From f6ab10466f5fa90f74d2ee34007ef5605b5cb04a Mon Sep 17 00:00:00 2001
From: Martin Evgeniev <suizman@outlook.com>
Date: Thu, 26 Sep 2019 12:24:23 +0200
Subject: [PATCH] Update deploy aws to support terraform v0.12.9

---
 Dockerfile                                    |   8 +-
 deploy/aws/config.tf                          |   7 +-
 deploy/aws/flavour.tf                         |  54 -------
 deploy/aws/main.tf                            |  98 ++++++------
 deploy/aws/modules/agent/main.tf              |   9 +-
 deploy/aws/modules/agent/outputs.tf           |  10 +-
 deploy/aws/modules/agent/variables.tf         |   2 +-
 deploy/aws/modules/inmemory_storage/main.tf   |   7 +-
 .../aws/modules/inmemory_storage/outputs.tf   |  10 +-
 deploy/aws/modules/prometheus/main.tf         |   7 +-
 deploy/aws/modules/prometheus/outputs.tf      |  10 +-
 deploy/aws/modules/qed/main.tf                |  12 +-
 deploy/aws/modules/qed/outputs.tf             |  10 +-
 deploy/aws/modules/qed/variables.tf           |   2 +-
 deploy/aws/modules/workload/main.tf           |   7 +-
 deploy/aws/modules/workload/outputs.tf        |  10 +-
 deploy/aws/network.tf                         | 142 +++++++++---------
 deploy/aws/outputs.tf                         |  18 ++-
 deploy/aws/pre-build/bucket.tf                |   6 +-
 deploy/aws/variables.tf                       |   1 +
 deploy/provision.sh                           |  12 +-
 deploy/provision/clean-restart.yml            |   6 +-
 deploy/provision/main.yml                     |   6 +-
 23 files changed, 223 insertions(+), 231 deletions(-)
 delete mode 100644 deploy/aws/flavour.tf

diff --git a/Dockerfile b/Dockerfile
index 17427b3ea..e0cd64327 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -24,11 +24,13 @@ WORKDIR /go/src/github.com/bbva/qed
 # Install deps.
 RUN apt update -qq && apt install -qq -y autoconf cmake
 
-# Build C deps. 
+# Download C deps. 
 RUN echo Cloning repo: ${REPO} with branch: ${BRANCH}
 RUN git clone --depth 1 -b ${BRANCH} ${REPO} .  &&\
-    git submodule update --init --recursive     &&\
-    cd c-deps                                   &&\
+    git submodule update --init --recursive
+
+# Build C deps. 
+RUN cd c-deps       &&\
     ./builddeps.sh
 
 FROM golang:1.12.5
diff --git a/deploy/aws/config.tf b/deploy/aws/config.tf
index 95bd3c5f0..a8ac6205e 100644
--- a/deploy/aws/config.tf
+++ b/deploy/aws/config.tf
@@ -16,7 +16,7 @@
 
 # Bucket config must be here: https://github.com/hashicorp/terraform/issues/13589
 terraform {
-  required_version = ">= 0.11.11"
+  required_version = ">= 0.12.0"
 
   backend "s3" {
     bucket = "terraform-qed-cluster"
@@ -26,8 +26,8 @@ terraform {
 }
 
 provider "aws" {
-  version = ">= 1.56.0, < 2.0"
-  profile = "${var.aws_profile}"
+  version = ">= 2.7.0"
+  profile = var.aws_profile
 }
 
 provider "http" {
@@ -37,3 +37,4 @@ provider "http" {
 provider "null" {
   version = "~> 2.0"
 }
+
diff --git a/deploy/aws/flavour.tf b/deploy/aws/flavour.tf
deleted file mode 100644
index a1dc35623..000000000
--- a/deploy/aws/flavour.tf
+++ /dev/null
@@ -1,54 +0,0 @@
-#  Copyright 2018-2019 Banco Bilbao Vizcaya Argentaria, S.A.
-#
-#  Licensed under the Apache License, Version 2.0 (the "License");
-#  you may not use this file except in compliance with the License.
-#  You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-#  Unless required by applicable law or agreed to in writing, software
-#  distributed under the License is distributed on an "AS IS" BASIS,
-#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-#  See the License for the specific language governing permissions and
-#  limitations under the License.
-resource null_resource "qed-base" {
-
-  triggers {
-    qed = "${format("%s",module.qed.private_ip)}"
-    prometheus = "${module.prometheus.private_ip}"
-    workload = "${module.workload.private_ip}"
-    gateway = "${aws_internet_gateway.qed.id}"
-    aws_route = "${aws_route.qed.id}"
-    aws_vpc_dhcp_options = "${aws_vpc_dhcp_options.qed.id}"
-    aws_vpc_dhcp_options_association = "${aws_vpc_dhcp_options_association.qed.id}"
-    aws_cloudwatch_log_group = "${aws_cloudwatch_log_group.qed.name}"
-    aws_iam_role = "${aws_iam_role.qed.id}"
-    aws_flow_log = "${aws_flow_log.qed.id}"
-    aws_iam_role_policy_attachmentCloudWatch = "${aws_iam_role_policy_attachment.CloudWatchLogsFullAccess-attach.role}"
-    aws_iam_role_policy_attachmentQed = "${aws_iam_role_policy_attachment.qed.role}"
-  }
-
-}
-
-resource null_resource "qed-full" {
-
-  triggers {
-    qed = "${format("%s",module.qed.private_ip)}"
-    prometheus = "${module.prometheus.private_ip}"
-    workload = "${module.workload.private_ip}"
-    auditor = "${format("%s", module.agent-auditor.private_ip)}"
-    monitor = "${format("%s", module.agent-monitor.private_ip)}"
-    publisher = "${format("%s", module.agent-publisher.private_ip)}"
-    storage = "${module.inmemory-storage.private_ip}"
-    gateway = "${aws_internet_gateway.qed.id}"
-    aws_route = "${aws_route.qed.id}"
-    aws_vpc_dhcp_options = "${aws_vpc_dhcp_options.qed.id}"
-    aws_vpc_dhcp_options_association = "${aws_vpc_dhcp_options_association.qed.id}"
-    aws_cloudwatch_log_group = "${aws_cloudwatch_log_group.qed.name}"
-    aws_iam_role = "${aws_iam_role.qed.id}"
-    aws_flow_log = "${aws_flow_log.qed.id}"
-    aws_iam_role_policy_attachmentCloudWatch = "${aws_iam_role_policy_attachment.CloudWatchLogsFullAccess-attach.role}"
-    aws_iam_role_policy_attachmentQed = "${aws_iam_role_policy_attachment.qed.role}"
-  }
-
-}
diff --git a/deploy/aws/main.tf b/deploy/aws/main.tf
index 344d80ec2..f2051e8e7 100644
--- a/deploy/aws/main.tf
+++ b/deploy/aws/main.tf
@@ -24,114 +24,116 @@ data "aws_iam_policy_document" "CloudWatchLogsFullAccess-assume-role-policy" {
 }
 
 resource "aws_iam_role" "CloudWatchLogsFullAccess" {
-  name               = "CloudWatchLogsFullAccess-${terraform.workspace}"
+  name                 = "CloudWatchLogsFullAccess-${terraform.workspace}"
   permissions_boundary = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/PermissionsBoundariesBBVA"
-  assume_role_policy = "${data.aws_iam_policy_document.CloudWatchLogsFullAccess-assume-role-policy.json}"
+  assume_role_policy   = data.aws_iam_policy_document.CloudWatchLogsFullAccess-assume-role-policy.json
 }
 
 resource "aws_iam_role_policy_attachment" "CloudWatchLogsFullAccess-attach" {
-  role       = "${aws_iam_role.CloudWatchLogsFullAccess.name}"
+  role       = aws_iam_role.CloudWatchLogsFullAccess.name
   policy_arn = "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess"
 }
 
 resource "aws_iam_instance_profile" "qed-profile" {
   name = "qed-profile-${terraform.workspace}"
-  role = "${aws_iam_role.CloudWatchLogsFullAccess.name}"
+  role = aws_iam_role.CloudWatchLogsFullAccess.name
 }
 
 module "qed" {
-  source = "./modules/qed"
-  count  = 3
+  source    = "./modules/qed"
+  instances = 3
 
   name                   = "qed"
   instance_type          = "z1d.xlarge"
-  iam_instance_profile   = "${aws_iam_instance_profile.qed-profile.name}"
+  iam_instance_profile   = aws_iam_instance_profile.qed-profile.name
   volume_size            = "20"
-  vpc_security_group_ids = "${aws_security_group.qed.id}"
-  subnet_id              = "${aws_subnet.qed.id}"
-  key_name               = "${aws_key_pair.qed.key_name}"
-  key_path               = "${var.keypath}"
+  vpc_security_group_ids = aws_security_group.qed.id
+  subnet_id              = aws_subnet.qed.id
+  key_name               = aws_key_pair.qed.key_name
+  key_path               = var.keypath
 }
+
 module "inmemory-storage" {
   source = "./modules/inmemory_storage"
 
   name                   = "inmemory-storage"
   instance_type          = "r5.large"
-  iam_instance_profile   = "${aws_iam_instance_profile.qed-profile.name}"
+  iam_instance_profile   = aws_iam_instance_profile.qed-profile.name
   volume_size            = "20"
-  vpc_security_group_ids = "${aws_security_group.qed.id}"
-  subnet_id              = "${aws_subnet.qed.id}"
-  key_name               = "${aws_key_pair.qed.key_name}"
-  key_path               = "${var.keypath}"
+  vpc_security_group_ids = aws_security_group.qed.id
+  subnet_id              = aws_subnet.qed.id
+  key_name               = aws_key_pair.qed.key_name
+  key_path               = var.keypath
 }
 
 module "agent-publisher" {
-  source = "./modules/agent"
-  count  = 1
+  source    = "./modules/agent"
+  instances = 1
 
   role                   = "publisher"
   name                   = "agent-publisher"
   instance_type          = "m5.large"
-  iam_instance_profile   = "${aws_iam_instance_profile.qed-profile.name}"
+  iam_instance_profile   = aws_iam_instance_profile.qed-profile.name
   volume_size            = "20"
-  vpc_security_group_ids = "${aws_security_group.qed.id}"
-  subnet_id              = "${aws_subnet.qed.id}"
-  key_name               = "${aws_key_pair.qed.key_name}"
-  key_path               = "${var.keypath}"
+  vpc_security_group_ids = aws_security_group.qed.id
+  subnet_id              = aws_subnet.qed.id
+  key_name               = aws_key_pair.qed.key_name
+  key_path               = var.keypath
 }
 
 module "agent-monitor" {
-  source = "./modules/agent"
-  count  = 1
+  source    = "./modules/agent"
+  instances = 1
 
   role                   = "monitor"
   name                   = "agent-monitor"
   instance_type          = "m5.large"
-  iam_instance_profile   = "${aws_iam_instance_profile.qed-profile.name}"
+  iam_instance_profile   = aws_iam_instance_profile.qed-profile.name
   volume_size            = "20"
-  vpc_security_group_ids = "${aws_security_group.qed.id}"
-  subnet_id              = "${aws_subnet.qed.id}"
-  key_name               = "${aws_key_pair.qed.key_name}"
-  key_path               = "${var.keypath}"
+  vpc_security_group_ids = aws_security_group.qed.id
+  subnet_id              = aws_subnet.qed.id
+  key_name               = aws_key_pair.qed.key_name
+  key_path               = var.keypath
 }
 
 module "agent-auditor" {
-  source = "./modules/agent"
-  count  = 1
+  source    = "./modules/agent"
+  instances = 1
 
   role                   = "auditor"
   name                   = "agent-auditor"
   instance_type          = "m5.large"
-  iam_instance_profile   = "${aws_iam_instance_profile.qed-profile.name}"
+  iam_instance_profile   = aws_iam_instance_profile.qed-profile.name
   volume_size            = "20"
-  vpc_security_group_ids = "${aws_security_group.qed.id}"
-  subnet_id              = "${aws_subnet.qed.id}"
-  key_name               = "${aws_key_pair.qed.key_name}"
-  key_path               = "${var.keypath}"
+  vpc_security_group_ids = aws_security_group.qed.id
+  subnet_id              = aws_subnet.qed.id
+  key_name               = aws_key_pair.qed.key_name
+  key_path               = var.keypath
 }
 
 module "prometheus" {
   source = "./modules/prometheus"
 
   instance_type          = "m5.large"
-  iam_instance_profile   = "${aws_iam_instance_profile.qed-profile.name}"
+  iam_instance_profile   = aws_iam_instance_profile.qed-profile.name
   volume_size            = "20"
-  vpc_security_group_ids = "${aws_security_group.prometheus.id}"
-  subnet_id              = "${aws_subnet.qed.id}"
-  key_name               = "${aws_key_pair.qed.key_name}"
-  key_path               = "${var.keypath}"
+  vpc_security_group_ids = aws_security_group.prometheus.id
+  subnet_id              = aws_subnet.qed.id
+  key_name               = aws_key_pair.qed.key_name
+  key_path               = var.keypath
 }
 
 module "workload" {
   source = "./modules/workload"
 
   instance_type          = "m5.large"
-  iam_instance_profile   = "${aws_iam_instance_profile.qed-profile.name}"
+  iam_instance_profile   = aws_iam_instance_profile.qed-profile.name
   volume_size            = "20"
-  vpc_security_group_ids = "${aws_security_group.qed.id}"
-  subnet_id              = "${aws_subnet.qed.id}"
-  key_name               = "${aws_key_pair.qed.key_name}"
-  key_path               = "${var.keypath}"
-  endpoint               = "${module.qed.private_ip[0]}"
+  vpc_security_group_ids = aws_security_group.qed.id
+  subnet_id              = aws_subnet.qed.id
+  key_name               = aws_key_pair.qed.key_name
+  key_path               = var.keypath
+  endpoint               = module.qed.*.private_ip[0]
   num_requests           = 10000000
 }
+
diff --git a/deploy/aws/modules/agent/main.tf b/deploy/aws/modules/agent/main.tf
index e097ffcee..64542b922 100644
--- a/deploy/aws/modules/agent/main.tf
+++ b/deploy/aws/modules/agent/main.tf
@@ -14,6 +14,7 @@
 
 data "aws_ami" "amazon_linux" {
   most_recent = true
+  owners = ["amazon"]
 
   filter {
     name   = "name"
@@ -27,7 +28,7 @@ data "aws_ami" "amazon_linux" {
 }
 
 resource "aws_instance" "qed-agent" {
-  count                = "${var.count}"
+  count                = "${var.instances}"
   ami                  = "${data.aws_ami.amazon_linux.id}"
   instance_type        = "${var.instance_type}"
   iam_instance_profile = "${var.iam_instance_profile}"
@@ -37,12 +38,12 @@ resource "aws_instance" "qed-agent" {
   associate_public_ip_address = true
   key_name                    = "${var.key_name}"
 
-  root_block_device = [{
+  root_block_device {
     volume_type = "gp2"
     volume_size = "${var.volume_size}"
-  }]
+  }
 
-  tags {
+  tags = {
     Name = "${format("${var.name}-%01d", count.index)}"
     Role = "${var.role}"
     DAM_OnOff = "NO"
diff --git a/deploy/aws/modules/agent/outputs.tf b/deploy/aws/modules/agent/outputs.tf
index 4d455dabe..46208d427 100644
--- a/deploy/aws/modules/agent/outputs.tf
+++ b/deploy/aws/modules/agent/outputs.tf
@@ -1,7 +1,13 @@
 output "private_ip" {
-  value = "${aws_instance.qed-agent.*.private_ip}"
+  value = [
+    for instance in aws_instance.qed-agent:
+    instance.private_ip
+  ]
 }
 
 output "public_ip" {
-  value = "${aws_instance.qed-agent.*.public_ip}"
+  value = [
+    for instance in aws_instance.qed-agent:
+    instance.public_ip
+  ]
 }
diff --git a/deploy/aws/modules/agent/variables.tf b/deploy/aws/modules/agent/variables.tf
index 234fbcc6b..db12e02c5 100644
--- a/deploy/aws/modules/agent/variables.tf
+++ b/deploy/aws/modules/agent/variables.tf
@@ -36,7 +36,7 @@ variable "path" {
   default = "/var/tmp/qed"
 }
 
-variable "count" {
+variable "instances" {
   default = 1
 }
 
diff --git a/deploy/aws/modules/inmemory_storage/main.tf b/deploy/aws/modules/inmemory_storage/main.tf
index 9dd7676b2..f26c66adc 100644
--- a/deploy/aws/modules/inmemory_storage/main.tf
+++ b/deploy/aws/modules/inmemory_storage/main.tf
@@ -14,6 +14,7 @@
 
 data "aws_ami" "amazon_linux" {
   most_recent = true
+  owners = ["amazon"]
 
   filter {
     name   = "name"
@@ -37,12 +38,12 @@ resource "aws_instance" "inmemory-storage" {
   associate_public_ip_address = true
   key_name                    = "${var.key_name}"
 
-  root_block_device = [{
+  root_block_device {
     volume_type = "gp2"
     volume_size = "${var.volume_size}"
-  }]
+  }
 
-  tags {
+  tags = {
     Name = "qed-${var.name}"
     Role = "${var.role}"
     DAM_OnOff = "NO"
diff --git a/deploy/aws/modules/inmemory_storage/outputs.tf b/deploy/aws/modules/inmemory_storage/outputs.tf
index e8aa285ed..a866bc83f 100644
--- a/deploy/aws/modules/inmemory_storage/outputs.tf
+++ b/deploy/aws/modules/inmemory_storage/outputs.tf
@@ -1,7 +1,13 @@
 output "private_ip" {
-  value = "${aws_instance.inmemory-storage.private_ip}"
+  value = [
+    for instance in aws_instance.inmemory-storage:
+    instance.private_ip
+  ]
 }
 
 output "public_ip" {
-  value = "${aws_instance.inmemory-storage.public_ip}"
+  value = [
+    for instance in aws_instance.inmemory-storage:
+    instance.public_ip
+  ]
 }
diff --git a/deploy/aws/modules/prometheus/main.tf b/deploy/aws/modules/prometheus/main.tf
index 1b043ea7c..665020bb5 100644
--- a/deploy/aws/modules/prometheus/main.tf
+++ b/deploy/aws/modules/prometheus/main.tf
@@ -21,6 +21,7 @@
 
 data "aws_ami" "amazon_linux" {
   most_recent = true
+  owners = ["amazon"]
 
   filter {
     name   = "name"
@@ -44,12 +45,12 @@ resource "aws_instance" "prometheus" {
   associate_public_ip_address = true
   key_name                    = "${var.key_name}"
 
