Terraform-更新S3访问控制：用grant取代acl的问题

Question

module "access_logging_bucket" {
    source = "../../resources/s3_bucket"
    environment = "${var.environment}"
    region = "${var.region}"
    acl = "log-delivery-write"

    encryption_key_alias = "alias/ab-data-key"

    name = "access-logging"
    name_tag = "Access logging bucket"
}

resource "aws_s3_bucket" "default" {
    bucket = "ab-${var.environment}-${var.name}-${random_id.bucket_suffix.hex}"
    acl = "${var.acl}"

    depends_on = [data.template_file.dependencies]

    tags = {
        name = "${var.name_tag}"
        . . .
    }

    lifecycle {
        ignore_changes = [ "server_side_encryption_configuration" ]
    }
}

变量acl的默认值是变量“acl”{default=“private”}。也如Terraform S3 bucket属性引用文档所述。

对于这个bucket，它被设置为log-delivery-write。

我想更新它以添加以下授权并删除相互冲突的acl：

grant {
    permissions = ["READ_ACP", "WRITE"]
    type = "Group"
    uri = "http://acs.amazonaws.com/groups/s3/LogDelivery"
}
grant {
    id = data.aws_canonical_user_id.current.id
    permissions = ["FULL_CONTROL"]
    type = "CanonicalUser"
}

null

Answer 1

根据grant-log-delivery-permissions-general文档，我继续运行terraform apply。

在第一次运行时，它正确地设置了bucket owner权限，但删除了S3日志传递组。因此，我再次运行Terraform Plan，它显示了以下acl授权差异。我认为很可能是它首先更新了ACL值，该值删除了Log delivery Group的授权。

因此，我重新运行了Terraform Apply，它运行良好，还更正了日志传递组。

  # module.buckets.module.access_logging_bucket.aws_s3_bucket.default will be updated in-place
  ~ resource "aws_s3_bucket" "default" {
        acl                         = "private"
        bucket                      = "ml-mxs-stage-access-logging-9d8e94ff"
        force_destroy               = false
        . . .
        tags                        = {
            "name"                                = "Access logging bucket"
            . . .
        }

      + grant {
          + permissions = [
              + "READ_ACP",
              + "WRITE",
            ]
          + type        = "Group"
          + uri         = "http://acs.amazonaws.com/groups/s3/LogDelivery"
        }
      + grant {
          + id          = "ID_VALUE"
          + permissions = [
              + "FULL_CONTROL",
            ]
          + type        = "CanonicalUser"
        }
        . . .
    }

Plan: 0 to add, 1 to change, 0 to destroy.