使用带有 Terraform 的环境变量的代码管道错误答案

【问题标题】：Codepipeline Error using Environment Variables with Terraform使用带有 Terraform 的环境变量的代码管道错误
【发布时间】：2022-08-19 19:55:46
【问题描述】：

所以我在使用 AWS Codepipeline 时遇到了错误：

错误：创建 CodePipeline 时出错：ValidationException： ActionConfiguration Map 值必须满足约束：[Member must 长度小于或等于 1000，成员必须有一个长度大于或等于 1]

谷歌它告诉我我有太多的管道环境变量。它告诉我我的字符数限制为 1000 个字符。我不确定这意味着什么，是不是意味着我的环境变量值不能超过 100 个字符，还是意味着构成环境变量的 json 不能超过 1000 个字符？

感谢这里的帮助。

根据要求的 Terraform 代码：

resource \"aws_codepipeline\" \"cp_plan_pipeline\" {
  name       = \"${local.cp_name}-cp\"
  role_arn   = aws_iam_role.cp_service_role.arn

  artifact_store {
    type     = var.cp_artifact_type
    location = module.S3.bucket_name
  }

  stage {
    name = \"Initialize\"

    action {
      run_order           = 1  
      name                = \"Source\"
      category            = \"Source\"
      owner               = \"AWS\"
      provider            = \"CodeCommit\"
      version             = \"1\"
      input_artifacts     = [] 
      output_artifacts    = [\"CodeWorkspace\"]

      configuration = {
        RepositoryName        = var.cp_repo_name
        BranchName            = var.cp_branch_name
        PollForSourceChanges  = var.cp_poll_sources
        OutputArtifactFormat  = var.cp_ouput_format
      }
    }
  }

  stage {
    name = \"Build\"

    action {
      run_order           = 1
      name                = \"Combine_Binaries\"
      category            = \"Build\"
      owner               = \"AWS\"
      provider            = \"CodeBuild\"
      version             = \"1\"
      namespace           = \"BINARYVARIABLE\"
      input_artifacts     = [\"CodeWorkspace\"]
      output_artifacts    = [\"CodeSource\"]

      configuration = {
        ProjectName          = var.cp_binary_project_name
        EnvironmentVariables = jsonencode([
          {
            name  = \"PIPELINE_EXECUTION_ID\"
            type  = \"PLAINTEXT\"
            value = \"#{codepipeline.PipelineExecutionId}\"
          },
          {
            name  = \"PL_BUCKET_KEY\"
            type  = \"PLAINTEXT\"
            value = \"global/state/${var.bucketlocation}/\"
          },
          {
            name  = \"PL_DYNAMODB_TABLE_NAME\"
            type  = \"PLAINTEXT\"
            value = \"${var.project}-${var.env}-${var.tenant}-db-${var.bucketlocation}\"
          },
          {
            name  = \"PL_JQ_VERSION\"
            type  = \"PLAINTEXT\"
            value = var.JQ_VER
          },
          {
            name  = \"PL_PY_VERSION\"
            type  = \"PLAINTEXT\"
            value = var.PY_VER
          },
          {
            name  = \"PL_GO_VERSION\"
            type  = \"PLAINTEXT\"
            value = var.TF_VER
          },                                                
          {
            name  = \"PL_TF_VERSION\"
            type  = \"PLAINTEXT\"
            value = var.TF_VER
          },
          {
            name  = \"PL_GROUP_NAME\"
            type  = \"PLAINTEXT\"
            value = var.group_name
          },
          {
            name  = \"PL_GROUP_EMAIL\"
            type  = \"PLAINTEXT\"
            value = var.group_email
          },
          {
            name  = \"PL_PROJECT\"
            type  = \"PLAINTEXT\"
            value = var.project
          },
          {
            name  = \"PL_TENANT\"
            type  = \"PLAINTEXT\"
            value = var.tenant
          },
          {
            name  = \"PL_APPENV\"
            type  = \"PLAINTEXT\"  
            value = \"\"
          },
          {
            name  = \"PL_AWSACCOUNTNAME\"
            type  = \"PLAINTEXT\"
            value = \"\"
          },
          {
            name  = \"PL_AWSACCOUNTNUMB\"
            type  = \"PLAINTEXT\"
            value = \"\"
          },
          {
            name  = \"PL_PERMISSION_SETS_DIR\"
            type  = \"PLAINTEXT\"  
            value = \"\"
          },
        ])
      }
    }
  }

