Skip to content

updates for cirrus v2 compatibility#253

Open
jkeifer wants to merge 2 commits intomainfrom
jak/cirrus-v2
Open

updates for cirrus v2 compatibility#253
jkeifer wants to merge 2 commits intomainfrom
jak/cirrus-v2

Conversation

@jkeifer
Copy link
Copy Markdown
Member

@jkeifer jkeifer commented Apr 13, 2026

Related issue(s)

  • n/a

Proposed Changes

  • Cirrus payload bucket prefix var used by cirrus >=2 for the new payload bucket organization (default cirrus)
  • Cirrus payload bucket tmp lifecycle policy to remove temporary payload objects when the payload bucket is managed by the cirrus module and the payload_tmp_lifecycle_expiration_days var is set to something other than 0
  • Properly support deploy_log_archive=false by ensuring aws_flow_log resource is not created when that setting is false

Testing

This change was validated by the following observations:

  • lambda env vars include CIRRUS_PAYLOAD_ROOT_PREFIX
  • parameter store includes CIRRUS_PAYLOAD_ROOT_PREFIX
  • validate that the lifecycle policy exists on the payloads bucket
  • deployment succeeds with deploy_log_archive=false

Checklist

General

  • I have deployed and validated this change
  • Changelog
    • I have added my changes to CHANGELOG.md
    • No changelog entry is necessary

If releasing a new version

  • In both CHANGELOG.md and MIGRATION.md, I have moved unreleased items to a newly created release section

If migration step(s) might be required

  • I have added any migration steps to MIGRATION.md

No migration steps are required, this is a backwards-compatible change due to the default values.

Comment on lines +50 to +54
# CIRRUS_PAYLOAD_BUCKET and CIRRUS_PAYLOAD_ROOT_PREFIX are special variables
# that you do not need to provide literal values for; they are automatically
# replaced with the Cirrus payload bucket's name (NOT the ARN) and the root
# prefix for payloads, respectively, for your target deployment environment
# at runtime.
Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could consider restricting these resources to just the payload bucket prefix, but that would not be backwards compatible. Users could set the prefix to an empty string to keep the current behavior, but leaving it set that way when upgrading to cirrus v2 that would defeat some of the point of the reorg.

I think I'd probably suggest leaving the permissions as-is, and restricting them in the future once we have everything on >=v2.

Comment thread modules/cirrus/inputs.tf
Each interpolation sequence's lookup value must have an associated entry in this map. If not, Terraform will raise a runtime error.

Since the Cirrus data and payload buckets will always be different for each environment, there are two predefined variables `CIRRUS_DATA_BUCKET` and `CIRRUS_PAYLOAD_BUCKET` that can be used to automatically reference these bucket names in your task definition YAML. You don't need to add entries to this variable for these.
Since the Cirrus data and payload buckets will always be different for each environment, there are predefined variables `CIRRUS_DATA_BUCKET`, `CIRRUS_PAYLOAD_BUCKET`, and `CIRRUS_PAYLOAD_ROOT_PREFIX` that can be used to automatically reference these values in your task definition YAML. You don't need to add entries to this variable for these.
Copy link
Copy Markdown
Member Author

@jkeifer jkeifer Apr 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This statement is not totally true: the v2 reorg opens up the possibility of using one payload bucket across multiple deployments. I don't think it is worth capturing that here, but I figured I'd point this out in case someone else feels this needs to be revised.

@jkeifer
Copy link
Copy Markdown
Member Author

jkeifer commented Apr 13, 2026

I authored this PR as a draft because I expected it had a dependency on cutting a cirrus v2 release. But it ended up backwards compatible, so I think it can be merged any time.

@jkeifer jkeifer marked this pull request as ready for review April 13, 2026 22:04
@KayakinCoder
Copy link
Copy Markdown
Contributor

Looks good, and good catch on the aws_flow_log

@jkeifer
Copy link
Copy Markdown
Member Author

jkeifer commented Apr 22, 2026

@KayakinCoder should I bump the cirrus version default to 2.0.0 now that it has been released? I tested with v2.0.0 and python 3.14 and everything looked good.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants