S3 bucket-Terraform:Plan在默认值上显示不存在的更改

Question

我正在尝试地形化并导入现有的日志存储桶。HCL代码如下所示，是生产中的完整复制品：

locals {
bucket_name = "log-bucket-${var.environment}-${var.region}"
}
module "bucket" {
source        = "[e-mail]:mycompany/s3-bucket-module?ref=1.0.5"
name          = local.bucket_name
log_bucket    = local.bucket_name
bucket_policy = jsonencode({
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "AllowSSLRequestsOnly",
"Effect" : "Deny",
"Principal" : "*",
"Action" : "s3:*",
"Resource" : [*],
"Condition" : {
"Bool" : {
"aws:SecureTransport" : "false"
}
}
}
]
})
grant = [
{
id          = data.aws_canonical_user_id.current_user.id
type        = "CanonicalUser"
permissions = ["FULL_CONTROL"]
},
{
type        = "Group"
uri         = "http://acs.amazonaws.com/groups/s3/LogDelivery"
permissions = ["READ_ACP", "WRITE"]
},
]
lifecycle_rules = [
{
id      = "log"
enabled = true
prefix  = "log/"
tags = {
"rule"      = "log"
"autoclean" = "true"
}
transition = [
{
days          = 30
storage_class = "STANDARD_IA"
},
{
days          = 60
storage_class = "GLACIER"
}
]
expiration = {
days = 90
}
}
]
}

在用terraform import ...导入bucket并制定地形计划后，我得到了以下更改：

# module.s3-bucket-module.module.bucket.aws_s3_bucket.bucket will be updated in-place
~ resource "aws_s3_bucket" "bucket" {
+ acl                         = "private"
+ force_destroy               = false
id                          = "mycompany-log-bucket-myenvironment-myregion"
tags                        = {}
# (8 unchanged attributes hidden)
# (6 unchanged blocks hidden)
}

根据这个计划，地形想要执行两件事：

+ acl                         = "private"
+ force_destroy               = false

但这些是默认值，我从未明确更改过。我想我想说的是，在现实中，它似乎没有改变任何东西，而是明确地设置了默认值。

这让我很困惑，因为这是一个生产桶，所以在申请之前我想听听你的意见。为什么这两个"；更改"；出现在那里？

Answer 1

2021年11月16日

我想有一个开放的bug，地形图会更新以下属性：

+ acl                         = "private"
+ force_destroy               = false

在特定的tf资源中，一个解决方法是应用更新(bug(，然后重新应用地形状态以更新。

Answer 2

这与评论中提到的bug bembas有关。

我创建了一个复制桶并将其导入。

---

步骤1

在应用计划之前

~ resource "aws_s3_bucket" "bucket" {
+ acl                         = "private"
+ force_destroy               = false
id                          = "mycompany-log-bucket-myenvironment-myregion"
tags                        = {}
# (8 unchanged attributes hidden)
# (6 unchanged blocks hidden)
}

我运行aws s3api get-bucket-acl --bucket mycompany-log-bucket-myenvironment-myregion得到的回复是：

{
"Owner": {
"ID": "hidden"
},
"Grants": [
{
"Grantee": {
"Type": "Group",
"URI": "http://acs.amazonaws.com/groups/s3/LogDelivery"
},
"Permission": "READ_ACP"
},
{
"Grantee": {
"Type": "Group",
"URI": "http://acs.amazonaws.com/groups/s3/LogDelivery"
},
"Permission": "WRITE"
},
{
"Grantee": {
"ID": "hidden",
"Type": "CanonicalUser"
},
"Permission": "FULL_CONTROL"
}
]
}

---

步骤2

应用计划后

{
"Owner": {
"ID": "hidden"
},
"Grants": [
{
"Grantee": {
"ID": "hidden",
"Type": "CanonicalUser"
},
"Permission": "FULL_CONTROL"
}
]
}

---

步骤3

制定了一个新的计划，资源想再次更改资源！

~ resource "aws_s3_bucket" "bucket" {
# (10 unchanged attributes hidden)
+ grant {
+ permissions = [
+ "READ_ACP",
+ "WRITE",
]
+ type        = "Group"
+ uri         = "http://acs.amazonaws.com/groups/s3/LogDelivery"
}
+ grant {
+ id          = "hidden"
+ permissions = [
+ "FULL_CONTROL",
]
+ type        = "CanonicalUser"
}
# (4 unchanged blocks hidden)
}

应用第二个计划后，一切恢复正常，地形不再要求更改。

No changes. Your infrastructure matches the configuration.