Terraform创建Lambda函数时出错:ResourceConflictException和Terraform apply刚刚创建的资源
我在帐户的每个AWS区域中部署了一个Lambda函数,遇到了一个奇怪的问题,应用程序失败了,一些AWS区域出现了以下错误消息 应用地形时出错Terraform创建Lambda函数时出错:ResourceConflictException和Terraform apply刚刚创建的资源,terraform,terraform-provider-aws,Terraform,Terraform Provider Aws,我在帐户的每个AWS区域中部署了一个Lambda函数,遇到了一个奇怪的问题,应用程序失败了,一些AWS区域出现了以下错误消息 应用地形时出错 Error: Error creating Lambda function: ResourceConflictException: Function already exist: log-forwarder { RespMetadata: { StatusCode: 409, RequestID: "8cfd7260-7c4a
Error: Error creating Lambda function: ResourceConflictException: Function already exist: log-forwarder
{
RespMetadata: {
StatusCode: 409,
RequestID: "8cfd7260-7c4a-42d2-98c6-6619c7b2804f"
},
Message_: "Function already exist: log-forwarder",
Type: "User"
}
上面的Lambda函数刚刚由失败的Terraform Apply创建
terraform plan和init不会抛出任何关于TF配置问题的错误
plan和init都成功运行
下面是我的目录结构
.
├── log_forwarder.tf
├── log_forwarder_lambdas
│ └── main.tf
└── providers.tf
下面是我的providers.tf
文件
provider "aws" {
region = "us-east-1"
version = "3.9.0"
}
provider "aws" {
alias = "us-east-2"
region = "us-east-2"
version = "3.9.0"
}
provider "aws" {
alias = "us-west-2"
region = "us-west-2"
version = "3.9.0"
}
provider "aws" {
alias = "us-west-1"
region = "us-west-1"
version = "3.9.0"
}
provider "aws" {
alias = "ca-central-1"
region = "ca-central-1"
version = "3.9.0"
}
... with all the AWS Regions.
下面是log\u forwarder.tf的tf配置
terraform {
required_version = "0.12.25"
backend "s3" {
All the backend Config
}
}
resource "aws_iam_role" "log_forwarder" {
name = "LogForwarder"
assume_role_policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Service": ["lambda.amazonaws.com"]
},
"Action": "sts:AssumeRole"
}
]
}
EOF
}
resource "aws_iam_role_policy" "log_forwarder" {
name = "LogForwarder"
role = aws_iam_role.log_forwarder.id
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"lambda:ListTags",
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": [
"arn:aws:logs:*",
"arn:aws:lambda:*"
]
},
{
"Effect": "Allow",
"Action": [
"lambda:InvokeFunction"
],
"Resource": "*"
},
{
"Sid": "AWSDatadogPermissionsForCloudtrail",
"Effect": "Allow",
"Action": ["s3:ListBucket", "s3:GetBucketLocation", "s3:GetObject", "s3:ListObjects"],
"Resource": [
"arn:aws:s3:::BucketName",
"arn:aws:s3:::BucketName/*"
]
}
]
}
EOF
}
module "DDLogForwarderUSEast1" {
source = "./log_forwarder_lambdas"
dd_log_forwarder_role = aws_iam_role.log_forwarder.arn
region = "us-east-1"
}
module "DDLogForwarderUSEast2" {
source = "./log_forwarder_lambdas"
dd_log_forwarder_role = aws_iam_role.log_forwarder.arn
providers = { aws = aws.us-east-2 }
region = "us-east-2"
}
module "DDLogForwarderUSWest1" {
source = "./log_forwarder_lambdas"
dd_log_forwarder_role = aws_iam_role.log_forwarder.arn
providers = { aws = aws.us-west-1 }
region = "us-west-1"
}
module "DDLogForwarderUSWest2" {
source = "./log_forwarder_lambdas"
dd_log_forwarder_role = aws_iam_role.log_forwarder.arn
region = "us-west-2"
providers = { aws = aws.us-west-2 }
}
module "DDLogForwarderAPEast1" {
