AWS Terraform 试图销毁和重建 documentdb

Question

我通过 terraform 创建了一个 documentdb 集群。当我运行terraform plan时，它试图销毁集群并重建它，但我没有更改值文件。

下面是terraform脚本的主要内容，

resource "aws_docdb_subnet_group" "default" {
  name = format("%s-subnet-group", var.env)
  subnet_ids = [
    data.terraform_remote_state.net.outputs.cicd-sub-priv1,
    data.terraform_remote_state.net.outputs.cicd-sub-priv2,
    data.terraform_remote_state.net.outputs.cicd-sub-pub2,
  ]

  tags = {
    Name = format("%s-subnet-group", var.env)
  }
}

resource "aws_docdb_cluster_instance" "docdb" {
  count              = var.docdb_instance_count
  identifier         = "${var.env}-docdb-instance-${count.index}"
  cluster_identifier = aws_docdb_cluster.docdb.id
  instance_class     = var.docdb_instance_class

  tags = {
      Name = format("%s-docdb-cluster-instance", var.env)
  }
}

resource "aws_docdb_cluster" "docdb" {
  cluster_identifier        = format("%s-docdb-cluster", var.env)
  availability_zones        = var.docdb_az
  db_subnet_group_name      = aws_docdb_subnet_group.default.id
  master_username           = var.docdb_master_username
  master_password           = var.docdb_master_password
  storage_encrypted         = "true"
  kms_key_id                = data.aws_kms_alias.rds.arn
  final_snapshot_identifier = format("%s-docdb-final-snapshot", var.env)

  engine         = "docdb"
  engine_version = "4.0.0"
  port           = var.docdb_port

    tags = {
        Name = format("%s-docdb-cluster", var.env)
    }
}

output "docdb_name" {
  value       = aws_docdb_cluster.docdb.id
  description = "The name of docdb cluster"
}

output "docdb_arn" {
  value       = aws_docdb_cluster.docdb.arn
  description = "The arn of docdb cluster"
}

output "docdb_endpoint" {
  value       = aws_docdb_cluster.docdb.endpoint
  description = "The DNS address of the DocDB instance"
}

data_kms_alias_rds.tf

data "aws_kms_alias" "rds" {
  name = "alias/aws/rds"
}

这些是地形规划结果

$ terraform plan -out tfplan -var-file test.tfvars
Acquiring state lock. This may take a few moments...
aws_docdb_subnet_group.default: Refreshing state... [id=test-subnet-group]
aws_docdb_cluster.docdb: Refreshing state... [id=test-docdb-cluster]
aws_docdb_cluster_instance.docdb[0]: Refreshing state... [id=test-docdb-instance-0]
aws_docdb_cluster_instance.docdb[1]: Refreshing state... [id=test-docdb-instance-1]

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the last "terraform apply":

  # aws_docdb_cluster.docdb has been changed
  ~ resource "aws_docdb_cluster" "docdb" {
      ~ cluster_members                 = [
          + "test-docdb-instance-0",
          + "test-docdb-instance-1",
        ]
      + enabled_cloudwatch_logs_exports = []
        id                              = "test-docdb-cluster"
      + tags                            = {}
        # (24 unchanged attributes hidden)
    }
  # aws_docdb_cluster_instance.docdb[0] has been changed
  ~ resource "aws_docdb_cluster_instance" "docdb" {
        id                           = "test-docdb-instance-0"
      + tags                         = {}
        # (21 unchanged attributes hidden)
    }
  # aws_docdb_cluster_instance.docdb[1] has been changed
  ~ resource "aws_docdb_cluster_instance" "docdb" {
        id                           = "test-docdb-instance-1"
      + tags                         = {}
        # (21 unchanged attributes hidden)
    }

Unless you have made equivalent changes to your configuration, or ignored the relevant attributes using ignore_changes, the
following plan may include actions to undo or respond to these changes.

────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following
symbols:
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # aws_docdb_cluster.docdb must be replaced
-/+ resource "aws_docdb_cluster" "docdb" {
      + apply_immediately               = (known after apply)
      ~ arn                             = "arn:aws:rds:us-east-1:<hidden>:cluster:test-docdb-cluster" -> (known after apply)
      + cluster_identifier_prefix       = (known after apply)
      ~ cluster_members                 = [
          - "test-docdb-instance-0",
          - "test-docdb-instance-1",
        ] -> (known after apply)
      ~ cluster_resource_id             = "cluster-<hidden>" -> (known after apply)
      ~ db_cluster_parameter_group_name = "default.docdb4.0" -> (known after apply)
      - deletion_protection             = false -> null
      - enabled_cloudwatch_logs_exports = [] -> null
      ~ endpoint                        = "<hidden>" -> (known after apply)
      ~ hosted_zone_id                  = "ZNKXH85TT8WVW" -> (known after apply)
      ~ id                              = "test-docdb-cluster" -> (known after apply)
      ~ kms_key_id                      = "arn:aws:kms:us-east-1:<hidden>:key/<hidden>" -> "arn:aws:kms:us-east-1:<hidden>:alias/aws/rds" # forces replacement
      ~ preferred_backup_window         = "07:55-08:25" -> (known after apply)
      ~ preferred_maintenance_window    = "wed:10:07-wed:10:37" -> (known after apply)
      ~ reader_endpoint                 = "<hidden>" -> (known after apply)
      - tags                            = {} -> null
      ~ tags_all                        = {} -> (known after apply)
      ~ vpc_security_group_ids          = [
          - "sg-066866c3e4988de42",
        ] -> (known after apply)
        # (12 unchanged attributes hidden)
    }

