通过 Terraform 创建 IAM 用户并将密钥和访问密钥上传到 S3 存储桶中

Question

我已经编写了一个 terraform 代码来创建 IAM 用户，我的要求是将访问密钥和秘密密钥存储在 S3 存储桶中。我曾尝试通过 s3 cli 命令实现相同的功能，但帮助不大。如有任何建议，我们将不胜感激

Answer 1

您可以使用 loca-exec 来执行命令：

resource "null_resource" "s3_copy" {
  provisioner "local-exec" {
    command = "aws s3 cp keys.txt s3://bucket/keys "
  }
}

Answer 2

我想指出，如果配置不正确，在 s3 中存储令牌可能很危险。

确保您了解 AWS 中的策略和 s3 中的访问控制是如何工作的！。 https://docs.aws.amazon.com/IAM/latest/UserGuide/access.html

除此之外，这就是我想出的：

# The user to which we will grant access to s3
resource "aws_iam_user" "user" {
  name          = "s3-user"
  path          = "/"
}

# Create the access key
resource "aws_iam_access_key" "key" {
  user = aws_iam_user.user.name
}

# Create the bucket for storing tokens
resource "aws_s3_bucket" "token" {
  bucket = "my_token_bucket"
  acl    = "private"
}

# Create the object inside the token bucket
resource "aws_s3_bucket_object" "tokens" {
  bucket                 = aws_s3_bucket.token.id
  key                    = "keys.txt"
  server_side_encryption = "AES256"
  content_type = "text/plain"
  content = <<EOF
access_id: ${aws_iam_access_key.key.id}
access_secret: ${aws_iam_access_key.key.secret}
EOF
}

我还没有测试过这个。

通过 Terraform 创建 IAM 用户并将密钥和访问密钥上传到 S3 存储桶中

Creating IAM user via terraform and upload the secret key and access key in S3 bucket

amazon-s3

amazon-web-services

amazon-iam

terraform