Terraform RDS实例monitoring_role_arn不起作用

Question

我正在尝试使用Terraform创建AWS RDS 数据库实例。我正在尝试使用PostgreSQL 12作为数据库。除了监控部分之外，一切似乎都很好，我无法在脚本中指定“ monitoring_role_arn ”。

\n

以下是我用于创建 PostgreSQL 数据库实例的 Terraform 脚本：

\n

rds.tf

\n

# AWS PSQL RDS Instance \nresource "aws_db_instance" "test-DB" {\n\n  depends_on = [aws_security_group.test-PSQL-DB-SG, aws_iam_role.test-IAM-Role-RDS]\n\n  // General Configurations\n  name                 = "testdb"\n  identifier = "am-poc-spoke1-db"\n  engine               = "postgres"\n  engine_version       = "12.5"\n  instance_class       = "db.t2.micro" \n  parameter_group_name = "default.postgres12"\n  port = "5432"\n\n  // Authentication\n  username             = "postgres"\n  password             = "postgres"\n\n  // Storage Configurations\n  storage_type = "gp2"\n  allocated_storage    = 20\n  max_allocated_storage = 100\n\n  // Networking and Security \n  vpc_security_group_ids = [aws_security_group.test-PSQL-DB-SG.id]\n  availability_zone = "ap-southeast-1a"\n  publicly_accessible = false\n\n  // Backup Configuration\n  backup_retention_period = 7\n  backup_window = "16:00-16:30"\n  copy_tags_to_snapshot = true\n\n  // Monitoring and Performance Insight\n  performance_insights_enabled = true\n  performance_insights_retention_period = 7\n\n  monitoring_interval = "60"\n  monitoring_role_arn = aws_iam_role.test-IAM-Role-RDS.arn\n  enabled_cloudwatch_logs_exports = ["postgresql"]\n\n  // Other Configurations\n  auto_minor_version_upgrade = false\n  deletion_protection = false\n  skip_final_snapshot = true\n\n  tags = {\n    Name = "test-DB"\n  }\n}\n

\n

由于“monitoring_role_arn”需要具有“AmazonRDSEnhancedMonitoringRole”策略的 AWS IAM 角色，因此我也为此创建了一个脚本。

\n

iam 角色.tf

\n

# IAM Role for RDS Enhanced Monitoring\nresource "aws_iam_role" "test-IAM-Role-RDS" {\n\n  name = "test-IAM-Role-RDS"\n  assume_role_policy = jsonencode({\n    Version = "2012-10-17"\n    Statement = [\n      {\n        Action = "sts:AssumeRole"\n        Effect = "Allow"\n        Sid    = ""\n        Principal = {\n          Service = "ec2.amazonaws.com"\n        }\n      },\n    ]\n  })\n\n  tags = {\n    Name = "test-IAM-Role-RDS"\n  }\n}\n

\n

然后将策略添加到 IAM 角色。

\n

iam 角色策略.tf

\n

# IAM Role Policy for RDS Enhanced Monitoring\nresource "aws_iam_role_policy" "test-Enhanced-Monitoring-Policy" {\n\n  depends_on = [aws_iam_role.test-IAM-Role-RDS]\n\n  name = "test-Enhanced-Monitoring-Policy"\n  role = aws_iam_role.test-IAM-Role-RDS.id\n\n  policy = jsonencode({\n    "Version": "2012-10-17",\n    "Statement": [{\n            "Sid": "EnableCreationAndManagementOfRDSCloudwatchLogGroups",\n            "Effect": "Allow",\n            "Action": [\n                "logs:CreateLogGroup",\n                "logs:PutRetentionPolicy"\n            ],\n            "Resource": [\n                "arn:aws:logs:*:*:log-group:RDS*"\n            ]\n        },\n        {\n            "Sid": "EnableCreationAndManagementOfRDSCloudwatchLogStreams",\n            "Effect": "Allow",\n            "Action": [\n                "logs:CreateLogStream",\n                "logs:PutLogEvents",\n                "logs:DescribeLogStreams",\n                "logs:GetLogEvents"\n            ],\n            "Resource": [\n                "arn:aws:logs:*:*:log-group:RDS*:log-stream:*"\n            ]\n        }\n    ]\n  })\n}\n

\n

运行时'terraform plan'没有显示错误。但是一旦我运行'terraform apply'，我就会收到以下错误。

\n

\n

错误：创建数据库实例时出错：InvalidParameterValue：IAM 角色 ARN 值无效或不包含以下权限所需的权限：\nENHANCED_MONITORING \xe2\x94\x82 状态代码：400，请求 ID：\n59e6127d-f39a-453d-885a-868e38415fc1 , {

\n

\n

现在有人如何解决这个问题吗？

\n

Answer 1

没有使用内联策略，而是使用托管策略AmazonRDSEnhancedMonitoringRole。也就是说，我们直接将 AWS 托管策略添加到我们的 IAM 角色中。

此外，我已将服务从IAM 角色更改ec2.amazonaws.com为monitoring.rds.amazonaws.comIAM 角色。该错误实际上是因为我们没有进行此更改而触发的。认为它也适用于内联策略，但我们可以仅使用 AWS 托管策略来避免额外的代码行，而不是创建新的内联策略。

完整变更：

iam.tf

# IAM Role for RDS Enhanced Monitoring
resource "aws_iam_role" "test-IAM-Role-RDS" {

  name = "test-IAM-Role-RDS"
  assume_role_policy = jsonencode({
         Version = "2012-10-17"
          Statement = [
            {
              Action = "sts:AssumeRole"
              Effect = "Allow"
              Sid    = ""
              Principal = {
                Service = "monitoring.rds.amazonaws.com"
             }
            },
          ]
        })

  managed_policy_arns = ["arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole"]

  tags = {
    Name = "test-IAM-Role-RDS"
  }
}