Fix destroy environment workflow failure due to missing variable#4355
Merged
gurevichdmitry merged 2 commits intomainfrom Apr 12, 2026
Merged
Fix destroy environment workflow failure due to missing variable#4355gurevichdmitry merged 2 commits intomainfrom
gurevichdmitry merged 2 commits intomainfrom
Conversation
Contributor
|
This pull request does not have a backport label. Could you fix it @gurevichdmitry? 🙏
|
uri-weisman
reviewed
Apr 12, 2026
| echo "Removing aws_auth resource from state in cis..." | ||
| terraform state rm "$(terraform state list | grep "kubernetes_config_map_v1_data.aws_auth")" | ||
| fi | ||
| # Destroy still evaluates module variable validation; CDR apply sets TF_VAR_* in CI, generic destroy does not. |
Collaborator
There was a problem hiding this comment.
Can you please explain why this is needed?
Collaborator
Author
There was a problem hiding this comment.
The CDR stack passes var.windows_elastic_defend_winrm_ingress_cidr into modules/aws/ec2-windows, which rejects an empty string (and 0.0.0.0/0)
Destroy process did not set that env var, so the variable stayed at its default ""
As a result Destroy then failed variable validation (winrm_ingress_cidr must be set…) even though you only wanted to tear resources down.
╷
│ Error: Invalid value for variable
│
│ on main.tf line 103, in module "aws_ec2_elastic_defend_windows":
│ 103: winrm_ingress_cidr = var.windows_elastic_defend_winrm_ingress_cidr
│ ├────────────────
│ │ var.winrm_ingress_cidr is ""
│
│ winrm_ingress_cidr must be set to a restrictive CIDR and must not be
│ 0.0.0.0/0, as this would expose WinRM to the public internet.
│
│ This was checked by the validation rule at
│ ../modules/aws/ec2-windows/variables.tf:35,3-13.
╵
uri-weisman
approved these changes
Apr 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary of your changes
The destroy environment workflow currently fails because a required variable is missing.
This PR adds the missing variable and sets it to the correct value to ensure the workflow runs successfully.