Terraform可以启用vpc流日志到amazons3

Question

我正在开发terraform脚本，以自动创建aws资源。作为其中的一部分，我正在创建一个vpc，并尝试为此启用vpc流日志。我已经创建了一个s3 bucket，还创建了terraform文档中提到的iam角色https://www.terraform.io/docs/providers/aws/r/flow_log.html

下面给出了我的地形代码

data "aws_s3_bucket" "selected" {
bucket = "${var.s3_bucket_name}"
}
resource "aws_flow_log" "vpc_flow_log" {
count = "${var.enable_vpc_flow_log}"
iam_role_arn    = "${aws_iam_role.test_role.arn}"
log_destination      = "${data.aws_s3_bucket.selected.arn}"
log_destination_type = "s3"
traffic_type         = "ALL"
vpc_id               = "${var.vpc_id}"
}
resource "aws_iam_role" "test_role" {
name = "example"
count = "${var.enable_vpc_flow_log}"
assume_role_policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Service": "vpc-flow-logs.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
EOF
}
resource "aws_iam_role_policy" "example" {
name = "example"
count = "${var.enable_vpc_flow_log}"
role = "${aws_iam_role.test_role.id}"
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents",
"logs:DescribeLogGroups",
"logs:DescribeLogStreams"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
EOF
}

当我执行地形图计划时，收到以下错误

Error: module.enable_vpc_flow_log.aws_flow_log.vpc_flow_log: "log_group_name": required field is not set
Error: module.enable_vpc_flow_log.aws_flow_log.vpc_flow_log: : invalid or unknown key: log_destination
Error: module.enable_vpc_flow_log.aws_flow_log.vpc_flow_log: : invalid or unknown key: log_destination_type

根据地形文档，log_group_name是可选的，只有当我们选择cloud_watch_logs作为log_destination_type时，我们才必须指定其值

有人能帮助我解决我的错误并将vpc流日志启用到s3吗。

Answer 1

我也收到了这个错误，因为我使用的是AWS提供商的1.41。通过查看代码，我发现对这些属性的支持仅在1.42中发布。升级到1.49成功了。

Answer 2

我已经将我的terraform版本从0.11.8更新为0.11.10。我现在可以使用下面的资源块将vpc流日志配置为s3，而不会出现任何错误。

resource "aws_flow_log" "vpc_flow_log" {
log_destination      = "${var.s3_bucket_arn}"
log_destination_type = "s3"
traffic_type         = "ALL"
vpc_id               = "${var.vpc_id}"
}

Answer 3

在将专有网络的日志发送到s3时，您不能设置log_group_name，但可以将组名附加到s3的arn中，它会自动为您创建一个文件夹。

resource "aws_flow_log" "vpc_flow_log" {
log_destination      = "${var.s3_bucket_arn}/group_name"
log_destination_type = "s3"
traffic_type         = "ALL"
vpc_id               = "${var.vpc_id}"
}