启用 vpc 流日志到 amazon s3 的 Terraform
Terraform to enable vpc flow logs to amazon s3
我正在使用 terraform 脚本来自动创建 aws 资源。作为其中的一部分,我正在创建一个 vpc 并尝试为此启用 vpc 流日志。我创建了一个 s3 存储桶,还创建了一个 iam 角色,如 terraform 文档 https://www.terraform.io/docs/providers/aws/r/flow_log.html
中所述
我的 terraform 代码如下
data "aws_s3_bucket" "selected" {
bucket = "${var.s3_bucket_name}"
}
resource "aws_flow_log" "vpc_flow_log" {
count = "${var.enable_vpc_flow_log}"
iam_role_arn = "${aws_iam_role.test_role.arn}"
log_destination = "${data.aws_s3_bucket.selected.arn}"
log_destination_type = "s3"
traffic_type = "ALL"
vpc_id = "${var.vpc_id}"
}
resource "aws_iam_role" "test_role" {
name = "example"
count = "${var.enable_vpc_flow_log}"
assume_role_policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Service": "vpc-flow-logs.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
EOF
}
resource "aws_iam_role_policy" "example" {
name = "example"
count = "${var.enable_vpc_flow_log}"
role = "${aws_iam_role.test_role.id}"
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents",
"logs:DescribeLogGroups",
"logs:DescribeLogStreams"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
EOF
}
当我执行 terraform plan 时出现以下错误
Error: module.enable_vpc_flow_log.aws_flow_log.vpc_flow_log: "log_group_name": required field is not set
Error: module.enable_vpc_flow_log.aws_flow_log.vpc_flow_log: : invalid or unknown key: log_destination
Error: module.enable_vpc_flow_log.aws_flow_log.vpc_flow_log: : invalid or unknown key: log_destination_type
根据 terraform 文档 log_group_name 是可选的,只有当我们选择 cloud_watch_logs 作为 log_destination_type
任何人都可以帮助我解决我的错误并启用到 s3 的 vpc 流日志。
我也遇到了这个错误,因为我使用的是 AWS 提供商的 1.41
。查看代码我发现 that support for these properties 仅在 1.42
中发布。升级到 1.49
成功了。
我已将我的 terraform 版本从 0.11.8 更新到 0.11.10。我现在可以使用以下资源块将 vpc 流日志配置到 s3 而不会出现任何错误。
resource "aws_flow_log" "vpc_flow_log" {
log_destination = "${var.s3_bucket_arn}"
log_destination_type = "s3"
traffic_type = "ALL"
vpc_id = "${var.vpc_id}"
}
VPC 的日志发送到 s3 时不能设置 log_group_name 但你可以在 s3 的 arn 中附加组名,它会自动为你创建一个文件夹。
resource "aws_flow_log" "vpc_flow_log" {
log_destination = "${var.s3_bucket_arn}/group_name"
log_destination_type = "s3"
traffic_type = "ALL"
vpc_id = "${var.vpc_id}"
}
我正在使用 terraform 脚本来自动创建 aws 资源。作为其中的一部分,我正在创建一个 vpc 并尝试为此启用 vpc 流日志。我创建了一个 s3 存储桶,还创建了一个 iam 角色,如 terraform 文档 https://www.terraform.io/docs/providers/aws/r/flow_log.html
中所述我的 terraform 代码如下
data "aws_s3_bucket" "selected" {
bucket = "${var.s3_bucket_name}"
}
resource "aws_flow_log" "vpc_flow_log" {
count = "${var.enable_vpc_flow_log}"
iam_role_arn = "${aws_iam_role.test_role.arn}"
log_destination = "${data.aws_s3_bucket.selected.arn}"
log_destination_type = "s3"
traffic_type = "ALL"
vpc_id = "${var.vpc_id}"
}
resource "aws_iam_role" "test_role" {
name = "example"
count = "${var.enable_vpc_flow_log}"
assume_role_policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Service": "vpc-flow-logs.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
EOF
}
resource "aws_iam_role_policy" "example" {
name = "example"
count = "${var.enable_vpc_flow_log}"
role = "${aws_iam_role.test_role.id}"
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents",
"logs:DescribeLogGroups",
"logs:DescribeLogStreams"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
EOF
}
当我执行 terraform plan 时出现以下错误
Error: module.enable_vpc_flow_log.aws_flow_log.vpc_flow_log: "log_group_name": required field is not set
Error: module.enable_vpc_flow_log.aws_flow_log.vpc_flow_log: : invalid or unknown key: log_destination
Error: module.enable_vpc_flow_log.aws_flow_log.vpc_flow_log: : invalid or unknown key: log_destination_type
根据 terraform 文档 log_group_name 是可选的,只有当我们选择 cloud_watch_logs 作为 log_destination_type
任何人都可以帮助我解决我的错误并启用到 s3 的 vpc 流日志。
我也遇到了这个错误,因为我使用的是 AWS 提供商的 1.41
。查看代码我发现 that support for these properties 仅在 1.42
中发布。升级到 1.49
成功了。
我已将我的 terraform 版本从 0.11.8 更新到 0.11.10。我现在可以使用以下资源块将 vpc 流日志配置到 s3 而不会出现任何错误。
resource "aws_flow_log" "vpc_flow_log" {
log_destination = "${var.s3_bucket_arn}"
log_destination_type = "s3"
traffic_type = "ALL"
vpc_id = "${var.vpc_id}"
}
VPC 的日志发送到 s3 时不能设置 log_group_name 但你可以在 s3 的 arn 中附加组名,它会自动为你创建一个文件夹。
resource "aws_flow_log" "vpc_flow_log" {
log_destination = "${var.s3_bucket_arn}/group_name"
log_destination_type = "s3"
traffic_type = "ALL"
vpc_id = "${var.vpc_id}"
}