 and Cloudflare", but the tutorial didn't mention github actions. So, when I put my project in github actions, even though terraform plan and terraform apply output successfully locally, I get errors on terraform apply:

Error: expected DNS record to not already be present but already exists

 with cloudflare_record.site_cname ...
 with cloudflare_record.www

I have two resources in my main.tf, one for the site domain and one for www, like the following:

resource "cloudflare_record" "site_cname"  {
zone_id = data.cloudflare_zones.domain.zones[0].id
name    = var.site_domain
value   = aws_s3_bucket.site.website_endpoint
type    = "CNAME"
ttl     = 1
proxied = true
}

resource "cloudflare_record" "www" {
zone_id = data.cloudflare_zones.domain.zones[0].id
name    = "www"
value   = var.site_domain
type    = "CNAME"

ttl     = 1
proxied = true
}

If I remove these lines of code from my main.tf and then run terraform apply locally, I get the warning that this will destroy my resource.

Which should I do?

  1. add an allow_overwrite somewhere (don't see examples of how to use this in the docs) and the ways I've tried to add it generated errors.
  2. remove the lines of code from main.tf knowing the github actions run will destroy my cloudflare_record.www and cloudflare_record.site_cname knowing I can see my zone id and CNAME if I log into cloudflare so maybe this code isn't necessary after the initial set up
  3. run terrform import somewhere? If so, where do I find the zone ID and record ID

or something else?

terraform-provider-aws terraform cloudflare
2 Answers
user_154926380

It shouldn't be a problem if Terraform would drop and re-create DNS records, but for better result, you need to ensure that GitHub Actions has access to the (current) workspace state.

Since Terraform Cloud provides a free plan, there is no reason not to take advantage of it. Just create a workspace through their dashboard, add "remote" backend configuration to your project and ensure that GitHub Actions uses Terraform API Token at runtime (you would set it via GitHub repository settings > Secrets).

You may want to check this example — Terraform Starter Kit

  • infra/backend.tf
  • infra/dns-records.tf
  • scripts/tf.js

Here is how you can pass Terraform API Token from secrets.TERRAFORM_API_TOKEN GitHub secret to Terraform CLI:

- env: { TERRAFORM_API_TOKEN: "${{ secrets.TERRAFORM_API_TOKEN }}" }
  run: |
    echo "credentials \"app.terraform.io\" { token = \"$TERRAFORM_API_TOKEN\" }" > ./.terraformrc
user_826860
Related