Skip to content

Fix destroy environment workflow failure due to missing variable#4355

Merged
gurevichdmitry merged 2 commits intomainfrom
dg-fix-workflows
Apr 12, 2026
Merged

Fix destroy environment workflow failure due to missing variable#4355
gurevichdmitry merged 2 commits intomainfrom
dg-fix-workflows

Conversation

@gurevichdmitry
Copy link
Copy Markdown
Collaborator

Summary of your changes

The destroy environment workflow currently fails because a required variable is missing.
This PR adds the missing variable and sets it to the correct value to ensure the workflow runs successfully.

@gurevichdmitry gurevichdmitry requested a review from a team as a code owner April 12, 2026 09:01
@mergify
Copy link
Copy Markdown
Contributor

mergify Bot commented Apr 12, 2026

This pull request does not have a backport label. Could you fix it @gurevichdmitry? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

  • backport-v./d./d./d is the label to automatically backport to the 8./d branch. /d is the digit
  • backport-active-all is the label that automatically backports to all active branches.
  • backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
  • backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

echo "Removing aws_auth resource from state in cis..."
terraform state rm "$(terraform state list | grep "kubernetes_config_map_v1_data.aws_auth")"
fi
# Destroy still evaluates module variable validation; CDR apply sets TF_VAR_* in CI, generic destroy does not.
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you please explain why this is needed?

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The CDR stack passes var.windows_elastic_defend_winrm_ingress_cidr into modules/aws/ec2-windows, which rejects an empty string (and 0.0.0.0/0)
Destroy process did not set that env var, so the variable stayed at its default ""
As a result Destroy then failed variable validation (winrm_ingress_cidr must be set…) even though you only wanted to tear resources down.

╷
│ Error: Invalid value for variable
│ 
│   on main.tf line 103, in module "aws_ec2_elastic_defend_windows":
│  103:   winrm_ingress_cidr    = var.windows_elastic_defend_winrm_ingress_cidr
│     ├────────────────
│     │ var.winrm_ingress_cidr is ""
│ 
│ winrm_ingress_cidr must be set to a restrictive CIDR and must not be
│ 0.0.0.0/0, as this would expose WinRM to the public internet.
│ 
│ This was checked by the validation rule at
│ ../modules/aws/ec2-windows/variables.tf:35,3-13.
╵

@gurevichdmitry gurevichdmitry added this pull request to the merge queue Apr 12, 2026
Merged via the queue into main with commit d408e5c Apr 12, 2026
13 of 14 checks passed
@gurevichdmitry gurevichdmitry deleted the dg-fix-workflows branch April 12, 2026 13:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants