Terraform: AWS Inspector plan fails

Question

I am using terraform to manage AWS infrastructure. I am completely new to AWS and terraform and the information is overwhelming.

I am trying to enable the service AWS Inspector though terraform using the following code:

resource "aws_inspector_assessment_template" "example" {
  name       = "example"
#   target_arn = aws_inspector_assessment_target.example.arn
  duration   = 3600

#   rules_package_arns = [
#     "arn:aws:inspector:us-west-2:758058086616:rulespackage/0-9hgA516p",
#     "arn:aws:inspector:us-west-2:758058086616:rulespackage/0-H5hpSawc",
#     "arn:aws:inspector:us-west-2:758058086616:rulespackage/0-JJOtZiqQ",
#     "arn:aws:inspector:us-west-2:758058086616:rulespackage/0-vg5GGHSD",
#   ]
}

But all I am getting is the following error:

Error: Missing required argument

  on aws_inspector.tf line 1, in resource "aws_inspector_assessment_template" "example":
   1: resource "aws_inspector_assessment_template" "example" {

The argument "rules_package_arns" is required, but no definition was found.


Error: Missing required argument

  on aws_inspector.tf line 1, in resource "aws_inspector_assessment_template" "example":
   1: resource "aws_inspector_assessment_template" "example" {

The argument "target_arn" is required, but no definition was found.

This is obviously because I commented out target_arn and rules_package_arns .

The thing is I don't understand what these variables are and what values to give the. Could you please help me figure this out?

Answer 1

You shouldn't comment out all the required parts. Thus your error.

You also have to create aws_inspector_assessment_target , and can use aws_inspector_rules_packages to get the ARNs that you require. Having these resources you can reference them in your aws_inspector_assessment_template .

An example is TF docs :

# Declare the data source
data "aws_inspector_rules_packages" "rules" {}

# e.g. Use in aws_inspector_assessment_template
resource "aws_inspector_resource_group" "group" {
  tags = {
    test = "test"
  }
}

resource "aws_inspector_assessment_target" "assessment" {
  name               = "test"
  resource_group_arn = aws_inspector_resource_group.group.arn
}

resource "aws_inspector_assessment_template" "assessment" {
  name       = "Test"
  target_arn = aws_inspector_assessment_target.assessment.arn
  duration   = "60"

  rules_package_arns = data.aws_inspector_rules_packages.rules.arns
}