  stage {
    name = \"Code_Validation\"

    action {
      run_order         = 1           
      name              = \"Build_Lint_Py\"
      category          = \"Build\"
      owner             = \"AWS\"
      provider          = \"CodeBuild\"
      version           = \"1\"
      input_artifacts   = [\"CodeSource\"]
      output_artifacts  = [\"pyReport\"]

      configuration = {
        ProjectName          = var.cp_lintpy_project_name
        EnvironmentVariables = jsonencode([
          {
            name  = \"PIPELINE_EXECUTION_ID\"
            type  = \"PLAINTEXT\"
            value = \"#{codepipeline.PipelineExecutionId}\"
          },
          {
            name  = \"PL_PY_VERSION\"
            type  = \"PLAINTEXT\"
            value = \"#{BINARYVARIABLE.PL_PY_VERSION}\"
          },
          {
            name  = \"PL_PERMISSION_SETS_DIR\"
            type  = \"PLAINTEXT\"  
            value = \"#{BINARYVARIABLE.PL_PERMISSION_SETS_DIR}\"
          },
        ])
      }
    }

    action {
      run_order         = 1           
      name              = \"Build_TF_Plan\"
      category          = \"Build\"
      owner             = \"AWS\"
      provider          = \"CodeBuild\"
      version           = \"1\"
      input_artifacts   = [\"CodeSource\"]
      output_artifacts  = [\"buildPlan\"]
        
      configuration = {
        ProjectName          = var.cp_build_tf_validate
        #PrimarySource        = \"CodeSource\"
        EnvironmentVariables = jsonencode([
          {
            name  = \"PIPELINE_EXECUTION_ID\"
            type  = \"PLAINTEXT\"
            value = \"#{codepipeline.PipelineExecutionId}\"
          },
          {
            name  = \"PL_APP_NAME\"
            type  = \"PLAINTEXT\"
            value = var.bucketlocation
          },
          {
            name  = \"PL_BUCKET_KEY\"
            type  = \"PLAINTEXT\"
            value = \"#{BINARYVARIABLE.PL_BUCKET_KEY}\"
          },
          {
            name  = \"PL_DYNAMODB_TABLE_NAME\"
            type  = \"PLAINTEXT\"
            value = \"#{BINARYVARIABLE.PL_DYNAMODB_TABLE_NAME}\"
          },
          {
            name  = \"PL_JQ_VERSION\"
            type  = \"PLAINTEXT\"
            value = \"#{BINARYVARIABLE.PL_JQ_VERSION}\"
          },
          {
            name  = \"PL_PY_VERSION\"
            type  = \"PLAINTEXT\"
            value = \"#{BINARYVARIABLE.PL_PY_VERSION}\"
          },
          {
            name  = \"PL_TF_VERSION\"
            type  = \"PLAINTEXT\"
            value = \"#{BINARYVARIABLE.PL_TF_VERSION}\"
          },
          {
            name  = \"PL_GROUP_NAME\"
            type  = \"PLAINTEXT\"
            value = \"#{BINARYVARIABLE.PL_GROUP_NAME}\"
          },
          {
            name  = \"PL_GROUP_EMAIL\"
            type  = \"PLAINTEXT\"
            value = \"#{BINARYVARIABLE.PL_GROUP_EMAIL}\"
          },
          {
            name  = \"PL_PROJECT\"
            type  = \"PLAINTEXT\"
            value = \"#{BINARYVARIABLE.PL_PROJECT}\"
          },
          {
            name  = \"PL_TENANT\"
            type  = \"PLAINTEXT\"
            value = \"#{BINARYVARIABLE.PL_TENANT}\"
          },
          {
            name  = \"PL_APPENV\"
            type  = \"PLAINTEXT\"  
            value = \"#{BINARYVARIABLE.PL_APPENV}\"
          },
          {
            name  = \"PL_AWSACCOUNTNUMB\"
            type  = \"PLAINTEXT\"
            value = \"#{BINARYVARIABLE.PL_AWSACCOUNTNUMB}\"
          },
          {
            name  = \"PL_PERMISSION_SETS_DIR\"
            type  = \"PLAINTEXT\"  
            value = \"#{BINARYVARIABLE.PL_PERMISSION_SETS_DIR}\"
          },
        ])
      }
    }

