logo标签列表

Terraform AWS提供程序错误：无法配置不可配置属性的值。不能为“acl”配置值：其值将自动确定

amazon-web-servicesterraformterraform-provider-awsamazon-s3
46

今天，每当我运行terraform apply时，我会看到类似于这样的错误：无法为“lifecycle_rule”配置值：其值将根据应用此配置的结果自动确定。

昨天还好好的。

以下是我运行的命令：terraform init && terraform apply

以下是已初始化的提供程序插件列表：

- Finding latest version of hashicorp/archive...
- Finding latest version of hashicorp/aws...
- Finding latest version of hashicorp/null...
- Installing hashicorp/null v3.1.0...
- Installed hashicorp/null v3.1.0 (signed by HashiCorp)
- Installing hashicorp/archive v2.2.0...
- Installed hashicorp/archive v2.2.0 (signed by HashiCorp)
- Installing hashicorp/aws v4.0.0...
- Installed hashicorp/aws v4.0.0 (signed by HashiCorp)

以下是错误信息：

Acquiring state lock. This may take a few moments...
Releasing state lock. This may take a few moments...
╷
│ Error: Value for unconfigurable attribute
│ 
│   with module.ssm-parameter-store-backup.aws_s3_bucket.this,
│   on .terraform/modules/ssm-parameter-store-backup/s3_backup.tf line 1, in resource "aws_s3_bucket" "this":
│    1: resource "aws_s3_bucket" "this" {
│ 
│ Can't configure a value for "lifecycle_rule": its value will be decided
│ automatically based on the result of applying this configuration.
╵
╷
│ Error: Value for unconfigurable attribute
│ 
│   with module.ssm-parameter-store-backup.aws_s3_bucket.this,
│   on .terraform/modules/ssm-parameter-store-backup/s3_backup.tf line 1, in resource "aws_s3_bucket" "this":
│    1: resource "aws_s3_bucket" "this" {
│ 
│ Can't configure a value for "server_side_encryption_configuration": its
│ value will be decided automatically based on the result of applying this
│ configuration.
╵
╷
│ Error: Value for unconfigurable attribute
│ 
│   with module.ssm-parameter-store-backup.aws_s3_bucket.this,
│   on .terraform/modules/ssm-parameter-store-backup/s3_backup.tf line 3, in resource "aws_s3_bucket" "this":
│    3:   acl    = "private"
│ 
│ Can't configure a value for "acl": its value will be decided automatically
│ based on the result of applying this configuration.
╵
ERRO[0012] 1 error occurred:
        * exit status 1

我的代码如下：

resource "aws_s3_bucket" "this" {
  bucket = "${var.project}-${var.environment}-ssm-parameter-store-backups-bucket"
  acl    = "private"

  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        kms_master_key_id = data.aws_kms_key.s3.arn
        sse_algorithm     = "aws:kms"
      }
    }
  }

  lifecycle_rule {
    id      = "backups"
    enabled = true

    prefix = "backups/"

    transition {
      days          = 90
      storage_class = "GLACIER_IR"
    }

    transition {
      days          = 180
      storage_class = "DEEP_ARCHIVE"
    }

    expiration {
      days = 365
    }
  }

  tags = {
    Name        = "${var.project}-${var.environment}-ssm-parameter-store-backups-bucket"
    Environment = var.environment
  }
}
5个回答
48

Terraform AWS Provider升级到版本4.0.0，发布日期为2022年2月10日。

发布的主要变化包括：

  • AWS提供程序的版本4.0.0引入了对aws_s3_bucket资源的重大更改。
  • 作为计划完全放弃EC2-Classic Networking，AWS提供程序的版本4.0.0将是支持EC2-Classic资源的最后一个重要版本。有关详细信息，请参见AWS News Blog。
  • AWS提供程序的版本4.0.0和4.x.x将是与Terraform 0.12-0.15兼容的最后一个版本。

Terraform做出这种变化的原因如下：通过独立资源帮助分发S3存储桶设置的管理，aws_s3_bucket资源中的各种参数和属性已变为只读。依赖于这些参数的配置应更新为使用相应的aws_s3_bucket_*资源。更新后，应将新aws_s3_bucket_*资源导入Terraform状态。

