Multi tool use

Can terraform tf file or module automatically expire resources?

In cloudformation you can set a TTL on a stack that runs a command which deletes the stack: https://aws.amazon.com/blogs/devops/scheduling-automatic-deletion-of-application-environments/

How do I do this in a TF file?

OR maybe I could have a script that gets the create time of a tf file (the state file), compare that with the current time and do a destroy? that might work too

at

1 Answer
1

Terraform does not keep track of these sorts of lifecycle events. It doesn't look like the state file even has data about when it was updated (except for whatever metadata the backend has, such as file creation/update time). I would suggest keeping track of this data yourself and model the lifecycle outside of terraform.

Here is an example of how to manage this lifecycle using SSM parameter store to keep this state.

First, I generate a unique identifier for the "stack" (to borrow a CloudFormation term) and store the create time in SSM Parameter Store. We pass in this UUID to Terraform for tagging and backend configuration

#!/bin/bash
set -e

UUID=$(uuidgen)
TIMESTAMP=$(date +%s)
SSM_PARAMETER_STORE_NAME="/terraform/created_at/${UUID}"
<configure terraform backend config>
<terraform apply step>
aws ssm put-parameter --name "$SSM_PARAMETER_STORE_NAME" --value "$TIMESTAMP" --type String > /dev/null
echo $UUID


Then you can use something like the following to conditionally destroy stack $UUID if it has been created $threshold seconds ago.

$UUID

#!/bin/bash

usage(){
echo "Performs terraform destroy if a terrafrom 'stack' was created at least <threshold> seconds ago"
echo "Usage: $0 UUID threshold"
exit 1
}

validate_args(){
[[ -z "$1" ]] && { echo "No UUID passed, exiting" ; usage; exit 1; }
[[ -z "$2" ]] && { echo "No Threshold passed, exiting" ; usage; exit 1; }
echo "Args validated"
}

check_time(){
SSM_PARAMETER_STORE_NAME=$1
THRESHOLD=$2
NOW=$(date +%s)

CREATED_AT=$(aws ssm get-parameter --name "$SSM_PARAMETER_STORE_NAME" | jq -r .Parameter.Value)
if [[ $(($NOW - $CREATED_AT)) > $THRESHOLD ]]; then
echo "Threshold not met, exiting"
exit 1
fi
echo "Threshold met"
}

perform_tf_destroy(){
<configure terraform backend config>
<terraform destroy step>
aws ssm delete-parameter --name "$SSM_PARAMETER_STORE_NAME"
}

validate_args $1 $2
SSM_PARAMETER_STORE_NAME="/terraform/created_at/${1}"
THRESHOLD=$2
check_time $SSM_PARAMETER_STORE_NAME $THRESHOLD
perform_tf_destroy


You could then automate periodically performing that check for every UUID in /terraform/created_at/*

/terraform/created_at/*

terraform init -backend-config 'bucket=${BUCKET}' -backend-config 'region=${REGION}' -backend-config 'dynamodb_table=${TABLE}' -backend-config 'key=${UUID}.state'

terraform apply -var 'UUID=${UUID}'

UUID

destroy

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.