    action {
      run_order         = 1           
      name              = \"Build_Lint_TF\"
      category          = \"Build\"
      owner             = \"AWS\"
      provider          = \"CodeBuild\"
      version           = \"1\"
      input_artifacts   = [\"CodeSource\"]
      output_artifacts  = [\"tfReport\"]

      configuration = {
        ProjectName          = var.cp_linttf_project_name
        #PrimarySource        = \"CodeSource\"
        EnvironmentVariables = jsonencode([
          {
            name  = \"PIPELINE_EXECUTION_ID\"
            type  = \"PLAINTEXT\"
            value = \"#{codepipeline.PipelineExecutionId}\"
          },
          {
            name  = \"PL_BUCKET_KEY\"
            type  = \"PLAINTEXT\"
            value = \"#{BINARYVARIABLE.PL_BUCKET_KEY}\"
          },
          {
            name  = \"PL_DYNAMODB_TABLE_NAME\"
            type  = \"PLAINTEXT\"
            value = \"#{BINARYVARIABLE.PL_DYNAMODB_TABLE_NAME}\"
          },
          {
            name  = \"PL_TF_VERSION\"
            type  = \"PLAINTEXT\"
            value = var.TF_VER
          },
          {
            name  = \"PL_TF_LINT_VERSION\"
            type  = \"PLAINTEXT\"
            value = \"#{BINARYVARIABLE.PL_TF_LINT_VERSION}\"
          },
          {
            name  = \"PL_PERMISSION_SETS_DIR\"
            type  = \"PLAINTEXT\"  
            value = \"#{BINARYVARIABLE.PL_PERMISSION_SETS_DIR}\"
          },
        ])
      }
    }
  }

  stage {
    name = \"Test\"

    action {
      run_order         = 1        
      name              = \"Static_Analysis_Py\"
      category          = \"Test\"
      owner             = \"AWS\"
      provider          = \"CodeBuild\"
      version           = \"1\"
      input_artifacts   = [\"CodeSource\"]
      output_artifacts  = [\"pySecReport\"]

      configuration = {
        ProjectName          = var.cp_test_static_py
        PrimarySource        = \"CodeSource\"
        EnvironmentVariables = jsonencode([
          {
            name  = \"PIPELINE_EXECUTION_ID\"
            type  = \"PLAINTEXT\"
            value = \"#{codepipeline.PipelineExecutionId}\"
          },
          {
            name  = \"PL_JQ_VERSION\"
            type  = \"PLAINTEXT\"
            value = \"#{BINARYVARIABLE.PL_JQ_VERSION}\"
          },
          {
            name  = \"PL_PY_VERSION\"
            type  = \"PLAINTEXT\"
            value = \"#{BINARYVARIABLE.PL_PY_VERSION}\"
          },
          {
            name  = \"PL_PERMISSION_SETS_DIR\"
            type  = \"PLAINTEXT\"  
            value = \"#{BINARYVARIABLE.PL_PERMISSION_SETS_DIR}\"
          },
        ])
      }
    }