  # aws_docdb_cluster_instance.docdb[0] must be replaced
-/+ resource "aws_docdb_cluster_instance" "docdb" {
      + apply_immediately            = (known after apply)
      ~ arn                          = "arn:aws:rds:us-east-1:<hidden>:db:test-docdb-instance-0" -> (known after apply)
      ~ availability_zone            = "us-east-1a" -> (known after apply)
      ~ ca_cert_identifier           = "rds-ca-2019" -> (known after apply)
      ~ cluster_identifier           = "test-docdb-cluster" -> (known after apply) # forces replacement
      ~ db_subnet_group_name         = "test-subnet-group" -> (known after apply)
      ~ dbi_resource_id              = "db-<hidden>" -> (known after apply)
      ~ endpoint                     = "<hidden>" -> (known after apply)
      ~ engine_version               = "4.0.0" -> (known after apply)
      ~ id                           = "test-docdb-instance-0" -> (known after apply)
      + identifier_prefix            = (known after apply)
      ~ kms_key_id                   = "arn:aws:kms:us-east-1:<hidden>:key/<hidden>" -> (known after apply)
      ~ port                         = 37018-> (known after apply)
      ~ preferred_backup_window      = "07:55-08:25" -> (known after apply)
      ~ preferred_maintenance_window = "sat:07:23-sat:07:53" -> (known after apply)
      ~ publicly_accessible          = false -> (known after apply)
      ~ storage_encrypted            = true -> (known after apply)
      - tags                         = {} -> null
      ~ tags_all                     = {} -> (known after apply)
      ~ writer                       = false -> (known after apply)
        # (5 unchanged attributes hidden)
    }

  # aws_docdb_cluster_instance.docdb[1] must be replaced
-/+ resource "aws_docdb_cluster_instance" "docdb" {
      + apply_immediately            = (known after apply)
      ~ arn                          = "arn:aws:rds:us-east-1:<hidden>:db:test-docdb-instance-1" -> (known after apply)
      ~ availability_zone            = "us-east-1c" -> (known after apply)
      ~ ca_cert_identifier           = "rds-ca-2019" -> (known after apply)
      ~ cluster_identifier           = "test-docdb-cluster" -> (known after apply) # forces replacement
      ~ db_subnet_group_name         = "test-subnet-group" -> (known after apply)
      ~ dbi_resource_id              = "db-<hidden>" -> (known after apply)
      ~ endpoint                     = "<hidden>" -> (known after apply)
      ~ engine_version               = "4.0.0" -> (known after apply)
      ~ id                           = "test-docdb-instance-1" -> (known after apply)
      + identifier_prefix            = (known after apply)
      ~ kms_key_id                   = "arn:aws:kms:us-east-1:<hidden>:key/<hidden>" -> (known after apply)
      ~ port                         = 37018 -> (known after apply)
      ~ preferred_backup_window      = "07:55-08:25" -> (known after apply)
      ~ preferred_maintenance_window = "sat:05:13-sat:05:43" -> (known after apply)
      ~ publicly_accessible          = false -> (known after apply)
      ~ storage_encrypted            = true -> (known after apply)
      - tags                         = {} -> null
      ~ tags_all                     = {} -> (known after apply)
      ~ writer                       = true -> (known after apply)
        # (5 unchanged attributes hidden)
    }

Plan: 3 to add, 0 to change, 3 to destroy.

Changes to Outputs:
  ~ docdb_arn      = "arn:aws:rds:us-east-1:<hidden>:cluster:test-docdb-cluster" -> (known after apply)
  ~ docdb_endpoint = "<hidden>" -> (known after apply)
  ~ docdb_name     = "test-docdb-cluster" -> (known after apply)

────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"
Releasing state lock. This may take a few moments...

如何在每次运行我的脚本时不重建 documentdb 集群？

Answer 1

正在更改 DocumentDB 的 kms 密钥 requires replacement。您对此无能为力。

您指的是默认公里数 (kms_key_id = data.aws_kms_alias.rds.arn) 是正确的。但由于您之前有不同的 kms 密钥，因此需要更换。如果是这样，请确保您在此之前备份您的数据库。

Answer 2

似乎 AWS 在创建集群期间替换了 kms_key_id 属性的值。尝试使用 target_key_arn 属性而不是集群资源中别名的 arn ： kms_key_id = data.aws_kms_alias.rds.target_key_arn

那是集群资源中唯一属性的 forces replacement。集群实例替换是集群替换的结果。

AWS Terraform 试图销毁和重建 documentdb

AWS Terraform tried to destory and rebuild documentdb

amazon-web-services

terraform

aws-documentdb