S3 存储桶 - Terraform：计划显示不存在的更改，默认值

Question

我正在尝试改造和导入现有的日志存储桶。 HCL 代码如下所示，是生产中的完整副本：

locals {
  bucket_name = "log-bucket-${var.environment}-${var.region}"
}

module "bucket" {
  source        = "git@github.com:mycompany/s3-bucket-module?ref=1.0.5"
  name          = local.bucket_name
  log_bucket    = local.bucket_name
  bucket_policy = jsonencode({
    "Version" : "2012-10-17",
    "Statement" : [
      {
        "Sid" : "AllowSSLRequestsOnly",
        "Effect" : "Deny",
        "Principal" : "*",
        "Action" : "s3:*",
        "Resource" : [*],
        "Condition" : {
          "Bool" : {
            "aws:SecureTransport" : "false"
          }
        }
      }
    ]
  })
  grant = [
    {
      id          = data.aws_canonical_user_id.current_user.id
      type        = "CanonicalUser"
      permissions = ["FULL_CONTROL"]
    },
    {
      type        = "Group"
      uri         = "http://acs.amazonaws.com/groups/s3/LogDelivery"
      permissions = ["READ_ACP", "WRITE"]
    },
  ]
  lifecycle_rules = [
    {
      id      = "log"
      enabled = true
      prefix  = "log/"

      tags = {
        "rule"      = "log"
        "autoclean" = "true"
      }
      transition = [
        {
          days          = 30
          storage_class = "STANDARD_IA"
        },
        {
          days          = 60
          storage_class = "GLACIER"
        }
      ]
      expiration = {
        days = 90
      }
    }
  ]
}

使用terraform import ... 导入存储桶并制定地形计划后，我得到以下更改：

  # module.s3-bucket-module.module.bucket.aws_s3_bucket.bucket will be updated in-place
  ~ resource "aws_s3_bucket" "bucket" {
      + acl                         = "private"
      + force_destroy               = false
        id                          = "mycompany-log-bucket-myenvironment-myregion"
        tags                        = {}
        # (8 unchanged attributes hidden)
        # (6 unchanged blocks hidden)
    }

基于这个计划，terraform 想要执行两件事：

      + acl                         = "private"
      + force_destroy               = false

但这些是默认值，我从未明确更改过。我想我想说的是，实际上它似乎并没有改变任何东西，而是明确地设置了默认值。

这让我很困惑，因为它是一个生产桶，所以我想在申请之前征求你的意见。为什么会出现那两个“变化”？

Answer 1

这与cmets中提到的bug bembas有关。

我创建了一个副本存储桶并导入它。

---

第一步

在应用计划之前

  ~ resource "aws_s3_bucket" "bucket" {
      + acl                         = "private"
      + force_destroy               = false
        id                          = "mycompany-log-bucket-myenvironment-myregion"
        tags                        = {}
        # (8 unchanged attributes hidden)
        # (6 unchanged blocks hidden)
    }

我跑aws s3api get-bucket-acl --bucket mycompany-log-bucket-myenvironment-myregion 并得到了这样的回应：

{
    "Owner": {
        "ID": "hidden"
    },
    "Grants": [
        {
            "Grantee": {
                "Type": "Group",
                "URI": "http://acs.amazonaws.com/groups/s3/LogDelivery"
            },
            "Permission": "READ_ACP"
        },
        {
            "Grantee": {
                "Type": "Group",
                "URI": "http://acs.amazonaws.com/groups/s3/LogDelivery"
            },
            "Permission": "WRITE"
        },
        {
            "Grantee": {
                "ID": "hidden",
                "Type": "CanonicalUser"
            },
            "Permission": "FULL_CONTROL"
        }
    ]
}

---

第 2 步

应用计划后

{
    "Owner": {
        "ID": "hidden"
    },
    "Grants": [
        {
            "Grantee": {
                "ID": "hidden",
                "Type": "CanonicalUser"
            },
            "Permission": "FULL_CONTROL"
        }
    ]
}

---

第三步

制定了新计划，资源又要换资源了！

  ~ resource "aws_s3_bucket" "bucket" {
        # (10 unchanged attributes hidden)

      + grant {
          + permissions = [
              + "READ_ACP",
              + "WRITE",
            ]
          + type        = "Group"
          + uri         = "http://acs.amazonaws.com/groups/s3/LogDelivery"
        }
      + grant {
          + id          = "hidden"
          + permissions = [
              + "FULL_CONTROL",
            ]
          + type        = "CanonicalUser"
        }

        # (4 unchanged blocks hidden)
    }

应用第二个计划后，一切恢复正常，terraform 不再请求更改。

No changes. Your infrastructure matches the configuration.

Answer 2

16/11/2021

我猜有一个open bug 和 terraform 看到更新以下属性：

 + acl                         = "private"
 + force_destroy               = false

在特定的 tf 资源中，一种解决方法是应用更​​新（错误），然后重新申请 terraform 状态为最新。