GitLab中Terraform AWS Pipeline无法识别变更及凭证问题排查

问题现象 #

• 已在GitLab配置AWS访问密钥和密钥作为环境变量，但必须通过terraform init -backend-config="access_key=$AWS_ACCESS_KEY_PIPELINE_TEST" -backend-config="secret_key=$AWS_ACCESS_KEY_PIPELINE_SECRET" -backend-config="region=$AWS_DEFAULT_REGION"显式传入凭证才能完成Terraform初始化，环境变量无法自动生效
• 直接执行terraform plan无法检测到基础设施变更，但指定var-file后可正常识别变更

提供的配置及输出信息 #

GitLab CI配置 #

image:
  name: hashicorp/terraform:latest
  entrypoint:
    - '/usr/bin/env'
    - 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'

variables:
  hcm_dev_PLAN: hcm_dev_plan.tfplan
  hcm_shared_PLAN: hcm_shared_plan.tfplan
  hcm_prod_PLAN: hcm_prod_plan.tfplan

stages:
  - test
  - validate
  - plan
  - apply


.validate: &ValidateAnchor
  script:
    - |
      echo "I am inside the validate anchor step"
      if [[ ${CI_JOB_NAME} == "validate" ]]; then
        export access_key=${AWS_ACCESS_KEY_PIPELINE_TEST}
        export secret_key=${AWS_ACCESS_KEY_PIPELINE_SECRET}
        export region=${AWS_DEFAULT_REGION}
        terraform init -backend-config="access_key=$AWS_ACCESS_KEY_PIPELINE_TEST" -backend-config="secret_key=$AWS_ACCESS_KEY_PIPELINE_SECRET" -backend-config="region=$AWS_DEFAULT_REGION"
        echo "DEV successfully initialized!"
        terraform fmt
        terraform validate
      fi

.plan: &PlanAnchor
  script:
    - |
      if [[ ${CI_JOB_NAME} == "plan" ]]; then
        export access_key=${AWS_ACCESS_KEY_PIPELINE_TEST}
        export secret_key=${AWS_ACCESS_KEY_PIPELINE_SECRET}
        export region=${AWS_DEFAULT_REGION}
        terraform init -backend-config="access_key=$AWS_ACCESS_KEY_PIPELINE_TEST" -backend-config="secret_key=$AWS_ACCESS_KEY_PIPELINE_SECRET" -backend-config="region=$AWS_DEFAULT_REGION"
        echo "DEV successfully initialized!"
        terraform plan -out=$hcm_dev_PLAN
      fi


validate:
  <<: *ValidateAnchor
  stage: validate
  only:
    changes:
      - *

plan:
  <<: *PlanAnchor
  stage: plan
  only:
    changes:
      - *
  artifacts:
    name: plan
    paths:
      - "$CI_PROJECT_DIR"
    exclude:

Plan执行输出 #

DEV successfully initialized!
No changes. Your infrastructure matches the configuration.
Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

Terraform Provider配置文件 #

provider "aws" {
  #required_version = ">= 0.13.1"
  region = "us-east-1"
}

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 4.9"
    }
  }
  backend "s3" {
    bucket = "terraform-dev-statefile-bucket"
    key    = "statefile-name.tfstate"
    region = "us-east-1"
  }
}

版本及初始化验证输出 #

Terraform has been successfully initialized!
You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.
If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.
DEV successfully initialized!
variables.tf
╷
│ Warning: Argument is deprecated
│ 
│   with module.s3.aws_s3_bucket.create-s3-bucket,
│   on .terraform/modules/s3/storage/s3/main.tf line 1, in resource "aws_s3_bucket" "create-s3-bucket":
│    1: resource "aws_s3_bucket" "create-s3-bucket" {
│ 
│ Use the aws_s3_bucket_server_side_encryption_configuration resource instead
╵
Success! The configuration is valid, but there were some
validation warnings as shown above.
Terraform v1.7.0
on linux_amd64
+ provider registry.terraform.io/hashicorp/aws v5.32.1
Cleaning up project directory and file based variables
00:01
Job succeeded

问题排查及解决建议 #

一、凭证无法自动生效问题 #

1. Backend与Provider的凭证变量差异

   • S3 Backend默认读取AWS_ACCESS_KEY_ID和AWS_SECRET_ACCESS_KEY环境变量，而非你自定义的AWS_ACCESS_KEY_PIPELINE_TEST和AWS_ACCESS_KEY_PIPELINE_SECRET。若想让环境变量自动生效，需将自定义变量映射为Terraform默认识别的变量：

     export AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_PIPELINE_TEST}
     export AWS_SECRET_ACCESS_KEY=${AWS_ACCESS_KEY_PIPELINE_SECRET}
     export AWS_DEFAULT_REGION=${AWS_DEFAULT_REGION}
     

   • 你当前脚本中导出的access_key、secret_key变量未被Terraform使用，属于无效操作。

2. GitLab变量作用域校验

   • 确认GitLab中配置的AWS_ACCESS_KEY_PIPELINE_TEST等变量的作用域包含当前流水线所在分支/标签，若作用域不匹配，变量无法在Job中正常获取。

二、变更检测异常问题 #

1. 变量加载缺失

   • Terraform默认加载terraform.tfvars、*.auto.tfvars文件或TF_VAR_*前缀的环境变量。若你的变量存储在其他自定义文件名（如dev.tfvars）中，必须显式通过-var-file指定，否则Terraform会使用变量默认值（无默认值则报错），导致与实际资源状态不匹配，无法检测到变更。
   • 检查variables.tf文件，确认是否有变量未设置默认值且未通过环境变量传递。

2. 状态文件一致性校验

   • 执行terraform state list查看当前状态中的资源，与实际AWS资源对比，确认使用的是S3桶中正确的statefile-name.tfstate文件。若存在手动修改状态文件、多环境共用状态文件的情况，会导致变更检测失效。

3. CI Artifacts优化

   • 当前plan Job的Artifacts配置为打包整个项目目录，建议仅传递必要文件（如生成的hcm_dev_plan.tfplan），避免不必要的文件干扰。

内容的提问来源于stack exchange，提问作者DevOps_Engg