在 terraform 中解密 Windows 密码答案

【问题标题】：Decrypting Windows Password in terraform在 terraform 中解密 Windows 密码
【发布时间】：2020-05-14 19:59:01
【问题描述】：

我正在尝试设置 Terraform 脚本来部署 Windows 服务器。运行 terraform apply 时，我收到一条错误消息，引用如下

Error: Invalid reference

  on main.tf line 44, in resource "aws_instance" "server":
  44:       password = "${rsadecrypt(aws_instance.server[0].password_data, file(KEY_PATH))}"

A reference to a resource type must be followed by at least one attribute
access, specifying the resource name.

AFAIK 资源是“aws_instance”，名称是“server[0]”，而属性是“password_data”。我知道我错过了一些东西，但不知道是什么。任何援助将不胜感激。

下面是完整的资源模块，以防其中包含我缺少的东西。谢谢

resource "aws_instance" "server" {
  ami                      = var.AMIS[var.AWS_REGION]
  instance_type            = var.AWS_INSTANCE
  vpc_security_group_ids  = [module.networking.security_group_id_out]
  subnet_id               = module.networking.subnet_id_out

  ## Use this count key to determine how many servers you want to create.
  count                   = 1
  key_name                = var.KEY_NAME
  tags = {
    # Name                  = "Server-Cloud"
    Name = "Server-${count.index}"
  }

  root_block_device {
    volume_size           = var.VOLUME_SIZE
    volume_type           = var.VOLUME_TYPE
    delete_on_termination = true
  }

  get_password_data = true

  provisioner "remote-exec" {
    connection {
      host = coalesce(self.public_ip, self.private_ip)
      type = "winrm"

      ## Need to provide your own .pem key that can be created in AWS or on your machine for each provisioned EC2.
      password = ${rsadecrypt(aws_instance.server[0].password_data, file(KEY_PATH))}
    }
    inline = [
      "powershell -ExecutionPolicy Unrestricted C:\\Users\\Administrator\\Desktop\\installserver.ps1 -Schedule",
    ]
  }

  provisioner "local-exec" {
    command = "echo ${self.public_ip} >> ../public_ips.txt"
  }
}

【问题讨论】：

认为您只需要 rsadecrypt(self.password_data, file(KEY_PATH)) 假设 KEY_PATH 是您已从此处删除或替换为 pathexpand("~/.ssh/id_rsa") 之类的实际路径
我在 terraform.tfvars 文件 KEY_PATH = "C:\\Users\\paulj\\OneDrive\\Documents\\_Education Courses\\Training\\AWS\\keys" 中有密钥路径（我正在本地测试 terraform 计划）。我试图使用 self.password 选项，但我得到了同样的错误。
KEY_PATH 不是有效的变量引用。如果您已将变量定义为 variable "KEY_PATH {}，则需要 var.KEY_PATH
感谢@ydaetskcoR，看来问题是缺少变量名的“var”部分。将其添加到 KEY_PATH 可以解决问题。谢谢
我很惊讶你可以在它自己的配置器中引用资源。这通常会出错，这就是为什么 self 关键字可供供应商使用的原因，但我尚未测试自 Terraform 0.12 以来是否仍然如此。

标签： windows amazon-ec2 terraform terraform-provider-aws

【解决方案1】：

使用password = "${rsadecrypt(self.password_data, file("/root/.ssh/id_rsa"))}" 没有user = "admin" 如下：

resource "aws_instance" "windows_server" {

   get_password_data      =   "true"
   connection {
     host     = "${self.public_ip}"
     type     = "winrm"
     https    = false
     password = "${rsadecrypt(self.password_data, file("/root/.ssh/id_rsa"))}"
     agent    = false
     insecure = "true"
   }
}

【讨论】：