放置 S3 通知配置时出错答案

【问题标题】：Error putting S3 notification configuration放置 S3 通知配置时出错
【发布时间】：2019-01-16 00:05:14
【问题描述】：

当我尝试创建 aws_s3_bucket_notification 时，我得到了这个 terrerform 异常：aws_s3_bucket_notification.input_notification: Error putting S3 notification configuration: InvalidArgument: Unable to validate the following destination configurations status code: 400, request id: 4E17F794B9BC67C9, host id: QmeEFS+T1cvr1xFEMmAlqBKxzX1Fg+qOpwJFXDl4sR1hVcHa4swLN87BiPI8BToGuNQ3oYD0pYk= 据我所知，我已经遵循了 terraform 文档中列出的规范：https://www.terraform.io/docs/providers/aws/r/s3_bucket_notification.html 以前有没有其他人遇到过这个问题？

resource "aws_sqs_queue" "sqs_queue" {
  name = "${var.env}-${var.subenv}-${var.appname}"
  delay_seconds = 5
  max_message_size = 262144
  message_retention_seconds = 86400
  receive_wait_time_seconds = 10
  visibility_timeout_seconds = 90
  redrive_policy = "{\"deadLetterTargetArn\":\"${aws_sqs_queue.sqs_dlq.arn}\",\"maxReceiveCount\":${var.sqs_max_receive_count}}"

  policy = <<POLICY
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": "*",
        "Action": "sqs:SendMessage",
        "Resource": "arn:aws:sqs:*:*:s3-event-notification-queue",
        "Condition": {
          "ArnEquals": { "aws:SourceArn": "${aws_s3_bucket.input.arn}" }
        }
      }
    ]
  }
  POLICY
}


resource "aws_s3_bucket" "input" {
  bucket = "${var.env}-${var.subenv}-${var.appname}-input"
}

resource "aws_s3_bucket_notification" "input_notification" {
    depends_on = [
        "aws_s3_bucket.input",
        "aws_sqs_queue.sqs_queue"
  ]

  bucket = "${aws_s3_bucket.input.id}"

  queue {
    queue_arn     = "${aws_sqs_queue.sqs_queue.arn}"
    events        = ["s3:ObjectCreated:*"]
    filter_suffix = ".gz"
  }
}

【问题讨论】：

为queue和bucket添加depends_on，曾经有一个bug，尊重ordering，
仍然出现同样的错误。
您确定资源 arn 在策略中是否正确：{ "Effect": "Allow", "Principal": "", "Action": "sqs:SendMessage", "资源": "arn:aws:sqs::*:s3-event-notification-queue", "条件": { "ArnEquals": { "aws:SourceArn": "${aws_s3_bucket.input.arn }" } } } - 为什么不使用 ""${var.env}-${var.subenv}-${var.appname}""

标签： amazon-web-services amazon-s3 terraform amazon-sqs

【解决方案1】：

SQS 策略错误，应该如下所示：

resource "aws_sqs_queue" "sqs_queue" {
  name = "${var.env}-${var.subenv}-${var.appname}"
  delay_seconds = 5
  max_message_size = 262144
  message_retention_seconds = 86400
  receive_wait_time_seconds = 10
  visibility_timeout_seconds = 90
  redrive_policy = "{\"deadLetterTargetArn\":\"${aws_sqs_queue.sqs_dlq.arn}\",\"maxReceiveCount\":${var.sqs_max_receive_count}}"

  policy = <<POLICY
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": "*",
        "Action": "sqs:SendMessage",
        "Resource": "arn:aws:sqs:*:*:${var.env}-${var.subenv}-${var.appname}",
        "Condition": {
          "ArnEquals": { "aws:SourceArn": "${aws_s3_bucket.input.arn}" }
        }
      }
    ]
  }
  POLICY
}

【讨论】：