因此，我按照这里的指南更新了我的代码：Terraform AWS提供程序版本4升级指南| S3 Bucket Refactor

新的工作代码如下：

resource "aws_s3_bucket" "this" {
  bucket = "${var.project}-${var.environment}-ssm-parameter-store-backups-bucket"

  tags = {
    Name        = "${var.project}-${var.environment}-ssm-parameter-store-backups-bucket"
    Environment = var.environment
  }
}

resource "aws_s3_bucket_acl" "this" {
  bucket = aws_s3_bucket.this.id
  acl    = "private"
}

resource "aws_s3_bucket_server_side_encryption_configuration" "this" {
  bucket = aws_s3_bucket.this.id

  rule {
    apply_server_side_encryption_by_default {
      kms_master_key_id = data.aws_kms_key.s3.arn
      sse_algorithm     = "aws:kms"
    }
  }
}

resource "aws_s3_bucket_lifecycle_configuration" "this" {
  bucket = aws_s3_bucket.this.id

  rule {
    id     = "backups"
    status = "Enabled"

    filter {
      prefix = "backups/"
    }

    transition {
      days          = 90
      storage_class = "GLACIER_IR"
    }

    transition {
      days          = 180
      storage_class = "DEEP_ARCHIVE"
    }

    expiration {
      days = 365
    }
  }
}

如果您不想升级Terraform AWS Provider版本到4.0.0，可以在代码中明确指定现有或旧版本以如下方式使用：

terraform {
  required_version = "~> 1.0.11"
  required_providers {
    aws  = "~> 3.73.0"
  }
}
19

Terraform AWS提供者已更新到4.0.0版本，导致出现了问题。

如果无法升级您的版本，可以采用以下方式锁定AWS提供者版本：

terraform {
  required_version = "~> 0.12.31"

  required_providers {
    aws  = "~> 3.74.1"
  }
}
我进行了这个配置，但是我得到了下面的错误： 此配置不支持 Terraform 版本 1.1.5。要继续，请 - DeadlyDagger
所需版本 = "~> 1.1.5" - Rob Sedgwick
6

对于Terragrunt/Terraform用户:

正如其他人所提到的，AWS Provider已升级到4.0版本。 这里列出了所有重大更改 (在git 4.0标签下): GitHub | terraform-provider-aws | v4.0.0

请注意s3的重大更改。我在页面上找到了39处参考，其中包括aws_s3_bucket。实际上，我们中的一些人没有时间去解决当前项目的所有重大更改。 我发现版本3.74.1非常有效。

为了限制所有使用Terragrunt配置的Terraform项目，在terragrunt repo的根terragrunt.hcl文件中，您可以指定以下内容:

generate "versions" {
    path      = "versions_override.tf"
    if_exists = "overwrite_terragrunt"
    contents  = <<EOF
    terraform {
        required_providers {
        aws = {
            version = "= 3.74.1"
            source = "hashicorp/aws"
        }
        }
    }
EOF
}

实际上，Terragrunt将生成一个versions_override.tf的terraform配置文件，该文件将定义3.74.1的明确版本。

4
我正在按照terraform文档中的教程，在AWS Lambda上创建服务。此配置。 https://learn.hashicorp.com/tutorials/terraform/lambda-api-gateway 
resource "aws_s3_bucket" "lambda_bucket" {
  bucket = random_pet.lambda_bucket_name.id
  acl = "private"
  force_destroy = true
}

会导致以下错误。
Error: Value for unconfigurable attribute
  with aws_s3_bucket.lambda_bucket,
  on main.tf line 32, in resource "aws_s3_bucket" "lambda_bucket":
  32:   acl           = "private"
Can't configure a value for "acl": its value will be decided automatically
based on the result of applying this configuration.

既然acl现在是只读的，那么请更新您的配置以使用aws_s3_bucket_acl资源，并在aws_s3_bucket资源中删除acl参数：

resource "aws_s3_bucket" "lambda_bucket" {
  bucket = random_pet.lambda_bucket_name.id

  force_destroy = true
}

resource "aws_s3_bucket_acl" "lamdbda_bucket" {
  bucket = aws_s3_bucket.lambda_bucket.id
  acl = "private"
}
2
快速解决方案：在准备按照 Terraform 提供的升级指南Terraform AWS Provider Version 4 Upgrade Guide将项目迁移到版本4之前，将其保持在版本3上。
为了做到这一点，请按以下方式冻结您的提供程序：
terraform {
   required_providers {

    aws = {
         source = "hashicorp/aws"
         version =  "~> 3.74.2"
    }

    consul = {
      source = "hashicorp/consul"
    }
  }

  required_version = ">= 0.13"
}
网页内容由stack overflow 提供, 点击上面的
可以查看英文原文，
原文链接