Terraform local-exec多行命令执行问题及Docker镜像构建求助

一、解决local-exec多行命令仅执行第一行的问题 #

Terraform的local-exec默认会逐行拆分命令并单独启动shell执行，要让多行命令作为一个整体运行，必须指定bash解释器并使用heredoc格式包裹命令：

resource "null_resource" "docker_build" {
  provisioner "local-exec" {
    # 指定用bash执行整个命令块，确保上下文连贯
    interpreter = ["bash", "-c"]
    # 用EOF包裹所有命令，多行将被当作单个shell会话执行
    command = <<EOF
      # 拉取Java代码仓库到临时目录
      git clone https://github.com/your-org/java-app-repo.git /tmp/java-app
      # 进入目录构建Jar包，用&&确保前序命令成功才执行后续
      cd /tmp/java-app && ./mvnw clean package -DskipTests
      # 构建并推送镜像到ECR
      docker build -t ${data.aws_ecr_repository.java_app.repository_url}:latest /tmp/java-app
      docker push ${data.aws_ecr_repository.java_app.repository_url}:latest
      # 清理临时文件
      rm -rf /tmp/java-app
    EOF
  }

  # 可选：当Java仓库更新时触发重建
  triggers = {
    java_repo_commit = "${data.github_repository.java_app.default_branch_ref.target.sha}"
  }
}

关键注意点：

• 必须配置interpreter = ["bash", "-c"]，否则cd等改变上下文的命令仅在当前行生效，后续命令会回到初始目录。
• 依赖步骤用&&连接，避免前序命令失败后继续执行无效操作。

二、解决WSL环境调用bash脚本的错误 #

如果在Windows WSL环境下运行Terraform，需注意以下两点：

1. 脚本路径必须使用WSL格式：将Windows路径C:\scripts\build.sh转换为/mnt/c/scripts/build.sh。
2. 直接指定WSL的bash解释器执行脚本：

   provisioner "local-exec" {
     interpreter = ["wsl", "bash", "-c"]
     command = "/mnt/c/scripts/build.sh ${var.ecr_repo_url}"
   }
   

3. 提前给脚本添加可执行权限：在WSL终端运行chmod +x /mnt/c/scripts/build.sh。

三、更优方案：用GitHub Actions分离构建与部署 #

用local-exec在Terraform中做镜像构建并非最佳实践，推荐将镜像构建交给GitHub Actions，基础设施部署交给Terraform，实现职责分离：

1. GitHub Actions工作流（构建+部署） #

在Java代码仓库或Terraform仓库创建.github/workflows/build-deploy.yml：

name: Build Java App & Deploy to AWS

on:
  push:
    branches: [main] # Java代码推送时自动触发
  workflow_dispatch: # 支持手动触发

jobs:
  build-image:
    runs-on: ubuntu-latest
    steps:
      # 拉取Java代码仓库（私有仓库需配置GH_PAT令牌）
      - name: Checkout Java App Code
        uses: actions/checkout@v4
        with:
          repository: your-org/java-app-repo
          ref: main
          token: ${{ secrets.GH_PAT }}

      # 登录AWS ECR镜像仓库
      - name: Login to Amazon ECR
        uses: aws-actions/amazon-ecr-login@v2
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ secrets.AWS_REGION }}

      # 构建并推送Docker镜像，用commit SHA作为唯一TAG
      - name: Build & Push Docker Image
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: |
            ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ secrets.AWS_REGION }}.amazonaws.com/java-app:${{ github.sha }}
            ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ secrets.AWS_REGION }}.amazonaws.com/java-app:latest

      # 传递镜像TAG到部署步骤
      - name: Export Image Tag
        id: image-tag
        run: echo "tag=${{ github.sha }}" >> $GITHUB_OUTPUT

  deploy-infra:
    needs: build-image
    runs-on: ubuntu-latest
    steps:
      # 拉取Terraform代码仓库
      - name: Checkout Terraform Code
        uses: actions/checkout@v4
        with:
          repository: your-org/terraform-aws-deploy
          ref: main
          token: ${{ secrets.GH_PAT }}

      # 配置AWS凭证
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ secrets.AWS_REGION }}

      # 初始化Terraform
      - name: Terraform Init
        run: terraform init

      # 应用Terraform配置，传入构建好的镜像TAG
      - name: Terraform Apply
        run: terraform apply -auto-approve -var "image_tag=${{ steps.image-tag.outputs.tag }}"

2. Terraform代码引用镜像变量 #

在Terraform代码中定义变量，直接引用GitHub Actions传入的镜像TAG，无需处理构建逻辑：

variable "image_tag" {
  type        = string
  description = "Docker image tag from GitHub Actions build"
}

variable "aws_region" {
  type        = string
  default     = "us-east-1"
}

data "aws_caller_identity" "current" {}

# ECS任务定义中引用镜像
resource "aws_ecs_task_definition" "java_app" {
  family                   = "java-app-task"
  network_mode             = "awsvpc"
  requires_compatibilities = ["FARGATE"]
  cpu                      = "256"
  memory                   = "512"
  execution_role_arn       = aws_iam_role.ecs_execution_role.arn
  task_role_arn            = aws_iam_role.ecs_task_role.arn

  container_definitions = jsonencode([
    {
      name      = "java-app"
      image     = "${data.aws_caller_identity.current.account_id}.dkr.ecr.${var.aws_region}.amazonaws.com/java-app:${var.image_tag}"
      portMappings = [
        {
          containerPort = 8080
          hostPort      = 8080
          protocol      = "tcp"
        }
      ]
      logConfiguration = {
        logDriver = "awslogs"
        options = {
          awslogs-group         = "/ecs/java-app"
          awslogs-region        = var.aws_region
          awslogs-stream-prefix = "ecs"
        }
      }
    }
  ])
}

方案优势 #

• 职责分离：Terraform专注基础设施配置，构建逻辑交给CI/CD，符合DevOps最佳实践。
• 环境无关：避免local-exec依赖本地shell环境（如WSL、Docker安装）的兼容性问题。
• 可追溯性：GitHub Actions提供完整的构建日志，便于排查问题。
• 自动化：Java代码更新自动触发构建和部署，无需手动操作。

内容的提问来源于stack exchange，提问作者Maksym Matveichuk