写入 CloudWatch 日志资源策略失败：LimitExceededException：超出资源限制

Question

我正在尝试使用 terraform 创建 elasticsearch 集群，但出现此错误

11:58:07 * aws_cloudwatch_log_resource_policy.elasticsearch-log-publishing-policy: Writing CloudWatch log resource policy failed: LimitExceededException: Resource limit exceeded.
11:58:07 * aws_elasticsearch_domain.es2: 1 error(s) occurred:

我最初以为这个资源限制错误是无法创建日志组。但是当我向 AWS 团队提出申请时，他们说“IAD 中此帐户的 CreateLogGroup API 没有节流”

ElasticSearch 有大约 10 个集群运行。我不确定超出了哪个资源限制。

谁能解释一下上面的错误。

更新：

data "aws_iam_policy_document" "elasticsearch-log-publishing-policy" {
  statement {
    actions = [
      "logs:CreateLogStream",
      "logs:PutLogEvents",
      "logs:PutLogEventsBatch",
    ]

    resources = ["arn:aws:logs:*"]

    principals {
      identifiers = ["es.amazonaws.com"]
      type        = "Service"
    }
  }
}

resource "aws_cloudwatch_log_resource_policy" "elasticsearch-log-publishing-policy" {
  policy_document = "${data.aws_iam_policy_document.elasticsearch-log-publishing-policy.json}"
  policy_name     = "elasticsearch-log-publishing-policy"
}

我尝试使用 terraform 目标来应用这个，我认为错误在这里，AWS 是否对我们创建的自定义策略数量有限制，我找不到请求增加的选项。

Answer 1

does AWS have a limit on number of custom policies we create, I could not find an option to request an increase.

是的，the limit无法更改，它是：

Up to 10 CloudWatch Logs resource policies per Region per account. This quota can't be changed.

写入 CloudWatch 日志资源策略失败：LimitExceededException：超出资源限制

Writing CloudWatch log resource policy failed: LimitExceededException: Resource limit exceeded

amazon-web-services

terraform

aws-elasticsearch