    action {
      run_order         = 1        
      name              = \"Static_Analysis_TFSec\"
      category          = \"Test\"
      owner             = \"AWS\"
      provider          = \"CodeBuild\"
      version           = \"1\"
      namespace         = \"TESTVARIABLE\"
      input_artifacts   = [\"CodeSource\"]
      output_artifacts  = [\"tfSecReport\"]

      configuration = {
        ProjectName          = var.cp_test_static_tf
        #PrimarySource        = \"CodeSource\"
        EnvironmentVariables = jsonencode([
          {
            name  = \"PIPELINE_EXECUTION_ID\"
            type  = \"PLAINTEXT\"
            value = \"#{codepipeline.PipelineExecutionId}\"
          },
          {
            name  = \"PL_JQ_VERSION\"
            type  = \"PLAINTEXT\"  
            value = \"#{BINARYVARIABLE.PL_JQ_VERSION}\"
          },
          {
            name  = \"PL_TFSEC_VERSION\"
            type  = \"PLAINTEXT\"
            value = \"#{BINARYVARIABLE.PL_TFSEC_VERSION}\"
          },
          {
            name  = \"PL_PERMISSION_SETS_DIR\"
            type  = \"PLAINTEXT\"  
            value = \"#{BINARYVARIABLE.PL_PERMISSION_SETS_DIR}\"
          },
          #{
          #  name  = \"PL_ARTIFACTBUCKET\"
          #  type  = \"PLAINTEXT\"  
          #  value = \"${var.project}-${var.env}-${var.tenant}-${var.cp_name}-cp-artifacts\"
          #},  
          #{
          #  name  = \"PL_TFSECAPPROVALLINK\"
          #  type  = \"PLAINTEXT\"  
          #  value = \"\"
          #},
        ])
      }
    }
  }

  stage {
    name = \"Manual_Approval_Action\"

    action {
      run_order           = 1
      name                = \"Manual_Review_Action-${var.project}-${var.env}-${var.tenant}-${var.cp_name}\"
      category            = \"Approval\"
      owner               = \"AWS\"
      provider            = \"Manual\"
      version             = \"1\"
      input_artifacts     = []
      output_artifacts    = []

      configuration  = {
        NotificationArn       = module.sns_cp.op_sns_topic_arn
        CustomData            = \"Please review the static code analysis and the repoistory before code is deployed.\"
      }
    }
  }

  stage {
    name = \"Deploy\"

    action {
      run_order           = 1
      name                = \"Terraform-Apply\"
      category            = \"Build\"
      owner               = \"AWS\"
      provider            = \"CodeBuild\"
      input_artifacts     = [\"CodeSource\",\"buildPlan\"]
      output_artifacts    = []
      version             = \"1\"

      configuration = {
        ProjectName          = var.cp_apply_project_name
        PrimarySource        = \"CodeSource\"
        EnvironmentVariables = jsonencode([
          {
            name  = \"PIPELINE_EXECUTION_ID\"
            value = \"#{codepipeline.PipelineExecutionId}\"
            type  = \"PLAINTEXT\"
          },
          {
            name  = \"PL_PERMISSION_SETS_DIR\"
            type  = \"PLAINTEXT\"  
            value = \"#{BINARYVARIABLE.PL_PERMISSION_SETS_DIR}\"
          },    
          {
            name  = \"PL_BUCKET_KEY\"
            type  = \"PLAINTEXT\"
            value = \"#{BINARYVARIABLE.PL_BUCKET_KEY}\"
          },
          {
            name  = \"PL_DYNAMODB_TABLE_NAME\"
            type  = \"PLAINTEXT\"
            value = \"#{BINARYVARIABLE.PL_DYNAMODB_TABLE_NAME}\"
          },
          {
            name  = \"PL_TF_VERSION\"
            type  = \"PLAINTEXT\"
            value = \"#{BINARYVARIABLE.PL_TF_VERSION}\"
          },
          {
            name  = \"PL_GROUP_NAME\"
            type  = \"PLAINTEXT\"
            value = \"#{BINARYVARIABLE.PL_GROUP_NAME}\"
          },
          {
            name  = \"PL_GROUP_EMAIL\"
            type  = \"PLAINTEXT\"
            value = \"#{BINARYVARIABLE.PL_GROUP_EMAIL}\"
          },
          {
            name  = \"PL_PROJECT\"
            type  = \"PLAINTEXT\"
            value = \"#{BINARYVARIABLE.PL_PROJECT}\"
          },
          {
            name  = \"PL_TENANT\"
            type  = \"PLAINTEXT\"
            value = \"#{BINARYVARIABLE.PL_TENANT}\"
          },
          {
            name  = \"PL_APPENV\"
            type  = \"PLAINTEXT\"  
            value = \"#{BINARYVARIABLE.PL_APPENV}\"
          },
        ])
      }
    }
  }
}

想要你的 terraform 代码吗？
用代码更新帖子。
我能够修复第一阶段，它归结为 11 个变量。仍然不确定这与 1000 个字符有何关联

标签： amazon-web-services terraform environment-variables aws-codepipeline

【解决方案1】：

好的，经过几天的调查，我的同事得到了所有的功劳，他弄清楚了 1000 个字符的限制是什么。因此，在未经 Hashicorp 确认的情况下，我们得出以下结论：

如果您想在文本编辑器中打开状态文件，请确保您正在查看文件而不是修改它。在状态文件中搜索“EnvironmentVariables”，您将找到 JSON 语法，输出示例如下所示。

"EnvironmentVariables": "[{\"name\":\"PIPELINE_EXECUTION_ID\",\"type\":\"PLAINTEXT\",\"value\":\"#{codepipeline.PipelineExecutionId}\"},{\"name\":\"PL_APP_NAME\",\"type\":\"PLAINTEXT\",\"value\":\"deploy_pl\"},{\"name\":\"PL_BUCKET_KEY\",\"type\":\"PLAINTEXT\",\"value\":\"#{BIN.PL_BUCKET_KEY}\"},{\"name\":\"PL_DYNAMODB_TABLE_NAME\",\"type\":\"PLAINTEXT\",\"value\":\"#{BIN.PL_DYNAMODB_TABLE_NAME}\"},{\"name\":\"PL_GROUP_NAME\",\"type\":\"PLAINTEXT\",\"value\":\"#{BIN.PL_GROUP_NAME}\"},{\"name\":\"PL_GROUP_EMAIL\",\"type\":\"PLAINTEXT\",\"value\":\"#{BIN.PL_GROUP_EMAIL}\"},{\"name\":\"PL_PROJECT\",\"type\":\"PLAINTEXT\",\"value\":\"#{BIN.PL_PROJECT}\"},{\"name\":\"PL_TENANT\",\"type\":\"PLAINTEXT\",\"value\":\"#{BIN.PL_TENANT}\"},{\"name\":\"PL_APPENV\",\"type\":\"PLAINTEXT\",\"value\":\"#{BIN.PL_APPENV}\"},{\"name\":\"PL_ACCT_NUMB\",\"type\":\"PLAINTEXT\",\"value\":\"#{BIN.PL_ACCT_NUMB}\"},{\"name\":\"PL_PERMISSION_SETS_DIR\",\"type\":\"PLAINTEXT\",\"value\":\"#{BIN.PL_PERMISSION_SETS_DIR}\"},{\"name\":\"PL_IS_MGMT_ACCT\",\"type\":\"PLAINTEXT\",\"value\":\"#{BIN.PL_IS_MGMT_ACCT}\"}]",

如果您删除 "EnvironmentVariables": 和 "" ，它会为您提供环境变量部分中的字符数。它使我能够准确地重命名和重构我的变量。

所以建议前进：

将命名空间保留为四个或更少的字符
保持变量简短以节省空间
仅在适当的阶段使用变量

【讨论】：