-  root_block_device = [{
+  root_block_device {
     volume_type = "gp2"
     volume_size = "${var.volume_size}"
-  }]
+  }
 
-  tags {
+  tags = {
     Name = "qed-prometheus"
     Role = "${var.role}"
     DAM_OnOff = "NO"
diff --git a/deploy/aws/modules/prometheus/outputs.tf b/deploy/aws/modules/prometheus/outputs.tf
index d0f13ec63..340c91079 100644
--- a/deploy/aws/modules/prometheus/outputs.tf
+++ b/deploy/aws/modules/prometheus/outputs.tf
@@ -1,7 +1,13 @@
 output "private_ip" {
-  value = "${aws_instance.prometheus.private_ip}"
+  value = [
+    for instance in aws_instance.prometheus:
+    instance.private_ip
+  ]
 }
 
 output "public_ip" {
-  value = "${aws_instance.prometheus.public_ip}"
+  value = [
+    for instance in aws_instance.prometheus:
+    instance.public_ip
+  ]
 }
diff --git a/deploy/aws/modules/qed/main.tf b/deploy/aws/modules/qed/main.tf
index 133ad0903..9a1605c1f 100644
--- a/deploy/aws/modules/qed/main.tf
+++ b/deploy/aws/modules/qed/main.tf
@@ -14,7 +14,7 @@
 
 data "aws_ami" "amazon_linux" {
   most_recent = true
-
+  owners = ["amazon"]
   filter {
     name   = "name"
     values = ["amzn2-ami-hvm-*-x86_64-gp2"]
@@ -27,7 +27,7 @@ data "aws_ami" "amazon_linux" {
 }
 
 resource "aws_instance" "qed-server" {
-  count                = "${var.count}"
+  count                = "${var.instances}"
   ami                  = "${data.aws_ami.amazon_linux.id}"
   instance_type        = "${var.instance_type}"
   iam_instance_profile = "${var.iam_instance_profile}"
@@ -37,19 +37,19 @@ resource "aws_instance" "qed-server" {
   associate_public_ip_address = true
   key_name                    = "${var.key_name}"
 
-  root_block_device = [{
+  root_block_device {
     volume_type = "gp2"
     volume_size = "${var.volume_size}"
-  }]
+  }
 
-  ebs_block_device = {
+  ebs_block_device {
     device_name           = "/dev/xvdc"
     volume_type           = "gp2"
     volume_size           = "${var.ebs_volume_size}"
     delete_on_termination = "true"
   }
 
-  tags {
+  tags = {
     Name = "${format("${var.name}-%01d", count.index)}"
     Role = "${var.role}"
     DAM_OnOff = "NO"
diff --git a/deploy/aws/modules/qed/outputs.tf b/deploy/aws/modules/qed/outputs.tf
index 6c4b504b2..affc8fc69 100644
--- a/deploy/aws/modules/qed/outputs.tf
+++ b/deploy/aws/modules/qed/outputs.tf
@@ -1,7 +1,13 @@
 output "private_ip" {
-  value = "${aws_instance.qed-server.*.private_ip}"
+  value = [
+    for instance in aws_instance.qed-server:
+    instance.private_ip
+  ]
 }
 
 output "public_ip" {
-  value = "${aws_instance.qed-server.*.public_ip}"
+  value = [
+    for instance in aws_instance.qed-server:
+    instance.public_ip
+  ]
 }
diff --git a/deploy/aws/modules/qed/variables.tf b/deploy/aws/modules/qed/variables.tf
index b712990f9..1a4570414 100644
--- a/deploy/aws/modules/qed/variables.tf
+++ b/deploy/aws/modules/qed/variables.tf
@@ -42,7 +42,7 @@ variable "path" {
   default = "/var/tmp/qed"
 }
 
-variable "count" {
+variable "instances" {
   default = 1
 }
 
diff --git a/deploy/aws/modules/workload/main.tf b/deploy/aws/modules/workload/main.tf
index 0008dd981..be84e860d 100644
--- a/deploy/aws/modules/workload/main.tf
+++ b/deploy/aws/modules/workload/main.tf
@@ -14,6 +14,7 @@
 
 data "aws_ami" "amazon_linux" {
   most_recent = true
+  owners = ["amazon"]
 
   filter {
     name   = "name"
@@ -37,12 +38,12 @@ resource "aws_instance" "workload" {
   associate_public_ip_address = true
   key_name                    = "${var.key_name}"
 
-  root_block_device = [{
+  root_block_device {
     volume_type = "gp2"
     volume_size = "${var.volume_size}"
-  }]
+  }
 
