我在使用 Terraform(v0.9.2)向 ELB 添加服务时遇到了问题(我正在使用:https://github.com/segmentio/stack/blob/master/s3-logs/main.tf)。
当我运行 terraform apply
时,出现以下错误:
* module.solr.module.elb.aws_elb.main: 1 error(s) occurred:
* aws_elb.main: Failure configuring ELB attributes:
InvalidConfigurationRequest: Access Denied for bucket: my-service-
logs. Please check S3bucket permission
status code: 409, request id: xxxxxxxxxx-xxxx-xxxx-xxxxxxxxx
我的服务看起来像这样:
module "solr" {
source = "github.com/segmentio/stack/service"
name = "${var.prefix}-${terraform.env}-solr"
environment = "${terraform.env}"
image = "123456789876.dkr.ecr.eu-west-2.amazonaws.com/my-docker-image"
subnet_ids = "${element(split(",", module.vpc_subnets.private_subnets_id), 3)}"
security_groups = "${module.security.apache_solr_group}"
port = "8983"
cluster = "${module.ecs-cluster.name}"
log_bucket = "${module.s3_logs.id}"
iam_role = "${aws_iam_instance_profile.ecs.id}"
dns_name = ""
zone_id = "${var.route53_zone_id}"
}
我的s3-logs存储桶看起来像这样:
module "s3_logs" {
source = "github.com/segmentio/stack/s3-logs"
name = "${var.prefix}"
environment = "${terraform.env}"
account_id = "123456789876"
}
我在S3中检查了一下,存储桶策略看起来是这样的:
{
"Version": "2012-10-17",
"Id": "log-bucket-policy",
"Statement": [
{
"Sid": "log-bucket-policy",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789876:root"
},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::my-service-logs/*"
}
]
}
就我所知,ELB需要访问S3存储桶以存储日志(它正在同一个AWS账户中运行)。存储桶和ELB都在
eu-west-2
区域。如有任何问题,请不吝赐教。
"arn:aws:s3:::my-loadbalancer-logs/my-app/AWSLogs/123456789012/*"
这样的内容。在末尾省略帐户ID可以解决问题(例如"arn:aws:s3:::my-loadbalancer-logs/my-app/AWSLogs/*"
)。 - Thismatters