Terraform配置Lambda@Edge：多区域日志组保留期与标签生效问题

Lambda@Edge函数必须部署在us-east-1区域，但执行日志会生成在CloudFront边缘节点覆盖的所有AWS区域。你当前使用的terraform-aws-modules/lambda/aws模块仅会在函数部署的us-east-1区域创建日志组配置，无法覆盖其他边缘区域，因此需要手动扩展配置来统一管理所有区域的日志组。

解决方案步骤： #

1. 关闭模块自动创建日志组
   修改模块配置，禁用自动创建日志组的功能，避免和后续手动配置的资源冲突：

   module "origin_request_lambda_at_edge" {
     source                      = "terraform-aws-modules/lambda/aws"
     lambda_at_edge              = true
     function_name               = local.lambda_origin_request_name
     description                 = "${var.app_tag} viewer request lambda@edge function for ${var.env_tag} environment"
     handler                     = var.handler
     runtime                     = var.run_time
     source_path                 = "${var.main_function_folder_name}/${var.request_function_folder_name}"
     # 关闭自动创建日志组，改为手动覆盖所有区域
     create_cloudwatch_log_group = false
     tags = {
       Name        = "${local.lambda_origin_request_name}-lambda-edge"
       App         = var.app_tag
       Environment = var.env_tag
     }
   }
   

2. 定义CloudFront边缘区域列表
   创建包含所有CloudFront边缘区域的变量（可根据AWS官方最新区域列表更新）：

   variable "cloudfront_edge_regions" {
     type    = list(string)
     default = [
       "us-east-1",
       "us-east-2",
       "us-west-1",
       "us-west-2",
       "af-south-1",
       "ap-east-1",
       "ap-south-1",
       "ap-northeast-1",
       "ap-northeast-2",
       "ap-northeast-3",
       "ap-southeast-1",
       "ap-southeast-2",
       "ca-central-1",
       "eu-central-1",
       "eu-west-1",
       "eu-west-2",
       "eu-west-3",
       "eu-south-1",
       "eu-north-1",
       "me-south-1",
       "sa-east-1"
     ]
   }
   

3. 跨区域统一配置日志组
   使用aws_cloudwatch_log_group资源配合for_each遍历所有边缘区域，批量设置日志保留期和标签：

   resource "aws_cloudwatch_log_group" "lambda_at_edge" {
     for_each             = toset(var.cloudfront_edge_regions)
     # Lambda@Edge日志组命名规则固定：/aws/lambda/<部署区域>.<函数名>
     name                 = "/aws/lambda/us-east-1.${module.origin_request_lambda_at_edge.function_name}"
     retention_in_days    = 60
     tags = {
       Name        = "${local.lambda_origin_request_name}-logs"
       App         = var.app_tag
       Environment = var.env_tag
     }
     # 指定当前日志组所在的边缘区域
     region = each.value
   }
   

关键说明： #

• Lambda@Edge日志组的命名规则是固定的，所有区域的日志组名称均以us-east-1.开头（因为函数必须部署在该区域）。
• 边缘区域列表需要定期核对AWS官方文档进行更新，确保覆盖所有当前可用的CloudFront边缘节点区域。

内容的提问来源于stack exchange，提问作者Vinod Kolla