-  tags {
+  tags = {
     Name = "qed-workload"
     Role = "${var.role}"
     DAM_OnOff = "NO"
diff --git a/deploy/aws/modules/workload/outputs.tf b/deploy/aws/modules/workload/outputs.tf
index 37998f38a..6c18a7075 100644
--- a/deploy/aws/modules/workload/outputs.tf
+++ b/deploy/aws/modules/workload/outputs.tf
@@ -1,7 +1,13 @@
 output "private_ip" {
-  value = "${aws_instance.workload.private_ip}"
+  value = [
+    for instance in aws_instance.workload:
+    instance.private_ip
+  ]
 }
 
 output "public_ip" {
-  value = "${aws_instance.workload.public_ip}"
+    value = [
+    for instance in aws_instance.workload:
+    instance.public_ip
+  ]
 }
diff --git a/deploy/aws/network.tf b/deploy/aws/network.tf
index 9da243407..854d7cdb6 100644
--- a/deploy/aws/network.tf
+++ b/deploy/aws/network.tf
@@ -17,11 +17,12 @@ data "http" "ip" {
   url = "http://icanhazip.com"
 }
 
-data "aws_caller_identity" "current" {}
+data "aws_caller_identity" "current" {
+}
 
 resource "aws_vpc" "qed" {
   enable_dns_hostnames = true
-  cidr_block           = "${var.vpc_cidr}"
+  cidr_block           = var.vpc_cidr
 
   tags = {
     Name = "QED-${terraform.workspace}"
@@ -29,29 +30,27 @@ resource "aws_vpc" "qed" {
 }
 
 resource "aws_subnet" "qed" {
-  vpc_id                  = "${aws_vpc.qed.id}"
-  cidr_block              = "${var.public_subnet_cidr}"
+  vpc_id                  = aws_vpc.qed.id
+  cidr_block              = var.public_subnet_cidr
   map_public_ip_on_launch = true
 
   tags = {
     Name = "QED-${terraform.workspace}"
   }
-
 }
 
 resource "aws_internet_gateway" "qed" {
-  vpc_id = "${aws_vpc.qed.id}"
+  vpc_id = aws_vpc.qed.id
 
   tags = {
     Name = "QED-${terraform.workspace}"
   }
-
 }
 
 resource "aws_route" "qed" {
-  route_table_id         = "${aws_vpc.qed.default_route_table_id}"
+  route_table_id         = aws_vpc.qed.default_route_table_id
   destination_cidr_block = "0.0.0.0/0"
-  gateway_id             = "${aws_internet_gateway.qed.id}"
+  gateway_id             = aws_internet_gateway.qed.id
 }
 
 resource "aws_vpc_dhcp_options" "qed" {
@@ -61,12 +60,11 @@ resource "aws_vpc_dhcp_options" "qed" {
   tags = {
     Name = "QED-${terraform.workspace}"
   }
-
 }
 
 resource "aws_vpc_dhcp_options_association" "qed" {
-  vpc_id          = "${aws_vpc.qed.id}"
-  dhcp_options_id = "${aws_vpc_dhcp_options.qed.id}"
+  vpc_id          = aws_vpc.qed.id
+  dhcp_options_id = aws_vpc_dhcp_options.qed.id
 }
 
 resource "aws_cloudwatch_log_group" "qed" {
@@ -74,9 +72,9 @@ resource "aws_cloudwatch_log_group" "qed" {
 }
 
 resource "aws_iam_role" "qed" {
-  name = "qed-${terraform.workspace}"
+  name                 = "qed-${terraform.workspace}"
   permissions_boundary = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/PermissionsBoundariesBBVA"
-  assume_role_policy = <<EOF
+  assume_role_policy   = <<EOF
 {
   "Version": "2012-10-17",
   "Statement": [
@@ -91,47 +89,48 @@ resource "aws_iam_role" "qed" {
   ]
 }
 EOF
+
 }
 
 resource "aws_iam_role_policy_attachment" "qed" {
-  role       = "${aws_iam_role.qed.name}"
+  role       = aws_iam_role.qed.name
   policy_arn = "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess"
 }
 
 resource "aws_flow_log" "qed" {
-  log_destination = "${aws_cloudwatch_log_group.qed.arn}"
-  iam_role_arn    = "${aws_iam_role.qed.arn}"
-  vpc_id          = "${aws_vpc.qed.id}"
+  log_destination = aws_cloudwatch_log_group.qed.arn
+  iam_role_arn    = aws_iam_role.qed.arn
+  vpc_id          = aws_vpc.qed.id
   traffic_type    = "ALL"
 }
 
 resource "aws_key_pair" "qed" {
   key_name   = "qed-${terraform.workspace}"
-  public_key = "${file("${var.keypath}.pub")}"
+  public_key = file("${var.keypath}.pub")
 }
 
