terraform 和 kms 关键别名

Question

我正在使用 aws 提供程序并尝试使用加密卷创建 aws_workspaces_workspace 。

我创建了一个带有关联别名 (aws_kms_alias) 的 aws_kms_key。

我为volume_encryption_key指定了密钥别名（作为字符串）。资源已按预期创建，我可以在控制台中验证卷是否已使用指定密钥加密。

我的问题是，每次重新运行 terraform apply 时，terraform 都会报告由于键值更新（从键 id 到别名）而需要替换 aws_workspaces_workspace

我怎样才能防止这种形式的发生？这是一个错误吗？我做错了什么吗？一些相关代码如下。

resource "aws_workspaces_workspace" "workspace" {
    directory_id = aws_workspaces_directory.ws-ad.id
    bundle_id    = var.bundle_id
    user_name    = var.username

    root_volume_encryption_enabled = true
    user_volume_encryption_enabled = true
    volume_encryption_key          = "alias/workspace-volume"

    workspace_properties {
        compute_type_name                         = "POWER"
        user_volume_size_gib                      = 80
        root_volume_size_gib                      = 50
        running_mode                              = "AUTO_STOP"
        running_mode_auto_stop_timeout_in_minutes = 60
    }
}

resource "aws_kms_key" "kms-ws-volume" {
    description             = "Workspace Volume Encryption Key"
    key_usage               = "ENCRYPT_DECRYPT"
    deletion_window_in_days = 30
    is_enabled              = true
}

resource "aws_kms_alias" "kms-ws-volume-alias" {
    name          = "alias/workspace-volume"
    target_key_id = aws_kms_key.kms-ws-volume.key_id
}

以下是 terraform apply 报告的内容：

  # aws_workspaces_workspace.workspace["1"] must be replaced
-/+ resource "aws_workspaces_workspace" "workspace" {
      ~ computer_name                  = "WSAMZN-T34E23BK" -> (known after apply)
      ~ id                             = "ws-v98b0y17z" -> (known after apply)
      ~ ip_address                     = "10.0.0.45" -> (known after apply)
      ~ state                          = "STOPPED" -> (known after apply)
        tags                           = {
            "Name"    = "workspace-user1-env1"
            "Owner"   = "mario"
            "Profile" = "dev"
            "Stack"   = "env1"
        }
      ~ volume_encryption_key          = "arn:aws:kms:us-west-2:927743275319:key/09de3db9-ecdd-4be1-a781-705fdd0294f9" -> "alias/workspace-volume" # forces replacement
        # (6 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

Answer 1

使用密钥的 ARN：aws_kms_key.kms-ws-volume.arn

volume_encryption_key存储密钥的 ARN，因此计划检测到更改。

尽管别名也可以使用，但https://registry.terraform.io/providers/hcavarsan/aws/latest/docs/resources/workspaces_workspace上的示例在这方面可能会产生误导。

aws_instance 的kms_key_id会发生类似的情况，因为它存储 ARN 而不是 key_id ，并且当使用 key_id 而不是 ARN 时，计划始终需要替换卷。https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance#kms_key_id