使用Terraform创建AWS AppFlow LinkedIn Ads连接器遇注册错误，求解决方案

你遇到的ResourceNotFoundException错误核心原因是：创建连接器配置（Connector Profile）前，必须先注册自定义连接器实体。控制台操作时AWS会自动完成连接器注册步骤，但Terraform需要显式执行完整流程：创建Lambda后端函数 → 注册自定义连接器 → 创建连接器配置。

以下是完整的Terraform实现步骤：

1. 创建处理LinkedIn Ads请求的Lambda函数 #

AppFlow自定义连接器依赖Lambda函数处理API交互（OAuth授权、数据拉取等）。下面是基础的Lambda资源配置（实际函数代码需根据LinkedIn Ads API规范实现AppFlow要求的接口）：

# Lambda IAM角色：允许AppFlow调用Lambda，以及Lambda访问LinkedIn API
resource "aws_iam_role" "linkedin_connector_lambda_role" {
  name = "linkedin-ads-connector-lambda-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "lambda.amazonaws.com"
        }
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "lambda_basic_execution" {
  role       = aws_iam_role.linkedin_connector_lambda_role.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}

# 允许AppFlow调用Lambda的权限
resource "aws_lambda_permission" "appflow_invoke_lambda" {
  statement_id  = "AllowAppFlowInvoke"
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.linkedin_connector_lambda.function_name
  principal     = "appflow.amazonaws.com"
}

# Lambda函数（示例使用zip包，实际需替换为符合AppFlow自定义连接器规范的代码）
resource "aws_lambda_function" "linkedin_connector_lambda" {
  filename      = "linkedin-connector-lambda.zip" # 替换为你的函数包路径
  function_name = "linkedin-ads-connector-lambda"
  role          = aws_iam_role.linkedin_connector_lambda_role.arn
  handler       = "index.handler" # 替换为你的函数入口
  runtime       = "nodejs18.x"

  source_code_hash = filebase64sha256("linkedin-connector-lambda.zip")
}

2. 注册AppFlow自定义连接器 #

使用aws_appflow_connector资源完成连接器注册，这是解决404错误的关键步骤：

resource "aws_appflow_connector" "linkedin_ads_connector" {
  connector_label = "linkedin_ads_connector"
  connector_type  = "CustomConnector"

  connector_provisioning_config {
    lambda {
      lambda_arn = aws_lambda_function.linkedin_connector_lambda.arn
    }
  }

  connector_config {
    custom_connector {
      oauth2 {
        oauth2_grant_type = "AUTHORIZATION_CODE"
        token_url         = "https://www.linkedin.com/oauth/v2/accessToken"
        auth_url          = "https://www.linkedin.com/oauth/v2/authorization"
        scopes            = ["r_ads_reporting", "r_ads"] # 按需调整LinkedIn权限范围
      }
    }
  }
}

3. 创建连接器配置（Connector Profile） #

现在可以创建你最初编写的连接器配置，注意引用已注册的connector_label：

resource "aws_appflow_connector_profile" "linkedin_ads_profile" {
  name               = "linkedin_ads_connector_profile"
  connector_type     = "CustomConnector"
  connection_mode    = "Public"
  connector_label    = aws_appflow_connector.linkedin_ads_connector.connector_label

  connector_profile_config {
    connector_profile_credentials {
      custom_connector {
        authentication_type = "OAUTH2"
        oauth2 {
          access_token  = var.linkedin_access_token
          client_id     = var.linkedin_client_id
          client_secret = var.linkedin_client_secret
        }
      }
    }

    connector_profile_properties {
      custom_connector {
        oauth2_properties {
          oauth2_grant_type = "AUTHORIZATION_CODE"
          token_url         = "https://www.linkedin.com/oauth/v2/accessToken"
        }
      }
    }
  }

  # 依赖连接器注册完成
  depends_on = [aws_appflow_connector.linkedin_ads_connector]
}

关键注意事项 #

• Lambda函数实现：必须遵循AWS AppFlow自定义连接器的接口规范，实现DISCOVER（元数据发现）、AUTHORIZE（OAuth授权）、INVOKE（数据拉取/推送）等核心动作。
• LinkedIn开发者配置：需在LinkedIn开发者平台创建应用，配置正确的回调URL（AWS AppFlow自定义连接器的OAuth回调URL可在连接器注册后获取），并确保申请的权限范围与Terraform中scopes一致。
• 权限配置：确保Lambda角色拥有访问LinkedIn API的出站权限，以及AppFlow拥有调用Lambda的权限。

内容的提问来源于stack exchange，提问作者Karthik Potturi