amazon-cognito - 如何使用 terraform 修复认知用户池域破坏，以便可以重新创建用户池？

Question

我正在使用 terraform 创建 Cognito 用户池、用户池客户端和域。
如果 Cognito 用户池(例如属性)有更新，则 terraform 需要销毁并重新创建这三个资源，但是在销毁 aws_cognito_user_pool_domain 期间 terraform apply 失败并出现错误:
InvalidParameter: 发现 1 个验证错误。
- 最小字段大小为 1，DeleteUserPoolDomainInput.UserPoolId。

地形版本:0.11.11
aws 提供程序版本:1.52.0

我曾尝试手动删除域并运行 terraform plan/apply 但随后失败并显示“InvalidParameterException:不存在此类域或用户池”。

resource "aws_cognito_user_pool" "admin_cognito_pool" {
  name = "dev-admin-pool"
  alias_attributes    = ["email"]
  auto_verified_attributes = ["email"]
  admin_create_user_config = {
    allow_admin_create_user_only = true
  }
}

resource "aws_cognito_user_pool_client" "admin_cognito_pool_client" {
  name = "dev-admin-pool-client"
  user_pool_id = "${aws_cognito_user_pool.admin_cognito_pool.id}"
  generate_secret     = false
...
}

resource "aws_cognito_user_pool_domain" "admin_cognito_domain" { 
  domain       = "demo-dev"
  user_pool_id = "${aws_cognito_user_pool.admin_cognito_pool.id}" 
}

以上代码将成功创建用户池、用户池客户端、用户池域。

接下来修改上面代码中的aws_cognito_user_pool并运行terraform plan/apply

resource "aws_cognito_user_pool" "admin_cognito_pool" {
  name = "dev-admin-pool"
  alias_attributes    = ["email"]
  auto_verified_attributes = ["email"]
  admin_create_user_config = {
    allow_admin_create_user_only = true
  }
  schema  = [
    {
      attribute_data_type = "String",
      name                = "family_name",
      required            = true,
      mutable             = true,
      string_attribute_constraints {
          min_length = 6
          max_length = 32
      }
    },            
  ]
}

地形计划:

-/+ module.aws-383.aws_cognito_user_pool.admin_cognito_pool (new resource required)
      id:                                                      "ap-southeast-2_CFPLxLl5A" => <computed> (forces new resource)
      admin_create_user_config.#:                              "1" => "1"
      admin_create_user_config.0.allow_admin_create_user_only: "true" => "true"
      admin_create_user_config.0.unused_account_validity_days: "7" => "7"
      alias_attributes.#:                                      "" => "1" (forces new resource)
      alias_attributes.881205744:                              "" => "email" (forces new resource)
      arn:                                                     "arn:aws:cognito-idp:ap-southeast-2:xxxxxxxx:userpool/ap-southeast-2_CFPLxLl5A" => <computed>
      auto_verified_attributes.#:                              "1" => "1"
      auto_verified_attributes.881205744:                      "email" => "email"
      creation_date:                                           "2018-12-19T04:49:06Z" => <computed>
      email_verification_message:                              "" => <computed>
      email_verification_subject:                              "" => <computed>
      endpoint:                                                "cognito-idp.ap-southeast-2.amazonaws.com/ap-southeast-2_CFPLxLl5A" => <computed>
      lambda_config.#:                                         "0" => <computed>
      last_modified_date:                                      "2018-12-19T04:49:06Z" => <computed>
      mfa_configuration:                                       "OFF" => "OFF"
      name:                                                    "dev-admin-pool" => "dev-admin-pool"
      password_policy.#:                                       "1" => <computed>
      schema.#:                                                "0" => "1" (forces new resource)
      schema.893014206.attribute_data_type:                    "" => "String" (forces new resource)
      schema.893014206.developer_only_attribute:               "" => ""
      schema.893014206.mutable:                                "" => "true" (forces new resource)
      schema.893014206.name:                                   "" => "family_name" (forces new resource)
      schema.893014206.number_attribute_constraints.#:         "" => "0"
      schema.893014206.required:                               "" => "true" (forces new resource)
      schema.893014206.string_attribute_constraints.#:         "" => "0"
      verification_message_template.#:                         "1" => <computed>

