我正在尝试使用组织将 AWS Guardduty 部署到多个区域。
在我的根配置中，我创建了以下提供程序：
# If I remove this default provider out i get prompted for a region
provider "aws" {
profile = "default"
region = var.region
}
provider "aws" {
profile = "default"
alias = "eu-west-2"
region = "eu-west-2"
}
provider "aws" {
profile = "default"
alias = "eu-west-3"
region = "eu-west-3"
}
然后在我的模块调用中，我对传递我的提供程序别名的模块进行了多次调用
module "guardduty_orgs_eu_west_2" {
source = "../../modules/aws_guardduty_organisations"
security_account_id = var.security_account_id
providers = {
aws.alternate = aws.eu-west-2
}
}
module "guardduty_orgs_eu_west_3" {
source = "../../modules/aws_guardduty_organisations"
security_account_id = var.security_account_id
providers = {
aws.alternate = aws.eu-west-3
}
}
然后在我的模块中，我有所需的提供程序块和“configuration_aliases”</p>
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 3.27"
configuration_aliases = [ aws.alternate ]
}
}
}
最后是我的资源
resource "aws_guardduty_organization_admin_account" "gdoaa" {
admin_account_id = var.security_account_id
provider = aws.alternate
}
但是，我收到一个错误：
" Error: error enabling GuardDuty Organization Admin Account (123456789): BadRequestException: The request failed because the account is already enabled as the GuardDuty delegated administrator for the organization."
现在，这是正确的，因为第一个模块调用启用了“eu-west-2”的管理员帐户，但我认为传入“eu-west-3”的第二个提供程序将根据该区域启用该区域的管理员帐户Guardduty 最佳实践\文档。
任何帮助表示赞赏
干杯
保罗