无法将变量从.tf文件传递到.json策略模板

Question

我是地形世界的新手，在将变量从.tf文件传递到.json时遇到了一些困难我的示例tf lambda函数如下

data "template_file" "task" {
template = file("./iam/grange_rest_dynlambda_policy.json")
vars = {
resource="${var.stage}_grange_dynamodb"
}
}
resource "aws_lambda_function" "grange_rest_dynlambda" {
function_name                  = "${var.stage}_grange_rest_dynlambda"
handler                        = "lambda/src/index.handler"
memory_size                    = "256"
timeout                        = 10
reserved_concurrent_executions = "-1"
filename                       = "${path.module}/../dist/lambda.zip"
role    = aws_iam_role.grange_rest_dynlambda_iam_role.arn
runtime = "nodejs14.x"
publish = true
}
resource "aws_lambda_alias" "grange_rest_dynlambda_alias" {
depends_on       = ["aws_lambda_function.grange_rest_dynlambda"]
name             = var.stage
description      = var.stage
function_name    = aws_lambda_function.grange_rest_dynlambda.arn
function_version = aws_lambda_function.grange_rest_dynlambda.version
}
// Enable cloudwatch for lambda
resource "aws_cloudwatch_log_group" "example" {
name              = "/aws/lambda/${var.stage}_grange_rest_dynlambda"
retention_in_days = 14
}
# See also the following AWS managed policy: AWSLambdaBasicExecutionRole
resource "aws_iam_policy" "lambda_logging" {
name        = "lambda_logging"
path        = "/"
description = "IAM policy for logging from a lambda"
policy = file("./iam/grange_rest_dynlambda_logging_policy.json")
}
// Lambda + DynamoDB
resource "aws_iam_role" "grange_rest_dynlambda_iam_role" {
name               = "grange_rest_dynlambda_iam_role"
assume_role_policy = file("./iam/grange_rest_dynlambda_assume_policy.json")
}
resource "aws_iam_role_policy" "grange_rest_dynlambda_iam_policy" {
policy = file("./iam/grange_rest_dynlambda_policy.json")
role   = aws_iam_role.grange_rest_dynlambda_iam_role.id
}
resource "aws_iam_role_policy_attachment" "lambda_logs" {
role       = aws_iam_role.grange_rest_dynlambda_iam_role.name
policy_arn = aws_iam_policy.lambda_logging.arn
}
// API Gateway + Lambda
resource "aws_api_gateway_resource" "grange_rest_dynlambda_api" {
parent_id   = aws_api_gateway_rest_api.grange_rest_api_gateway.root_resource_id
path_part   = "grange_rest_dynlambda_api"
rest_api_id = aws_api_gateway_rest_api.grange_rest_api_gateway.id
}
resource "aws_api_gateway_method" "grange_rest_dynlambda_api_get" {
authorization = "NONE"
http_method   = "GET"
resource_id   = aws_api_gateway_resource.grange_rest_dynlambda_api.id
rest_api_id   = aws_api_gateway_rest_api.grange_rest_api_gateway.id
}
resource "aws_api_gateway_method" "grange_rest_dynlambda_api_post" {
authorization = "NONE"
http_method   = "POST"
resource_id   = aws_api_gateway_resource.grange_rest_dynlambda_api.id
rest_api_id   = aws_api_gateway_rest_api.grange_rest_api_gateway.id
}
resource "aws_lambda_permission" "apigw" {
action        = "lambda:InvokeFunction"
statement_id  = "AllowExecutionFromAPIGateway"
function_name = aws_lambda_function.grange_rest_dynlambda.function_name
principal     = "apigateway.amazonaws.com"
source_arn    = "${aws_api_gateway_rest_api.grange_rest_api_gateway.execution_arn}/*/*"
}
output "base_url" {
value = aws_api_gateway_deployment.apigwdeployment.invoke_url
}

我从JSON文件注入策略；资源"；要传递到JSON中的变量。但是，不是这样工作的

{
"Version": "2012-10-17",
"Statement":[{
"Effect": "Allow",
"Action": [
"dynamodb:BatchGetItem",
"dynamodb:GetItem",
"dynamodb:Query",
"dynamodb:Scan",
"dynamodb:BatchWriteItem",
"dynamodb:PutItem",
"dynamodb:UpdateItem"
],
"Resource": "arn:aws:dynamodb:us-east-2:741573820784:table/${resource}"
}
]
}

我错过了什么？

Answer 1

template_file数据源不会替换实际文件中的变量。它只是读取文件并提供"；呈现"；直接输出到Terraform。

因此，你需要改变你的地形，在那里你想消耗"；呈现"；输出：

之前：

resource "aws_iam_role_policy" "grange_rest_dynlambda_iam_policy" {
policy = file("./iam/grange_rest_dynlambda_policy.json")
role   = aws_iam_role.grange_rest_dynlambda_iam_role.id
}

之后：

resource "aws_iam_role_policy" "grange_rest_dynlambda_iam_policy" {
policy = data.template_file.task.rendered
role   = aws_iam_role.grange_rest_dynlambda_iam_role.id
}

您需要访问template_file数据源的rendered属性：

data.template_file.task.rendered

这将用"${var.stage}_grange_dynamodb"的值替换${resource}。

请注意，文档建议使用templatefile函数而不是此数据源。