CDKTF部署AWS IoT主题规则报错：不存在newuuid函数

环境信息 #

• Terraform v1.5.7
• CDKTF 0.20.8
• NodeJS v18.20.4
• Docker version 25.0.4, build 1a576c50a9
• aws-cli/2.13.6 Python/3.11.4 Darwin/23.5.0 exe/x86_64 prompt/off

问题场景 #

用CDKTF定义AWS IoT主题规则，为S3错误动作的key字段配置了包含AWS IoT规则引擎函数newuuid()的表达式：

const iotTopicRule1 = new iotTopicRule.IotTopicRule(this, 'iot-topic-rule-1', {
    ...,
    errorAction: {
        s3: {
            "roleArn": "arn:aws:iam::XXXXXXXXXXXXXXXXX:role/service-role/iot-write-to-failed-iot-s3-bucket",
            "bucketName" : "failed-iot-action-messages",
            "key" : "${replace(topic(), '/', '-') + '-' + timestamp() + '-' + newuuid()}",
        }
    }
})

cdktf synth执行正常，但cdktf deploy <stack-name>时报错：不存在名为"newuuid"的函数。原因是Terraform将newuuid()识别为自身的内置函数尝试解析，而非传递给AWS IoT规则引擎执行。

解决方法 #

要让Terraform不对表达式中的AWS IoT函数进行解析，需将key值标记为原始字符串，避免Terraform插值处理，有两种实现方式：

方式1：使用CDKTF的rawstring函数 #

导入rawstring工具，将表达式包裹起来，直接传递原始字符串给AWS：

import { rawstring } from "cdktf";

const iotTopicRule1 = new iotTopicRule.IotTopicRule(this, 'iot-topic-rule-1', {
    ...,
    errorAction: {
        s3: {
            roleArn: "arn:aws:iam::XXXXXXXXXXXXXXXXX:role/service-role/iot-write-to-failed-iot-s3-bucket",
            bucketName: "failed-iot-action-messages",
            key: rawstring("${replace(topic(), '/', '-') + '-' + timestamp() + '-' + newuuid()}"),
        }
    }
})

方式2：转义插值符号$ #

通过双反斜杠转义$，让Terraform不解析该插值表达式：

const iotTopicRule1 = new iotTopicRule.IotTopicRule(this, 'iot-topic-rule-1', {
    ...,
    errorAction: {
        s3: {
            roleArn: "arn:aws:iam::XXXXXXXXXXXXXXXXX:role/service-role/iot-write-to-failed-iot-s3-bucket",
            bucketName: "failed-iot-action-messages",
            key: "\\${replace(topic(), '/', '-') + '-' + timestamp() + '-' + newuuid()}",
        }
    }
})

两种方式都能让表达式原封不动传递给AWS IoT规则引擎，由AWS执行newuuid()等内置函数。

内容的提问来源于stack exchange，提问作者Dan