amazon-web-services - 如何在 Terraform 子文件夹中声明托管资源

Question

结构：

.
├── aws
│   ├── master
│   │   ├── accounts.tf
│   │   ├── dynamodb.tf
│   │   ├── main.tf
│   │   ├── organization.tf
│   │   └── s3.tf
│   └── ou
│       └── dev2
│           └── dev2_foo
│               └── main.tf
├── main.tf

tfstate 文件位于 s3 中并具有 dynamodb 锁。ou 子帐户在 main.tf 中作为模块加载

module "aws_dev2_dev2_foo" {
         source         = "./aws/ou/dev2/dev2_foo"
}

在

aws/ou/dev2/dev2_foo/main.tf

我试图假设这个帐户：

provider "aws" {
         alias          = "assume"
         region         = "eu-central-1"
         profile        = "terraform"
         assume_role {
            role_arn = "arn:aws:iam::${aws_organizations_account.devteam02.id}:role/terrasume"
            session_name = "terraforming"
         }
}

resource "aws_iam_account_alias" "alias" {
  provider = "aws.assume"
  account_alias = "dev02_devteam02-foo"
}

如果我运行 terraform，我会收到此错误：

未在 aws_dev2_dev2_foo 中声明托管资源“aws_organizations_account”“devteam02”。在这种情况下：如何声明此托管资源？

该资源在aws/master/accounts.tf中声明：

resource "aws_organizations_account" "devteam02" {
  name      = "devteam02"
  email     = "[e-mail]"
  role_name = "terrasume"
  parent_id = "${aws_organizations_organizational_unit.dev2_foo.id}"

  lifecycle {
    ignore_changes = ["role_name"]
  }

}

标签： amazon-web-servicesresourcesterraformdeclare

Answer 1

您需要将 aws_organizations_account.devteam2 资源作为变量传递给模块。

在aws/ou/dev2/dev2_foo创建一个 variables.tf。这会将输入变量保存到您的 dev2_foo 模块。

内容可能类似于

variable "other_aws_org_id"
{
  type = string
}

然后在main.tf中，调用模块的时候需要初始化这个变量。例如

module "aws_dev2_dev2_foo"
{
  source = "./aws/ou/dev2/dev2_foo"
  other_aws_org_id = "${aws_organizations_account.devteam02.id}"
}

然后在您的模块 main.tf 中，将提供程序块更改为类似

provider "aws"
{
  alias = "assume"
  region = "eu-central-1"
  profile = "terraform"
  assume_role  
  { 
    role_arn = "arn:aws:iam::${var.other_aws_org_id}:role/terrasume"
    session_name = "terraforming"
  } 
}

https://www.terraform.io/docs/configuration/variables.html