Fix Race Condition between the Creation of the S3 Bucket Policy and the CloudTrail Trail

[X-Guardian]

what

Fix the race condition between the creation of the S3 Bucket policy and the CloudTrail trail by adding a depends_on argument to the bucket_id output which is used as input to the CloudTrail module. This ensures that all the resources in the CloudTrail S3 Bucket module, including the S3 Bucket Policy have been created before the CloudTrail trail is created.

The example used for the tests has also been updated to include the creation of the CloudTrail Trail to verify that this is working.

why

• Fixes Race Condition between the Creation of the S3 Bucket Policy and the CloudTrail Trail #90

[jamengual]

/terratest

[jamengual]

/terratest

[jamengual]

What version of terraform are you using?
Usually, depends_on in outputs is not used, so I just want to make sure it is ok with other CP reviewers.

[X-Guardian]

The Terraform version is not relevant. It is the AWS CloudTrail CreateTrail API that is checking the S3 Bucket Policy when creating the trail. Without the depends_on on the output this check happens before the S3 Bucket Policy has been applied.

[Nuru]

/terratest

[Nuru]

I am uncomfortable allowing the use of an undocumented feature, and this should probably be fixed upstream in terraform-aws-s3-bucket, but it works with Terraform 1.3, 1.5, and 1.8 and I don't see a better way to achieve the desired result, so I will allow this and we can see how it goes.

[X-Guardian]

Thank for merging this @Nuru. If you are talking about the depends_on feature for an entire module being undocumented, it is documented here: https://developer.hashicorp.com/terraform/language/meta-arguments/depends_on.

When the dependency object is an entire module, depends_on affects the order in which Terraform processes all of the resources and data sources associated with that module.

And depends_on for outputs is documented here: https://developer.hashicorp.com/terraform/language/values/outputs#depends_on-explicit-output-dependencies