Terraform ELB access_log S3访问权限问题

Question

当我尝试为我的elb access_log创建s3存储桶时，terraform出现问题，我在下面得到以下错误：

Error applying plan:

1 error(s) occurred:

* module.elb-author-dev.aws_elb.elb: 1 error(s) occurred:

* aws_elb.elb: Failure configuring ELB attributes: InvalidConfigurationRequest: Access Denied for bucket: my-elb-access-log. Please check S3bucket permission
status code: 409, request id: 13c63697-c016-11e7-8978-67fad50955bd

但是，如果我转到AWS控制台并手动将s3 Public访问权限授予所有人。重新运行terraform应用效果很好，请帮助我解决此问题。

我的main.tf文件

module "s3-access-logs" {
  source = "../../../../modules/aws/s3"

  s3_bucket_name       = "my-elb-access-data"
  s3_bucket_acl        = "private"
  s3_bucket_versioning = true
  s3_bucket_region = "us-east-2"
}
 # elastic load balancers (elb)
module "elb-author-dev" {
  source           = "../../../../modules/aws/elb"
  elb_sgs          = "${module.secgrp-elb-nonprod-
author.security_group_id}"
  subnets          = ["subnet-a7ec0cea"]
  application_tier    = "auth"
  access_logs_enabled = true
  access_logs_bucket  = "my-elb-access-log"  
  access_logs_prefix  = "dev-auth-elb-access-log" 
 access_logs_interval = "5"
 instances           = ["${module.ec2-author-dev.ec2_instance[0]}"]
}

我的s3 / main.tf

  resource "aws_s3_bucket" "s3_data_bucket" {
    bucket = "${var.s3_bucket_name}"
    acl    = "${var.s3_bucket_acl}" #"public"

    region = "${var.s3_bucket_region}"

   policy = <<EOF
  {
   "Id": "Policy1509573454872",
   "Version": "2012-10-17",
   "Statement": [
   {
      "Sid": "Stmt1509573447773",
      "Action": "s3:PutObject",
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::my-elb-access-log/dev-auth-elb/AWSLogs/my_account_id/*",
      "Principal": {
      "AWS": [
          "033677994240"
        ]
      }
    }
  ]
}
EOF

  versioning {
    enabled = "${var.s3_bucket_versioning}" #true
  }
  tags {
    Name        = "${var.s3_bucket_name}"
    Terraform   = "${var.terraform_tag}"
 }
}

我的elb.main.tf

  access_logs {
    enabled       = "${var.access_logs_enabled}"  #false
    bucket        = "${var.access_logs_bucket}"
    bucket_prefix = "${var.environment_name}-${var.application_tier}-${var.access_logs_prefix}"
    interval      = "${var.access_logs_interval}"  #60
  }

Answer 1

AWS Bucket权限

您需要授予对ELB主体的访问权限。每个地区都有不同的主体。

区域，ELB帐户主体ID

us-east-1，127311923021

us-east-2，033677994240

us-west-1，027434742980

us-west-2，797873946194

ca-central-1，985666609251

eu-west-1，156460612806

eu-central-1，054676820928

eu-west-2，652711504416

ap-northeast-1，582318560864

ap-northeast-2，600734575887

ap-southeast-1，114774131450

ap-southeast-2，783225319266

ap-south-1，718504428378

sa-east-1，507241528517

us-gov-west-1 *，048591011584

cn-north-1 *，638102146993

* 这些地区需要一个单独的帐户。

来源： AWS访问日志记录存储桶权限

地貌

在terraform中，您的资源配置应类似于以下示例。您将需要上表中的aws帐户ID和本金ID：

resource "aws_s3_bucket" "s3_data_bucket" {
    bucket = "${var.s3_bucket_name}"
    acl    = "${var.s3_bucket_acl}"
    region = "${var.s3_bucket_region}"

    policy =<<EOF
{
"Id": "Policy1509573454872",
"Version": "2012-10-17",
"Statement": [
    {
    "Sid": "Stmt1509573447773",
    "Action": "s3:PutObject",
    "Effect": "Allow",
    "Resource": "arn:aws:s3:::my-elb-access-data/dev-auth-elb/AWSLogs/your-account-id/*",
    "Principal": {
        "AWS": ["principal_id_from_table_above"]
    }
    }
]
}
EOF
}

您可能需要单独拆分策略，而不是像上面那样保持内联。在这种情况下，您需要添加存储桶策略资源，如下所示：

resource "aws_s3_bucket_policy" "elb_access_logs" {
  bucket = "${aws_s3_bucket.s3_data_bucket.id}"
  policy =<<EOF
{
"Id": "Policy1509573454872",
"Version": "2012-10-17",
"Statement": [
    {
    "Sid": "Stmt1509573447773",
    "Action": "s3:PutObject",
    "Effect": "Allow",
    "Resource": "arn:aws:s3:::my-elb-access-data/dev-auth-elb/AWSLogs/your-account-id/*",
    "Principal": {
        "AWS": ["principal_id_from_table_above"]
    }
    }
]
}
EOF
}