 # Create the Security Group
 resource "aws_security_group" "qed" {
-  vpc_id       = "${aws_vpc.qed.id}"
+  vpc_id      = aws_vpc.qed.id
   name        = "qed-${terraform.workspace}"
   description = "Security group for QED usage"
   ingress {
-      from_port   = 22
-      to_port     = 22
-      protocol    = "tcp"
-      cidr_blocks = ["${chomp(data.http.ip.body)}/32"]
+    from_port   = 22
+    to_port     = 22
+    protocol    = "tcp"
+    cidr_blocks = ["${chomp(data.http.ip.body)}/32"]
   }
   ingress {
-      from_port   = 8800
-      to_port     = 8800
-      protocol    = "tcp"
-      cidr_blocks = ["${chomp(data.http.ip.body)}/32"]
+    from_port   = 8800
+    to_port     = 8800
+    protocol    = "tcp"
+    cidr_blocks = ["${chomp(data.http.ip.body)}/32"]
   }
   ingress {
-      from_port   = 8888
-      to_port     = 8888
-      protocol    = "tcp"
-      cidr_blocks = ["${chomp(data.http.ip.body)}/32"]
+    from_port   = 8888
+    to_port     = 8888
+    protocol    = "tcp"
+    cidr_blocks = ["${chomp(data.http.ip.body)}/32"]
   }
   ingress {
     from_port   = 8600
@@ -157,17 +156,17 @@ resource "aws_security_group" "qed" {
     protocol    = "tcp"
     cidr_blocks = ["${chomp(data.http.ip.body)}/32"]
   }
-  ingress  {
-      from_port    = 0
-      to_port      = 65535
-      protocol     = "tcp"
-      self         = true
+  ingress {
+    from_port = 0
+    to_port   = 65535
+    protocol  = "tcp"
+    self      = true
   }
   ingress {
-      from_port        = 0
-      to_port          = 65535
-      protocol         = "tcp"
-      security_groups  = ["${aws_security_group.prometheus.id}"]
+    from_port       = 0
+    to_port         = 65535
+    protocol        = "tcp"
+    security_groups = [aws_security_group.prometheus.id]
   }
 
   egress {
@@ -176,51 +175,54 @@ resource "aws_security_group" "qed" {
     protocol    = "-1"
     cidr_blocks = ["0.0.0.0/0"]
   }
-  tags {
-    Name = "qed-${terraform.workspace}"
-    Workspace = "${terraform.workspace}"
+  tags = {
+    Name      = "qed-${terraform.workspace}"
+    Workspace = terraform.workspace
   }
 }
 
 resource "aws_security_group" "prometheus" {
-  vpc_id       = "${aws_vpc.qed.id}"
+  vpc_id      = aws_vpc.qed.id
   name        = "prometheus-${terraform.workspace}"
   description = "Security group for QED usage"
 
   ingress {
-      from_port   = 22
-      to_port     = 22
-      protocol    = "tcp"
-      cidr_blocks = ["${chomp(data.http.ip.body)}/32"]
+    from_port   = 22
+    to_port     = 22
+    protocol    = "tcp"
+    cidr_blocks = ["${chomp(data.http.ip.body)}/32"]
   }
+
   # Prometheus metrics
   ingress {
-      from_port   = 9090          
-      to_port     = 9090
-      protocol    = "tcp"
-      cidr_blocks = ["${chomp(data.http.ip.body)}/32"]
-    }
+    from_port   = 9090
+    to_port     = 9090
+    protocol    = "tcp"
+    cidr_blocks = ["${chomp(data.http.ip.body)}/32"]
+  }
+
   # Grafana
   ingress {
-      from_port   = 3000
-      to_port     = 3000
-      protocol    = "tcp"
-      cidr_blocks = ["${chomp(data.http.ip.body)}/32"]
+    from_port   = 3000
+    to_port     = 3000
+    protocol    = "tcp"
+    cidr_blocks = ["${chomp(data.http.ip.body)}/32"]
   }
-  ingress  {
-      from_port    = 0
-      to_port      = 65535
-      protocol     = "tcp"
-      self         = true
+  ingress {
+    from_port = 0
+    to_port   = 65535
+    protocol  = "tcp"
+    self      = true
   }
   egress {
-      from_port   = 0
-      to_port     = 0
-      protocol    = "-1"
-      cidr_blocks = ["0.0.0.0/0"]
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
   }
-  tags {
-    Name = "prometheus-${terraform.workspace}"
-    Workspace = "${terraform.workspace}"
+  tags = {
+    Name      = "prometheus-${terraform.workspace}"
+    Workspace = terraform.workspace
   }
 }
+
diff --git a/deploy/aws/outputs.tf b/deploy/aws/outputs.tf
index 35ba10ba6..84d9c62a2 100644
--- a/deploy/aws/outputs.tf
+++ b/deploy/aws/outputs.tf
@@ -1,30 +1,32 @@
 output "qed" {
-  value = "${module.qed.public_ip}"
+  value = module.qed.public_ip
 }
 
