Terraform 1.5.7中aws_ecr_repository_policy持续触发更新问题

环境与配置信息 #

• Terraform版本：1.5.7
• 使用模块：terraform-aws-modules/ecr/aws
• AWS Provider版本：~> 5.37

provider.tf #

terraform {
  required_version = ">= 1.5.7"

  backend "s3" {
    ...
  }
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.37"
    }
  }
}

ecr.tf #

module "my_ecr" {
  source = "../shared/ecr"
  .....
}

shared/ecr/main.tf #

module "ecr" {
  source  = "terraform-aws-modules/ecr/aws"
  ...
}

问题现象 #

执行terraform plan时，即使未修改任何资源或代码，module.ecr.aws_ecr_repository_policy.this[0]始终显示需要更新，具体为移除一条针对Lambda的权限语句：

module.my_ecr.module.ecr.aws_ecr_repository_policy.this[0] will be updated in-place

  ~ resource "aws_ecr_repository_policy" "this" {
        id          = "example"
      ~ policy      = jsonencode(
          ~ {
              ~ Statement = [
                    {
                        Action    = [
                            "ecr:ListTagsForResource",
                            "ecr:ListImages",
                            "ecr:GetRepositoryPolicy",
                            "ecr:GetLifecyclePolicyPreview",
                            "ecr:GetLifecyclePolicy",
                            "ecr:GetDownloadUrlForLayer",
                            "ecr:GetAuthorizationToken",
                            "ecr:DescribeRepositories",
                            "ecr:DescribeImages",
                            "ecr:DescribeImageScanFindings",
                            "ecr:BatchGetImage",
                            "ecr:BatchCheckLayerAvailability",
                        ]
                        Effect    = "Allow"
                        Principal = {
                            AWS = "arn:aws:iam::....."
                        }
                        Sid       = "PrivateReadOnly"
                    },
                  - {
                      - Action    = [
                          - "ecr:BatchGetImage",
                          - "ecr:GetDownloadUrlForLayer",
                          - "ecr:SetRepositoryPolicy",
                          - "ecr:DeleteRepositoryPolicy",
                          - "ecr:GetRepositoryPolicy",
                        ]
                      - Condition = {
                          - StringLike = {
                              - "aws:sourceArn" = "arn:aws:lambda:...."
                            }
                        }
                      - Effect    = "Allow"
                      - Principal = {
                          - Service = "lambda.amazonaws.com"
                        }
                      - Sid       = "LambdaECRImageRetrievalPolicy"
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        # (2 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

尝试更换Terraform版本后问题依旧，请问该问题产生的原因是什么？

问题原因分析 #

• Lambda自动添加的策略不在Terraform管理范围内：AWS Lambda在关联ECR镜像时，会自动给ECR仓库添加针对lambda.amazonaws.com的权限策略，但这条策略是AWS后台自动创建的，没有被定义在你的Terraform配置里。Terraform状态文件中不存在这条策略的记录，所以每次执行plan时，会判定这条策略是额外的，试图移除它来匹配配置中的期望状态。
• 模块默认配置未包含Lambda权限：你使用的terraform-aws-modules/ecr/aws模块默认不会自动添加Lambda相关的仓库策略，而这条自动添加的策略和Terraform的期望状态不一致，导致每次plan都会出现变更提示。
• JSON策略的格式差异（次要可能）：如果后续手动添加类似策略，可能因为JSON编码的键顺序、空格、换行等格式差异，导致Terraform认为策略不匹配，但当前场景更偏向于外部自动添加的策略未被管理的问题。

内容的提问来源于stack exchange，提问作者52zxc