amazon-web-services - Terraform - 启用访问负载平衡器日志 InvalidConfigurationRequest : Access Denied for bucket

Question

我正在使用 Terraform 配置 ELB，并希望在 S3 存储桶中为 ELB 启用访问日志。当我尝试应用资源时，出现以下错误 - InvalidConfiguration: Access Denied for bucket:

下面是我的 TF 资源，其中包含使用 IAM 策略文档创建的 S3 存储桶策略。

resource "aws_lb" "this" {
  name               = var.name
  load_balancer_type = "application"

  access_logs {
    bucket  = aws_s3_bucket.this.bucket
    prefix  = var.name
    enabled = true
  }
}

resource "aws_s3_bucket" "this" {
  bucket        = "${var.bucket_name}"
  acl           = "log-delivery-write"
  force_destroy = true

}

resource "aws_s3_bucket_policy" "this" {
  bucket = "aws_s3_bucket.this.id"
  policy = "${data.aws_iam_policy_document.s3_bucket_lb_write.json}"
}


data "aws_iam_policy_document" "s3_bucket_lb_write" {
  policy_id = "s3_bucket_lb_logs"

  statement {
    actions = [
      "s3:PutObject",
    ]
    effect = "Allow"
    resources = [
      "${aws_s3_bucket.this.arn}/*",
    ]

    principals {
      identifiers = ["${data.aws_elb_service_account.main.arn}"]
      type        = "AWS"
    }
  }

  statement {
    actions = [
      "s3:PutObject"
    ]
    effect = "Allow"
    resources = ["${aws_s3_bucket.this.arn}/*"]
    principals {
      identifiers = ["delivery.logs.amazonaws.com"]
      type        = "Service"
    }
  }


  statement {
    actions = [
      "s3:GetBucketAcl"
    ]
    effect = "Allow"
    resources = ["${aws_s3_bucket.this.arn}"]
    principals {
      identifiers = ["delivery.logs.amazonaws.com"]
      type        = "Service"
    }
  }
}

output "bucket_name" {
  value = "${aws_s3_bucket.this.bucket}"
}

出现以下错误

Error: Error putting S3 policy: NoSuchBucket: The specified bucket does not exist
        status code: 404, request id: 5932CFE816059A8D, host id: j5ZBQ2ptHXivx+fu7ai5jbM8PSQR2tCFo4IAvcLkuocxk8rn/r0TG/6YbfRloBFR2WSy8UE7K8Q=

Error: Failure configuring LB attributes: InvalidConfigurationRequest: Access Denied for bucket: test-logs-bucket-xyz. Please check S3bucket permission
        status code: 400, request id: ee101cc2-5518-42c8-9542-90dd7bb05e3c

地形版本Terraform v0.12.23

• provider.aws v3.6.0

Answer 1

错误在:

resource "aws_s3_bucket_policy" "this" {
  bucket = "aws_s3_bucket.this.id"
  policy = "${data.aws_iam_policy_document.s3_bucket_lb_write.json}"
}

应该是:

resource "aws_s3_bucket_policy" "this" {
  bucket = aws_s3_bucket.this.id
  policy = data.aws_iam_policy_document.s3_bucket_lb_write.json
}

原始版本 (bucket = "aws_s3_bucket.this.id") 只会尝试查找字面上称为“aws_s3_bucket.this.id”的存储桶。