 output "qed-private" {
-  value = "${module.qed.private_ip}"
+  value = module.qed.private_ip
 }
+
 output "prometheus" {
-  value = "${module.prometheus.public_ip}"
+  value = module.prometheus.public_ip
 }
 
 output "workload" {
-  value = "${module.workload.public_ip}"
+  value = module.workload.public_ip
 }
 
 output "inmemory-storage" {
-  value = "${module.inmemory-storage.public_ip}"
+  value = module.inmemory-storage.public_ip
 }
 
 output "agent-publisher" {
-  value = "${module.agent-publisher.public_ip}"
+  value = module.agent-publisher.public_ip
 }
 
 output "agent-monitor" {
-  value = "${module.agent-monitor.public_ip}"
+  value = module.agent-monitor.public_ip
 }
 
 output "agent-auditor" {
-  value = "${module.agent-auditor.public_ip}"
+  value = module.agent-auditor.public_ip
 }
+
diff --git a/deploy/aws/pre-build/bucket.tf b/deploy/aws/pre-build/bucket.tf
index 34859ee4d..3955f7eb4 100644
--- a/deploy/aws/pre-build/bucket.tf
+++ b/deploy/aws/pre-build/bucket.tf
@@ -14,11 +14,11 @@
    limitations under the License.
 */
 terraform {
-  required_version = ">= 0.11.11"
+  required_version = ">= 0.12.9"
 }
 
 provider "aws" {
-  version = ">= 1.56.0, < 2.0"
+  version = ">= 2.7.0"
   region  = "eu-west-1"
   profile = "${var.aws_profile}"
 }
@@ -47,7 +47,7 @@ resource "aws_s3_bucket" "terraform-qed-cluster" {
     }
   }
 
-  tags {
+  tags = {
     Name = "S3 Remote Terraform State Store"
   }
 }
diff --git a/deploy/aws/variables.tf b/deploy/aws/variables.tf
index 4625f901c..328bd46da 100644
--- a/deploy/aws/variables.tf
+++ b/deploy/aws/variables.tf
@@ -30,3 +30,4 @@ variable "public_subnet_cidr" {
   description = "CIDR of the public subnet"
   default     = "172.31.1.0/24"
 }
+
diff --git a/deploy/provision.sh b/deploy/provision.sh
index 49646f3eb..11091d292 100755
--- a/deploy/provision.sh
+++ b/deploy/provision.sh
@@ -13,7 +13,12 @@
 #  See the License for the specific language governing permissions and
 #  limitations under the License.
 
-export TF_STATE=/tmp/terraform.tfstate
+# TF_STATE must be the realtive or absolute path to the terraform 
+# project directory. This is required due a lack decent multi version
+# tfstate support of the terraform-inventory library.
+# Issue: https://github.com/adammck/terraform-inventory/pull/114
+
+export TF_STATE=../aws
 
 if ! which terraform-inventory
 then
@@ -21,10 +26,7 @@ then
     exit 1
 fi
 
-echo "Pulling terraform remote state to: $TF_STATE"
-cd aws
-terraform state pull > $TF_STATE
-cd ../provision
+cd provision
 
 if [ -z "$@" ];
 then
diff --git a/deploy/provision/clean-restart.yml b/deploy/provision/clean-restart.yml
index ce1467ddc..df412cfa6 100644
--- a/deploy/provision/clean-restart.yml
+++ b/deploy/provision/clean-restart.yml
@@ -149,7 +149,7 @@
     - restart
     - start-agents
 
-- hosts: inmemory-storage
+- hosts: role_storage
   remote_user: ec2-user
   become: true
   vars_files:
@@ -166,7 +166,7 @@
     - restart
     - start-storage
 
-- hosts: workload
+- hosts: role_workload
   remote_user: ec2-user
   gather_facts: true
   become: true
@@ -188,7 +188,7 @@
     - restart
     - start-storage
 
-- hosts: prometheus
+- hosts: role_prometheus
   remote_user: ec2-user
   become: true
   vars_files:
diff --git a/deploy/provision/main.yml b/deploy/provision/main.yml
index 5809824c2..aefef982e 100644
--- a/deploy/provision/main.yml
+++ b/deploy/provision/main.yml
@@ -86,7 +86,7 @@
   tags:
     - install
 
-- hosts: workload
+- hosts: role_workload
   remote_user: ec2-user
   become: true
   vars_files:
@@ -97,7 +97,7 @@
     - install
     - workload
 
-- hosts: inmemory-storage
+- hosts: role_storage
   remote_user: ec2-user
   become: true
   vars_files:
@@ -107,7 +107,7 @@
   tags:
     - install
 
-- hosts: prometheus
+- hosts: role_prometheus
   remote_user: ec2-user
   become: true
   vars_files: