ssl-certificate - Terraform 不断强制重新创建 aws_iam_server_certificate 资源

Question

✦ ➜ terraform --version                       
Terraform v0.12.28
+ provider.aws v2.60.0
+ provider.kubernetes v1.11.3
+ provider.local v1.4.0
+ provider.null v2.1.2
+ provider.random v2.2.1
+ provider.template v2.1.2

只需为 SSL 证书添加 2 个新文件

  # module.ssl-certificate.aws_iam_server_certificate.cert must be replaced
+/- resource "aws_iam_server_certificate" "cert" {
      ~ arn               = "arn:aws:iam::XXX:server-certificate/xxx-ssl-certxxx" -> (known after apply)
      ~ certificate_body  = "721e444119806928d19ef830740057c52580ba71" -> "cd6882dff1edb0223a20fe5f1c2b4b594f07526f" # forces replacement
      - certificate_chain = "7e85cb3e40dff5a9f83ff75576d71fd98fdfdd89" -> null # forces replacement
      ~ id                = "XXX" -> (known after apply)
      ~ name              = "XXX-ssl-cert20200716210119477600000001" -> (known after apply)
        name_prefix       = "XXX-ssl-cert"
        path              = "/"
        private_key       = (sensitive value)
    }

每次我运行 terraform apply 时，我总是要求“替换”证书。每次创建一个新的。

文件(crt， key )没有改变

/main.tf

module "ssl-certificate" {
  source = "./modules/certificates"
  certificate = {
    name        = "xxx-ssl-cert"
    body        = file("assets/ssl/_.xxx.com/xxx.crt")
    private_key = file("assets/ssl/_.xxx.com/xxx.key")
  }
  team        = var.team
  project     = var.project
  component   = ""
  environment = var.environment
  tags        = module.project_config.tags
}

/modules/certificates/main.tf

resource "aws_iam_server_certificate" "cert" {
  name_prefix      = var.certificate.name
  certificate_body = var.certificate.body
  private_key      = var.certificate.private_key

  lifecycle {
    create_before_destroy = true
  }
}

怎么了？在此之前，我有自签名证书，但从未有过这种行为。添加了新证书 - 并开始在申请中获取这些“重新创建”所需的计划。

有什么想法吗？

Answer 1

我建议对 ignore_changes 使用生命周期。

Example:   lifecycle {
    ignore_changes = [certificate_body]
  }