1

我有一个 Lambda，它将从 Secret Manager 中读取一个秘密，它们都由 Terraform 管理。所以在 Terraform 中，我对这个秘密有一个定义：

resource "aws_secretsmanager_secret" "example" {
  name = "example"
}

对于 Lambda，我附上了获取秘密的权限：

resource "aws_iam_role_policy" "example_role_policy" {
  name   = "example-role-policy"
  role   = aws_iam_role.example_lambda_role.id
  policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
.....(other needed permissions)
    },
    {
      "Sid": "GetDatabaseSecret",
      "Effect":"Allow",
      "Action": [
        "secretsmanager:GetSecretValue"
      ],
      "Resource": "${local.secret_arn}"
    }
  ]
}
POLICY
}

我secret_arn在变量中定义：

locals{

secret_arn = "arn:aws:secretsmanager:::us-east-1:${local.account_number}:secret:${aws_secretsmanager_secret.example}-*"

}

当我应用 Terraform 时，它给了我错误：

Error: Invalid template interpolation value

  on ..\..\xxx\terraform\variables.tf line 39, in locals:
  39:   secret_arn = "arn:aws:secretsmanager:::us-east-1:${local.account_number}:secret:${aws_secretsmanager_secret.example}-*"
    |----------------
    | aws_secretsmanager_secret.example is object with 12 attributes

Cannot include the given value in a string template: string required.

我试图*用??????in替换secrect_arn但仍然无法正常工作，在网上找不到任何有用的东西，有人可以帮忙吗？非常感谢。

4

2 回答 2

2

你local.secret_arn应该使用${aws_secretsmanager_secret.example.name}-*"，而不是${aws_secretsmanager_secret.example}-*"。

但是，在您的政策中获取 arn的最简单方法是：

resource "aws_iam_role_policy" "example_role_policy" {
  name   = "example-role-policy"
  role   = aws_iam_role.example_lambda_role.id
  policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
.....(other needed permissions)
    },
    {
      "Sid": "GetDatabaseSecret",
      "Effect":"Allow",
      "Action": [
        "secretsmanager:GetSecretValue"
      ],
      "Resource": "${aws_secretsmanager_secret.example.arn}"
    }
  ]
}
POLICY
}
于 2021-03-01T11:57:07.537 回答
1

我可能是错的，但我认为你想多了。试试这个：

secret_arn = aws_secretsmanager_secret.example.arn

请记住，当您设置 AWS 提供商时，您正在设置账户 ID 和区域：

provider "aws" {
  alias   = "ireland" # Your is in america but you get what I mean :)
  version = "2.70.0"
  region  = "eu-west-1"
...
于 2021-03-01T11:57:28.960 回答