1

我正在开发 terraform 脚本以自动创建 aws 资源。作为其中的一部分，我正在创建一个 vpc 并尝试为此启用 vpc 流日志。我创建了一个 s3 存储桶，还创建了一个 iam 角色，如 terraform 文档https://www.terraform.io/docs/providers/aws/r/flow_log.html中所述

我的地形代码如下

data "aws_s3_bucket" "selected" {
  bucket = "${var.s3_bucket_name}"
}

resource "aws_flow_log" "vpc_flow_log" {
    count = "${var.enable_vpc_flow_log}"
    iam_role_arn    = "${aws_iam_role.test_role.arn}"
    log_destination      = "${data.aws_s3_bucket.selected.arn}"
    log_destination_type = "s3"
    traffic_type         = "ALL"
    vpc_id               = "${var.vpc_id}"

}

resource "aws_iam_role" "test_role" {
  name = "example"
  count = "${var.enable_vpc_flow_log}"
  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "vpc-flow-logs.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF
}
resource "aws_iam_role_policy" "example" {
  name = "example"
  count = "${var.enable_vpc_flow_log}"
  role = "${aws_iam_role.test_role.id}"
  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents",
        "logs:DescribeLogGroups",
        "logs:DescribeLogStreams"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}
EOF
}

当我执行 terraform plan 时出现以下错误

Error: module.enable_vpc_flow_log.aws_flow_log.vpc_flow_log: "log_group_name": required field is not set

Error: module.enable_vpc_flow_log.aws_flow_log.vpc_flow_log: : invalid or unknown key: log_destination

Error: module.enable_vpc_flow_log.aws_flow_log.vpc_flow_log: : invalid or unknown key: log_destination_type

根据 terraform 文档log_group_name是可选的，只有当我们选择 cloud_watch_logs 作为log_destination_type时，我们才必须指定它的值

谁能帮我解决我的错误并将 vpc 流日志启用到 s3。

4

3 回答 3

1

我也收到了这个错误，因为我使用1.41的是 AWS 提供商。通过查看代码，我发现对这些属性的支持仅在1.42. 升级1.49就行了。

于 2018-11-29T11:34:08.283 回答
0

在将 VPC 的日志发送到 s3 时，您不能设置 log_group_name 但您可以将组名附加到 s3 的 arn，它会自动为您创建一个文件夹。

resource "aws_flow_log" "vpc_flow_log" {
log_destination      = "${var.s3_bucket_arn}/group_name"
log_destination_type = "s3"
traffic_type         = "ALL"
vpc_id               = "${var.vpc_id}"
}
于 2021-05-19T12:01:46.537 回答
0

我已将 terraform 版本从0.11.8更新到0.11.10。我现在可以使用以下资源块将 vpc 流日志配置为 s3 而不会出现任何错误。

resource "aws_flow_log" "vpc_flow_log" {
    log_destination      = "${var.s3_bucket_arn}"
    log_destination_type = "s3"
    traffic_type         = "ALL"
    vpc_id               = "${var.vpc_id}"
}
于 2018-12-04T14:15:25.743 回答