-/+ module.aws-383.aws_cognito_user_pool_client.admin_cognito_pool_client (new resource required)
      id:                                                      "2tsed339bl6ds4437n1h0hasr4" => <computed> (forces new resource)
      allowed_oauth_flows.#:                                   "2" => "2"
      allowed_oauth_flows.2645166319:                          "code" => "code"
      allowed_oauth_flows.3465961881:                          "implicit" => "implicit"
      allowed_oauth_flows_user_pool_client:                    "true" => "true"
      allowed_oauth_scopes.#:                                  "2" => "2"
      allowed_oauth_scopes.2517049750:                         "openid" => "openid"
      allowed_oauth_scopes.881205744:                          "email" => "email"
      callback_urls.#:                                         "1" => "1"
      callback_urls.0:                                         "https://qnq2ds22xg.execute-api.ap-southeast-2.amazonaws.com/staging/admin-portal/redirectUrl/" => "https://qnq2ds22xg.execute-api.ap-southeast-2.amazonaws.com/staging/admin-portal/redirectUrl/"
      client_secret:                                           "" => <computed>
      explicit_auth_flows.#:                                   "2" => "2"
      explicit_auth_flows.1860959087:                          "USER_PASSWORD_AUTH" => "USER_PASSWORD_AUTH"
      explicit_auth_flows.245201344:                           "ADMIN_NO_SRP_AUTH" => "ADMIN_NO_SRP_AUTH"
      generate_secret:                                         "false" => "false"
      name:                                                    "dev-admin-pool-client" => "dev-admin-pool-client"
      refresh_token_validity:                                  "30" => "30"
      supported_identity_providers.#:                          "1" => "1"
      supported_identity_providers.0:                          "COGNITO" => "COGNITO"
      user_pool_id:                                            "ap-southeast-2_CFPLxLl5A" => "${aws_cognito_user_pool.admin_cognito_pool.id}" (forces new resource)

-/+ module.aws-383.aws_cognito_user_pool_domain.admin_cognito_domain (new resource required)
      id:                                                      "demo-dev" => <computed> (forces new resource)
      aws_account_id:                                          "" => <computed>
      cloudfront_distribution_arn:                             "" => <computed>
      domain:                                                  "demo-dev" => "demo-dev"
      s3_bucket:                                               "" => <computed>
      user_pool_id:                                            "" => "${aws_cognito_user_pool.admin_cognito_pool.id}" (forces new resource)
      version:                                                 "" => <computed>

terraform 的确切错误适用 -

[...]
module.aws-383.aws_cognito_user_pool_client.admin_cognito_pool_client: Destroying... (ID: 2tsed339bl6ds4437n1h0hasr4)
module.aws-383.aws_cognito_user_pool_domain.admin_cognito_domain: Destroying... (ID: demo-dev)
module.aws-383.aws_cognito_user_pool_client.admin_cognito_pool_client: Destruction complete after 0s

Error: Error applying plan:

1 error(s) occurred:

* module.aws-383.aws_cognito_user_pool_domain.admin_cognito_domain (destroy): 1 error(s) occurred:

* aws_cognito_user_pool_domain.admin_cognito_domain: InvalidParameter: 1 validation error(s) found.
- minimum field size of 1, DeleteUserPoolDomainInput.UserPoolId.

Terraform 应该能够销毁认知用户池域，这将允许重新创建资源。

Answer 1

目前 terraform 中有一个错误可以防止这种情况:https://github.com/terraform-providers/terraform-provider-aws/issues/5313

解决方案是手动删除它(aws cli 或控制台)，然后使用 state command 手动将其从 terraform 状态中删除。 .