如何解决Terraform 'aws_secretsmanager_secret' 传递 arn 错误:模板插值无效
我有一个 Lambda,它会从 Secret Manager 中读取机密,它们都由 terraform 管理。 所以在 terraform 中,我对这个秘密有一个定义:
resource "aws_secretsmanager_secret" "example" {
name = "example"
}
对于 Lambda,我附上了获取秘密的权限:
resource "aws_iam_role_policy" "example_role_policy" {
name = "example-role-policy"
role = aws_iam_role.example_lambda_role.id
policy = <<POLICY
{
"Version": "2012-10-17","Statement": [
{
.....(other needed permissions)
},{
"Sid": "GetDatabaseSecret","Effect":"Allow","Action": [
"secretsmanager:GetSecretValue"
],"Resource": "${local.secret_arn}"
}
]
}
POLICY
}
我在变量中定义了 secret_arn
:
locals{
secret_arn = "arn:aws:secretsmanager:::us-east-1:${local.account_number}:secret:${aws_secretsmanager_secret.example}-*"
}
Error: Invalid template interpolation value
on ..\..\xxx\terraform\variables.tf line 39,in locals:
39: secret_arn = "arn:aws:secretsmanager:::us-east-1:${local.account_number}:secret:${aws_secretsmanager_secret.example}-*"
|----------------
| aws_secretsmanager_secret.example is object with 12 attributes
Cannot include the given value in a string template: string required.
我试图用 *
中的 ??????
替换 secrect_arn
但仍然无法正常工作,在网上找不到任何有用的东西,有人可以帮忙吗?非常感谢。
解决方法
您的 local.secret_arn
应该使用 ${aws_secretsmanager_secret.example.name}-*"
,而不是 ${aws_secretsmanager_secret.example}-*"
。
但将 arn 纳入您的保单的最简单方法就是:
resource "aws_iam_role_policy" "example_role_policy" {
name = "example-role-policy"
role = aws_iam_role.example_lambda_role.id
policy = <<POLICY
{
"Version": "2012-10-17","Statement": [
{
.....(other needed permissions)
},{
"Sid": "GetDatabaseSecret","Effect":"Allow","Action": [
"secretsmanager:GetSecretValue"
],"Resource": "${aws_secretsmanager_secret.example.arn}"
}
]
}
POLICY
}
,
我可能是错的,但我认为你想多了。 试试这个:
secret_arn = aws_secretsmanager_secret.example.arn
请记住,您在设置 AWS 提供商时要设置账户 ID 和区域:
provider "aws" {
alias = "ireland" # Your is in america but you get what I mean :)
version = "2.70.0"
region = "eu-west-1"
...
版权声明:本文内容由互联网用户自发贡献,该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 dio@foxmail.com 举报,一经查实,本站将立刻删除。