Terraform+GitLab流水线部署AWS VPC遇远程状态认证错误求助

问题根源分析 #

你的错误来自三个核心问题：

1. GitLab Terraform State API的lock/unlock地址路径错误
2. 硬编码Token的做法不安全且未正确利用GitLab CI内置认证变量
3. 后续Terraform操作（plan/apply）未传递认证信息到Backend

分步解决方案 #

1. 修正Terraform Backend配置（provider.tf） #

修改Backend的地址规则，同时使用变量传递认证Token，避免硬编码：

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 3.27"
    }
  }
  backend "http" {
    address        = "https://gitlab.com/api/v4/projects/xxxx1/terraform/state/xxxprivate"
    # 修正lock/unlock地址：必须在state名称后加/lock和/unlock后缀
    lock_address   = "https://gitlab.com/api/v4/projects/xxxx1/terraform/state/xxxprivate/lock"
    unlock_address = "https://gitlab.com/api/v4/projects/xxxx1/terraform/state/xxxprivate/unlock"
    username       = "gitlab-ci-token"
    # 使用变量传递Token，不在代码中硬编码
    password       = var.gitlab_state_token
  }
}

# 添加对应的变量定义
variable "gitlab_state_token" {
  type        = string
  description = "GitLab CI Job Token for Terraform state backend access"
}

provider "aws" {
  region = var.aws_region
}

2. 调整GitLab CI配置（.gitlab-ci.yml） #

利用GitLab内置的CI_JOB_TOKEN自动注入认证，拆分Init到独立Stage，并确保所有涉及State操作的步骤都传递Token：

image:
  name: registry.xxx.xxx.xxx/xxx/xxx-packer:latest

stages:
 - init
 - validate
 - plan
 - apply

before_script:
  # 修正AWS变量名，保持与Provider预期一致
  - export AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
  - export AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
  - apt-get update && apt-get install -y gnupg software-properties-common apt-utils
  - wget -O- https://apt.releases.hashicorp.com/gpg | gpg --dearmor | tee /usr/share/keyrings/hashicorp-archive-keyring.gpg
  - gpg --no-default-keyring --keyring /usr/share/keyrings/hashicorp-archive-keyring.gpg --fingerprint
  - echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | tee /etc/apt/sources.list.d/hashicorp.list
  - apt update
  - apt-get install terraform=1.1.7
  - cd /builds/personalawsaccount/aws_cicd_test_private/terraform

init:
  stage: init
  script:
    # 用GitLab内置的CI_JOB_TOKEN作为认证Token
    - terraform init -var="gitlab_state_token=${CI_JOB_TOKEN}"
  tags:
    - docker

validate:
  stage: validate
  script:
    - terraform validate
  tags:
    - docker
  dependencies:
    - init

plan:
  stage: plan
  script:
    - terraform plan -var="gitlab_state_token=${CI_JOB_TOKEN}"
  tags:
    - docker
  dependencies:
    - validate

apply:
  stage: apply
  script:
    - terraform apply -auto-approve -var="gitlab_state_token=${CI_JOB_TOKEN}"
  tags:
    - docker
  dependencies:
    - plan
  only:
    - main  # 仅在主分支执行apply，防止误操作

3. 关键权限与配置检查 #

• 确认项目IDxxxx1正确：可在GitLab项目的Settings > General > Project information中查看数字ID
• 确认State名称xxxprivate无拼写错误
• 若为自托管GitLab，需检查API地址是否正确，以及是否需要跳过SSL验证（生产环境不推荐）

内容的提问来源于stack exchange，提问作者Krystian junior DevOps