微信公众号搜"智元新知"关注
微信扫一扫可直接关注哦!

Terraform API Gateway HTTP API-获取错误权限不足,无法启用日志记录

如何解决Terraform API Gateway HTTP API-获取错误权限不足,无法启用日志记录

我用于部署HTTP API的terraform脚本如下所示。运行此程序时出现以下错误-

错误创建API Gateway v2阶段:BadRequestException:权限不足,无法启用日志记录

是否需要添加其他内容才能使其正常工作?

resource "aws_cloudwatch_log_group" "api_gateway_log_group" {
  name              = "/aws/apigateway/${var.location}-${var.custom_tags.Layer}-demo-publish-api"
  retention_in_days = 7
  tags = var.custom_tags
}

resource "aws_apigatewayv2_api" "demo_publish_api" {
  name = "${var.location}-${var.custom_tags.Layer}-demo-publish-api"
  description = "API to publish event payloads"
  protocol_type = "HTTP"
  tags = var.custom_tags
}

resource "aws_apigatewayv2_vpc_link" "demo_vpc_link" {
  name = "${var.location}-${var.custom_tags.Layer}-demo-vpc-link"
  security_group_ids = local.security_group_id_list
  subnet_ids = local.subnet_ids_list
  tags = var.custom_tags
}

resource "aws_apigatewayv2_integration" "demo_apigateway_integration" {
  api_id           = aws_apigatewayv2_api.demo_publish_api.id
  integration_type = "HTTP_PROXY"
  connection_type = "VPC_LINK"
  integration_uri = var.alb_listener_arn
  connection_id = aws_apigatewayv2_vpc_link.demo_vpc_link.id
  integration_method = "POST"
  timeout_milliseconds = var.api_timeout_milliseconds
}

resource "aws_apigatewayv2_route" "demo_publish_api_route" {
  api_id    = aws_apigatewayv2_api.demo_publish_api.id
  route_key = "POST /api/event"
  target = "integrations/${aws_apigatewayv2_integration.demo_apigateway_integration.id}"
}

resource "aws_apigatewayv2_stage" "demo_publish_api_default_stage" {
  depends_on = [aws_cloudwatch_log_group.api_gateway_log_group]

  api_id = aws_apigatewayv2_api.demo_publish_api.id
  name   = "$default"
  auto_deploy = true
  tags = var.custom_tags

  route_settings {
    route_key = aws_apigatewayv2_route.demo_publish_api_route.route_key
    throttling_burst_limit = var.throttling_burst_limit
    throttling_rate_limit = var.throttling_rate_limit
  }

  default_route_settings {
    detailed_metrics_enabled = true
    logging_level = "INFO"
  }

  access_log_settings {
    destination_arn = aws_cloudwatch_log_group.api_gateway_log_group.arn
    format = jsonencode({ "requestId":"$context.requestId","ip": "$context.identity.sourceIp"})
  }
}

解决方法

@Marcin您最初关于aws_api_gateway_account的评论是正确的。我添加了以下资源,现在一切正常-

resource "aws_api_gateway_account" "demo" {
  cloudwatch_role_arn = var.apigw_cloudwatch_role_arn
}
data "aws_iam_policy_document" "demo_apigw_allow_manage_resources" {
  version = "2012-10-17"
  statement {
    actions = [
      "logs:DescribeLogGroups","logs:DescribeLogStreams","logs:GetLogEvents","logs:FilterLogEvents"
    ]

    resources = [
      "*"
    ]
  }

  statement {
    actions = [
      "logs:CreateLogDelivery","logs:PutResourcePolicy","logs:UpdateLogDelivery","logs:DeleteLogDelivery","logs:CreateLogGroup","logs:DescribeResourcePolicies","logs:GetLogDelivery","logs:ListLogDeliveries"
    ]

    resources = [
      "*"
    ]
  }
}

data "aws_iam_policy_document" "demo_apigw_allow_assume_role" {
  version = "2012-10-17"
  statement {
    effect = "Allow"
    actions = [
      "sts:AssumeRole"]
    principals {
      type = "Service"
      identifiers = ["apigateway.amazonaws.com"]
    }
  }
}

resource "aws_iam_role_policy" "demo_apigw_allow_manage_resources" {
  policy = data.aws_iam_policy_document.demo_apigw_allow_manage_resources.json
  role = aws_iam_role.demo_apigw_cloudwatch_role.id
  name = var.demo-apigw-manage-resources_policy_name
}

resource "aws_iam_role" "demo_apigw_cloudwatch_role" {
  name = "demo_apigw_cloudwatch_role"
  tags = var.custom_tags
  assume_role_policy = data.aws_iam_policy_document.demo_apigw_allow_assume_role.json
}
,

在获得AWS支持之前,我坚持了几天。如果您已经部署了许多HTTP API,则可能会遇到同一问题,即IAM策略变得非常庞大。

  1. 运行此AWS CLI命令以找到关联的CloudWatch Logs资源策略: aws logs describe-resource-policies
  2. 寻找AWSLogDeliveryWrite20150319。您会注意到该策略具有大量关联的LogGroup资源。您有三种选择:
  • 通过删除一些可能未使用的条目来调整此政策。
  • 将资源列表更改为"*"
  • 您可以添加其他策略。根据此策略,在它们之间拆分资源记录。
  1. 通过此AWS CLI命令应用更新: aws logs put-resource-policy

这是我运行的用于设置资源的命令。对策略使用"*"

aws logs put-resource-policy --policy-name AWSLogDeliveryWrite20150319 --policy-document "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"AWSLogDeliveryWrite\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"delivery.logs.amazonaws.com\"},\"Action\":[\"logs:CreateLogStream\",\"logs:PutLogEvents\"],\"Resource\":[\"*\"]}]}"

版权声明:本文内容由互联网用户自发贡献,该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 dio@foxmail.com 举报,一经查实,本站将立刻删除。