Terraform data

Author: stevebux

infrastructure/terraform/components/api/api_gateway_base_path_mapping.tf

@@ -3,3 +3,26 @@ resource "aws_api_gateway_base_path_mapping" "main" {
   stage_name  = aws_api_gateway_stage.main.stage_name
   domain_name = aws_api_gateway_domain_name.main.domain_name
 }
+
+# AWS requires base path mappings to be removed before the associated stage can
+# be deleted. Terraform's implicit dependency ordering is not sufficient when the
+# REST API is being replaced. This resource explicitly deletes the base path
+# mapping via the AWS CLI as a destroy-time action, before the stage is torn down.
+resource "terraform_data" "delete_base_path_mapping" {
+  triggers_replace = [aws_api_gateway_base_path_mapping.main.id]
+
+  provisioner "local-exec" {
+    when    = destroy
+    command = <<-EOT
+      aws apigateway delete-base-path-mapping \
+        --region ${self.input.region} \
+        --domain-name ${self.input.domain_name} \
+        --base-path "(none)" 2>/dev/null || true
+    EOT
+  }
+
+  input = {
+    region      = var.region
+    domain_name = aws_api_gateway_domain_name.main.domain_name
+  }
+}

infrastructure/terraform/components/api/api_gateway_rest_api.tf

@@ -5,7 +5,6 @@ resource "aws_api_gateway_rest_api" "main" {
   disable_execute_api_endpoint = var.disable_gateway_execute_endpoint
 
   lifecycle {
-    replace_triggered_by  = [terraform_data.rest_api_security_policy]
-    create_before_destroy = true
+    replace_triggered_by = [terraform_data.rest_api_security_policy]
   }
 }