amazon-s3 - S3 存储桶的 Terraform "ping-pong"加密配置

Question

使用 Terraform 似乎一切正常，但由于某种原因，每次应用后，它都会不断删除然后添加回所有 s3 存储桶上的服务器端加密配置。如果我应用删除，它只会在我下次运行 apply 时将其添加回来。

这是在我的主分支上运行 terraform plan 后发生的情况，没有进行任何更改/部署。下次我运行计划/应用时，它会将其添加回来。

  # aws_s3_bucket.terraform-state will be updated in-place
  ~ resource "aws_s3_bucket" "terraform-state" {
        id                          = "company-terraform-state"
        tags                        = {}
        # (11 unchanged attributes hidden)

      - server_side_encryption_configuration {
          - rule {
              - bucket_key_enabled = false -> null

              - apply_server_side_encryption_by_default {
                  - kms_master_key_id = "arn:aws:kms:us-east-1:123456789012:key/Random-GUID-ABCD-1234" -> null
                  - sse_algorithm     = "aws:kms" -> null
                }
            }
        }

        # (1 unchanged block hidden)
    }

可能做出贡献:我设置了一个 S3 state 存储桶来跟踪我在 AWS 中部署的内容:https://technology.doximity.com/articles/terraform-s3-backend-best-practices

我的state.tf文件:

// This file is based on the writtings here: https://technology.doximity.com/articles/terraform-s3-backend-best-practices
terraform {
  backend "s3" {
    bucket         = "company-terraform-state"
    key            = "state/terraform.tfstate"
    region         = "us-east-1"
    encrypt        = true
    kms_key_id     = "alias/terraform-bucket-key"
    dynamodb_table = "terraform-state"
  }
}
// The backend configuration above is added after the state s3 bucket is created with the rest of the file below

resource "aws_kms_key" "terraform-bucket-key" {
  description             = "This key is used to encrypt bucket objects for terraform state"
  deletion_window_in_days = 10
  enable_key_rotation     = true
}

resource "aws_kms_alias" "key-alias" {
  name          = "alias/terraform-bucket-key"
  target_key_id = aws_kms_key.terraform-bucket-key.key_id
}

resource "aws_s3_bucket" "terraform-state" {
  bucket = "company-terraform-state"
}

resource "aws_s3_bucket_server_side_encryption_configuration" "encryption-config" {
  bucket = aws_s3_bucket.terraform-state.id
  rule {
    apply_server_side_encryption_by_default {
      kms_master_key_id = aws_kms_key.terraform-bucket-key.arn
      sse_algorithm     = "aws:kms"
    }
  }
}

resource "aws_s3_bucket_versioning" "versioning" {
  bucket = aws_s3_bucket.terraform-state.id
  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_acl" "acl" {
  bucket = aws_s3_bucket.terraform-state.id
  acl    = "private"
}

resource "aws_s3_bucket_public_access_block" "block" {
  bucket = aws_s3_bucket.terraform-state.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

// This table exists to prevent multiple team members from modifying the state file at the same time
resource "aws_dynamodb_table" "terraform-state" {
  name           = "terraform-state"
  read_capacity  = 20
  write_capacity = 20
  hash_key       = "LockID"

  attribute {
    name = "LockID"
    type = "S"
  }
}

Answer 1

弄清楚了，我在 main.tf 中使用了较旧的提供程序。我设置了 3.0 而不是 4.0，并且使用较新的 aws_s3_bucket_server_side_encryption_configuration，而不是在 aws_s3_bucket 中配置加密(这更适合旧的提供商)。

我真的很惊讶它竟然有效!一定是 3.0 中尚未发布的某些功能。

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 4.0" # This was "~> 3.0"
    }
  }
}