如何使用role_arn将不同的aws凭据提供给s3后端和ec2

Question

我想将terraform状态文件存储在一个aws帐户的s3 bucket中，并在另一个使用role_arn的aws帐户中部署实例更改。这是我的配置：
providers.tf

terraform {
backend "s3" {
bucket = "bucket"
key = "tf/terraform.tfstate"
encrypt = "false"
region = "us-east-1"
profile = "s3"
role_arn = "arn:aws:iam::1111111111111:role/s3-role"
dynamodb_table = "name"
}
}
provider "aws" {
profile = "ec2"
region = "eu-north-1"
assume_role {
role_arn = "arn:aws:iam::2222222222222:role/ec2-role"
}
}

~/.aws/凭据

[s3-def]
aws_access_key_id = aaaaaaaaaa
aws_secret_access_key = sssssssss
[ec2-def]
aws_access_key_id = aaaaaaa
aws_secret_access_key = sssss
[s3]
role_arn = arn:aws:iam::1111111111:role/s3-role
region = us-east-1
source_profile = s3-def
[ec2]
role_arn = arn:aws:iam::22222222222:role/ec2-role
region = eu-north-1
source_profile = ec2-def

当我尝试terraform初始化-迁移状态时，我得到：

2022-08-03T17:23:21.334+0300 [INFO]  Terraform version: 1.2.5
2022-08-03T17:23:21.334+0300 [INFO]  Go runtime version: go1.18.1
2022-08-03T17:23:21.334+0300 [INFO]  CLI args: []string{"terraform", "init", "-migrate-state"}
2022-08-03T17:23:21.334+0300 [INFO]  Loading CLI configuration from /
2022-08-03T17:23:21.335+0300 [INFO]  CLI command args: []string{"init", "-migrate-state"}
Initializing the backend...
2022-08-03T17:23:21.337+0300 [WARN]  backend config has changed since last init
Backend configuration changed!
Terraform has detected that the configuration specified for the backend
has changed. Terraform will now check for existing state in the backends.
2022-08-03T17:23:21.338+0300 [INFO]  Attempting to use session-derived credentials
╷
│ Error: error configuring S3 Backend: no valid credential sources for S3 Backend found.
│ 
│ Please see https://www.terraform.io/docs/language/settings/backends/s3.html
│ for more information about providing credentials.
│ 
│ Error: NoCredentialProviders: no valid providers in chain. Deprecated.

我只是不明白这个错误是什么，甚至可能为s3和ec2提供两组不同的凭据？

Answer 1

您的问题似乎是无法通过身份验证来管理远程状态。在基本terraform init工作之前，不要尝试处理其他帐户中的资源。

一旦您完成了这项工作，请使用提供程序别名访问多个帐户。https://developer.hashicorp.com/terraform/language/providers/configuration#alias-多供应商配置