使用Terraform跨多区域创建S3桶并绑定自定义策略失败求助

尝试用Terraform在us-east-1、us-west-1两个区域各创建2个S3桶，并绑定对应自定义策略。桶已成功创建，但策略绑定失败，抛出301永久重定向错误。

原Terraform代码 #

variable "bucket_prefix" {
  default = "sankethcl1234"
}

# Create S3 buckets in us-east-1
provider "aws" {
  alias  = "us-east-1"
  region = "us-east-1"
}

# Create S3 buckets in us-west-1
provider "aws" {
  alias  = "us-west-1"
  region = "us-west-1"
}

# Create 2 S3 buckets in us-east-1
resource "aws_s3_bucket" "sankethcl1234_us_east_1" {
  count    = 2
  provider = aws.us-east-1
  bucket   = "${var.bucket_prefix}-us-east-1-${count.index + 1}"
  acl      = "private"
}

# Define a bucket policy for S3 buckets in us-east-1
resource "aws_s3_bucket_policy" "sankethcl1234_us_east_1" {
  count  = 2
  bucket = aws_s3_bucket.sankethcl1234_us_east_1[count.index].id
  policy = templatefile("${path.module}/bucket_policy_east.json", { bucket_name = aws_s3_bucket.sankethcl1234_us_east_1[count.index].id })
}

# Create 2 S3 buckets in us-west-1
resource "aws_s3_bucket" "sankethcl1234_us_west_1" {
  count    = 2
  provider = aws.us-west-1
  bucket   = "${var.bucket_prefix}-us-west-1-${count.index + 1}"
}

# Define a bucket policy for S3 buckets in us-west-1
resource "aws_s3_bucket_policy" "sankethcl1234_us_west_1" {
  count  = 2
  bucket = aws_s3_bucket.sankethcl1234_us_west_1[count.index].id
  policy = templatefile("${path.module}/bucket_policy_west.json", { bucket_name = aws_s3_bucket.sankethcl1234_us_west_1[count.index].id })
}

报错信息 #

Error: putting S3 Bucket (sankethcl1234-us-east-1-2) Policy: operation error S3: PutBucketPolicy, https response error StatusCode: 301, RequestID: DNG0HE3RABQTZNJ6, HostID: mmJps0saH/1+HskYQPtwXG71ofDOUSXm95JKy4dZY5IpDpI5xuFFO3L1jU+NuyMJ49THk5rPkUs=, api error PermanentRedirect: The bucket you are attempting to access must be addressed using the specified endpoint. Please send all future requests to this endpoint.with aws_s3_bucket_policy.sankethcl1234_us_east_1[1],
on main.tf line 49, in resource "aws_s3_bucket_policy" "sankethcl1234_us_east_1":
49: resource "aws_s3_bucket_policy" "sankethcl1234_us_east_1" {

Error: putting S3 Bucket (sankethcl1234-us-east-1-1) Policy: operation error S3: PutBucketPolicy, https response error StatusCode: 301, RequestID: DNG5Z9NBPMXZAHEH, HostID: TVe1g0aYuuDF/6cT/KC/iGJOmwnDvsLdjkRhte6AwpHdqzewWsV/MUVed+B/Z0wohPXTnOlLp8I=, api error PermanentRedirect: The bucket you are attempting to access must be addressed using the specified endpoint. Please send all future requests to this endpoint.with aws_s3_bucket_policy.sankethcl1234_us_east_1[0],
on main.tf line 49, in resource "aws_s3_bucket_policy" "sankethcl1234_us_east_1":
49: resource "aws_s3_bucket_policy" "sankethcl1234_us_east_1" {

Error: putting S3 Bucket (sankethcl1234-us-west-1-2) Policy: operation error S3: PutBucketPolicy, https response error StatusCode: 301, RequestID: G4B8RZYRDH20298A, HostID: bDgPRXI49MSxEdesSpIBueXVnvV1LHD5guBm+H3vi1wwJNgtOjrZEGiFjAgofJFlWQO5UUn4YfM=, api error PermanentRedirect: The bucket you are attempting to access must be addressed using the specified endpoint. Please send all future requests to this endpoint.with aws_s3_bucket_policy.sankethcl1234_us_west_1[1],
on main.tf line 77, in resource "aws_s3_bucket_policy" "sankethcl1234_us_west_1":
77: resource "aws_s3_bucket_policy" "sankethcl1234_us_west_1" {

Error: putting S3 Bucket (sankethcl1234-us-west-1-1) Policy: operation error S3: PutBucketPolicy, https response error StatusCode: 301, RequestID: G4BC4QJP0YQ6NPHS, HostID: HSHXHl4p3Has2DEC0GoQpzecRjMdUhd//9FpdFiyq1oT+FnOEeyvIvKXcg8GJlTj2TsDG781tEM=, api error PermanentRedirect: The bucket you are attempting to access must be addressed using the specified endpoint. Please send all future requests to this endpoint.with aws_s3_bucket_policy.sankethcl1234_us_west_1[0],
on main.tf line 77, in resource "aws_s3_bucket_policy" "sankethcl1234_us_west_1":
77: resource "aws_s3_bucket_policy" "sankethcl1234_us_west_1" {

原因与解决方法 #

问题出在aws_s3_bucket_policy资源没有指定对应区域的provider，Terraform默认使用了全局或不匹配的S3端点，导致请求被重定向。

解决方法是给每个区域的aws_s3_bucket_policy资源添加对应的provider参数，和创建桶时使用的区域provider保持一致。

修改后的代码 #

variable "bucket_prefix" {
  default = "sankethcl1234"
}

# Create S3 buckets in us-east-1
provider "aws" {
  alias  = "us-east-1"
  region = "us-east-1"
}

# Create S3 buckets in us-west-1
provider "aws" {
  alias  = "us-west-1"
  region = "us-west-1"
}

# Create 2 S3 buckets in us-east-1
resource "aws_s3_bucket" "sankethcl1234_us_east_1" {
  count    = 2
  provider = aws.us-east-1
  bucket   = "${var.bucket_prefix}-us-east-1-${count.index + 1}"
  acl      = "private"
}

# Define a bucket policy for S3 buckets in us-east-1
resource "aws_s3_bucket_policy" "sankethcl1234_us_east_1" {
  count    = 2
  provider = aws.us-east-1  # 新增：指定对应区域的provider
  bucket   = aws_s3_bucket.sankethcl1234_us_east_1[count.index].id
  policy   = templatefile("${path.module}/bucket_policy_east.json", { bucket_name = aws_s3_bucket.sankethcl1234_us_east_1[count.index].id })
}

# Create 2 S3 buckets in us-west-1
resource "aws_s3_bucket" "sankethcl1234_us_west_1" {
  count    = 2
  provider = aws.us-west-1
  bucket   = "${var.bucket_prefix}-us-west-1-${count.index + 1}"
}

# Define a bucket policy for S3 buckets in us-west-1
resource "aws_s3_bucket_policy" "sankethcl1234_us_west_1" {
  count    = 2
  provider = aws.us-west-1  # 新增：指定对应区域的provider
  bucket   = aws_s3_bucket.sankethcl1234_us_west_1[count.index].id
  policy   = templatefile("${path.module}/bucket_policy_west.json", { bucket_name = aws_s3_bucket.sankethcl1234_us_west_1[count.index].id })
}

内容的提问来源于stack exchange，提问作者sanket kurane