source = "./log_forwarder_lambdas"
dd_log_forwarder_role = aws_iam_role.log_forwarder.arn
providers = { aws = aws.ap-east-1 }
region = "ap-east-1"
}
module "DDLogForwarderAPSouth1" {
source = "./log_forwarder_lambdas"
dd_log_forwarder_role = aws_iam_role.log_forwarder.arn
region = "ap-south-1"
providers = { aws = aws.ap-south-1 }
}
... All AWS Regions with different providers
variable "region" {}
variable "account_id" {
default = "AWS Account Id"
}
variable "dd_log_forwarder_role" {}
variable "exclude_at_match" {
default = "([A-Z]* RequestId: .*)"
}
data "aws_s3_bucket" "cloudtrail_bucket" {
count = var.region == "us-west-2" ? 1 : 0
bucket = "BucketName"
}
resource "aws_lambda_function" "log_forwarder" {
filename = "${path.cwd}/log_forwarder_lambdas/aws-dd-forwarder-3.16.3.zip"
function_name = "log-forwarder"
role = var.dd_log_forwarder_role
description = "Gathers logs from targetted Cloudwatch Log Groups and sends them to DataDog"
handler = "lambda_function.lambda_handler"
runtime = "python3.7"
timeout = 600
memory_size = 1024
layers = ["arn:aws:lambda:${var.region}:464622532012:layer:Datadog-Python37:11"]
environment {
variables = {
DD_ENHANCED_METRICS = false
EXCLUDE_AT_MATCH = var.exclude_at_match
}
}
}
resource "aws_cloudwatch_log_group" "log_forwarder" {
name = "/aws/lambda/${aws_lambda_function.log_forwarder.function_name}"
retention_in_days = 90
}
resource "aws_lambda_permission" "cloudtrail_bucket" {
count = var.region == "us-west-2" ? 1 : 0
statement_id = "AllowExecutionFromS3Bucket"
action = "lambda:InvokeFunction"
function_name = aws_lambda_function.log_forwarder.arn
principal = "s3.amazonaws.com"
source_arn = element(data.aws_s3_bucket.cloudtrail_bucket.*.arn, count.index)
}
resource "aws_s3_bucket_notification" "cloudtrail_bucket_notification" {
count = var.region == "us-west-2" ? 1 : 0
bucket = element(data.aws_s3_bucket.cloudtrail_bucket.*.id, count.index)
lambda_function {
lambda_function_arn = aws_lambda_function.log_forwarder.arn
events = ["s3:ObjectCreated:*"]
}
depends_on = [aws_lambda_permission.cloudtrail_bucket, aws_cloudwatch_log_group.log_forwarder]
}
在这种情况下,我使用TF 0.12.25
到目前为止我已经尝试过的事情
每次运行terraform init/plan/apply循环时,从根模块中删除.terraform文件夹
我尽可能多地重构代码
我正在本地运行TF计划/应用循环,没有任何CI
乍一看,Lambda函数似乎不在您的地形状态(无论出于何种原因)。您是否更改了后端/从后端删除了数据
运行terraform show
和/或terraform state show
,查看冲突的Lambda函数是否处于您的状态。
如果不是,但AWS中已经存在,则可以导入它。
请看这里:
更新:
根据您的说法,由于资源存在于AWS中,但不在状态中,因此这是一个预期错误。(Terraform不知道资源存在,因此尝试创建它;AWS知道它已经存在,因此返回错误。)
你有两个选择:
- 删除AWS中的资源并再次运行Terraform;或
- 将现有资源导入Terraform(推荐)
尝试以下方法:
terraform import module.DDLogForwarderUSEast1.aws_lambda_function.log-forwarder log-forwarder
(如果在其他地区尝试此操作,请确保设置了正确的提供者/地区!)这是我最初的想法,AWS中已经存在Lambda函数,我的TF对此表示不满。然而,我已经仔细检查了目标区域,但没有成功。我也在完全独立的AWS账户中旋转以上的infra片段,只是为了分离,但仍然是相同的错误。定义成功?>但是我已经仔细检查了目标区域,但是没有成功。那么您的terraform show
的输出是什么?函数是否存在?当我运行TF apply to上述代码时,它开始创建所有必要的资源,并在运行结束时失败,并显示Resource ready exists错误消息。如果我转到TF错误中提到的目标区域,我可以看到lambda函数是由TF Apply cycle(几分钟前)创建的。然而,地形状态列表
没有任何类似的资源。我已经目视检查了s3后端中的地形状态,它也缺少了TF apply cycle刚刚创建的资源。