amazon-web-services - 如何部署具有多个角色的 Terraform 模块？

Question

我目前正在开发一个 AWS terraform 项目，其中有一组不同帐户的 ROLE ID(作为变量)。

variable "slave_account_id" {
 default = ["5686435678", "9889865446"]
}

每个角色都允许我当前的 AWS 帐户(与 terraform 链接)在这些帐户上部署模块(假设每个帐户都有角色 ID)

因此，我想根据变量数组“slave_account_id”为每个角色创建不同的提供程序。

我尝试这样做:

provider "aws" {
  counter = "${length(var.slave_account_id)}"

  alias  = "aws-assume-${counter.index}"
  region = "eu-west-1"

  assume_role {
    role_arn     = "arn:aws:iam::${var.slave_account_id[counter.index]}:role/slave_role_for_master"
    session_name = "${var.slave_session_name[counter.index]}"
    external_id  = "EXTERNAL_ID"
  }
}

这样我就计划在我的模块中使用此代码:

module "my_super_module" {
 counter = "${length(var.slave_account_id)}"
 providers = {
   aws = "aws.aws-assume-${counter.index}"
 }

 [...]
}

但这不起作用(据我了解，我无法在提供程序的别名内“连接”变量，因为必须先定义提供程序，然后才能进行插值)。这是执行结果(由于提供程序的别名部分而出错):

Error: Invalid provider configuration alias

An alias must be a valid name. A name must start with a letter and may contain
only letters, digits, underscores, and dashes.


Error: Duplicate provider configuration

  on main.tf line 5:
   5: provider "aws" {

A default (non-aliased) provider configuration for "aws" was already given at
main.tf:1,1-15. If multiple configurations are required, set the "alias"
argument for alternative configurations.


Error: Unsuitable value type

  on main.tf line 8, in provider "aws":
   8:   alias  = "aws-assume-${counter.index}"

Unsuitable value: value must be known


Error: Variables not allowed

  on main.tf line 8, in provider "aws":
   8:   alias  = "aws-assume-${counter.index}"

Variables may not be used here.


Error: Invalid provider configuration reference

  on main.tf line 33, in module "my-lambda":
  33:     aws = "aws.aws-assume-${counter.index}"

A provider configuration reference must not be given in quotes.

所以我有点迷失......

如何部署具有角色 ID 列表的模块(每个帐户一个模块)？

Answer 1

Terraform 中的提供程序配置不可动态构造(即，根据值决定创建哪个)，因为 Terraform 需要在生命周期的早期、图形构建期间以及可以进行表达式求值之前将提供程序与资源关联起来。

相反，我们可以重构问题，以便每个模块采用固定数量的 AWS 提供商(通常是一个，但在某些情况下，如果模块的目的是在两个区域或两个账户之间建立对等互连，则为两个)，然后在根目录中多次实例化模块:

provider "aws" {
  alias = "eu-west-1_5686435678"

  region = "eu-west-1"
  assume_role {
    role_arn     = "arn:aws:iam::acct5686435678:role/admin"
    session_name = "whatever_session_name"
    external_id  = "EXTERNAL_ID"
  }
}

provider "aws" {
  alias = "eu-west-1_9889865446"

  region = "eu-west-1"
  assume_role {
    role_arn     = "arn:aws:iam::acct9889865446:role/admin"
    session_name = "whatever_session_name"
    external_id  = "EXTERNAL_ID"
  }
}

module "acct5686435678" {
  source = "./modules/aws-account"

  providers = {
    aws = aws.eu-west-1_5686435678
  }
}

module "acct9889865446" {
  source = "./modules/aws-account"

  providers = {
    aws = aws.eu-west-1_9889865446
  }
}


module "peering_5686435678_9889865446" {
  source = "./modules/aws-account-peering"

  providers = {
    aws.from = aws.eu-west-1_5686435678
    aws.to   = aws.eu-west-1_9889865446
  }
}

对于必须在多个 AWS 账户或多个 AWS 区域创建相同基础设施的情况，多次实例化同一模块是一种常见技术。

话虽如此，如果多个 AWS 账户代表单独的环境，而不是环境中的单独组件，则通常最好在每个环境中使用单独的根配置，同时仍共享模块，以便对每个环境的更新完全分开，每个环境都有自己的状态等。