Terraform部署S3存储桶无操作仍持续生成访问日志问题

我用Terraform创建了包含3个S3存储桶的项目：1个公开桶、1个私有桶、1个服务器访问日志桶，相关配置代码如下。目前日志功能正常，但无任何手动操作时，日志桶仍持续生成以我的IAM用户（通过SSO假定角色）为名的日志，且Terraform会自动假定角色执行操作。我已尝试关闭VSCode确保会话结束，也查阅相关资料但未找到原因。我想了解该现象的原因，以及是否可以限制被记录的API调用。注：我是Terraform新手，这是我的第一个编程项目。

项目配置代码 #

Main.tf #

module "public-s3" {
  source        = "./modules"
  name          = "public"
  acl           = "public-read"
  target_bucket = module.logging-s3.bucket-name

  depends_on = [module.logging-s3]
}

module "private-s3" {
  source        = "./modules"
  name          = "private"
  acl           = "private"
  target_bucket = module.logging-s3.bucket-name

  depends_on = [module.logging-s3]
}

module "logging-s3" {
  source = "./modules/logging"
  name   = "logging"
  acl    = "log-delivery-write"
}

./modules/s3.tf #

resource "random_integer" "bucket-int" {
  min = 1000000
  max = 5000000
}


resource "aws_s3_bucket" "s3" {
  bucket = "${var.name}-${random_integer.bucket-int.result}"

  tags = {
    Name = "${var.name}"
  }
}

resource "aws_s3_bucket_ownership_controls" "ownership" {
  bucket = aws_s3_bucket.s3.id
  rule {
    object_ownership = "BucketOwnerPreferred"
  }
}


resource "aws_s3_bucket_public_access_block" "public" {
  bucket = aws_s3_bucket.s3.id

  block_public_acls       = var.acl == "public-read" ? false : true
  block_public_policy     = var.acl == "public-read" ? false : true
  ignore_public_acls      = var.acl == "public-read" ? false : true
  restrict_public_buckets = var.acl == "public-read" ? false : true
}


resource "aws_s3_bucket_acl" "bucket-acl" {
  depends_on = [aws_s3_bucket_ownership_controls.ownership,
    aws_s3_bucket_public_access_block.public
  ]

  bucket = aws_s3_bucket.s3.id
  acl    = var.acl
}

resource "aws_s3_bucket_logging" "logs-delivery" {
  bucket        = aws_s3_bucket.s3.id
  target_bucket = var.target_bucket
  target_prefix = "log-${var.name}/"

  depends_on = [var.target_bucket]
}

output "bucket-name" {
  value = aws_s3_bucket.s3.bucket
}

./modules/logging/logging-s3.tf #

resource "random_integer" "bucket-int" {
  min = 1000000
  max = 5000000
}


resource "aws_s3_bucket" "s3" {
  bucket = "${var.name}-${random_integer.bucket-int.result}"

  tags = {
    Name = "${var.name}"
  }
}

resource "aws_s3_bucket_ownership_controls" "ownership" {
  bucket = aws_s3_bucket.s3.id
  rule {
    object_ownership = "BucketOwnerPreferred"
  }
}


resource "aws_s3_bucket_public_access_block" "public" {
  bucket = aws_s3_bucket.s3.id

  block_public_acls       = var.acl == "public-read" ? false : true
  block_public_policy     = var.acl == "public-read" ? false : true
  ignore_public_acls      = var.acl == "public-read" ? false : true
  restrict_public_buckets = var.acl == "public-read" ? false : true
}


resource "aws_s3_bucket_acl" "bucket-acl" {
  depends_on = [aws_s3_bucket_ownership_controls.ownership,
    aws_s3_bucket_public_access_block.public
  ]

  bucket = aws_s3_bucket.s3.id
  acl    = var.acl
}


output "bucket-name" {
  value = aws_s3_bucket.s3.bucket
}

resource "aws_s3_bucket_policy" "allow_write_logs" {
  bucket = aws_s3_bucket.s3.id
  policy = <<EOF
    {
    "Version": "2012-10-17",
    "Id": "S3-Console-Auto-Gen-Policy-1684330819963",
    "Statement": [
        {
            "Sid": "S3PolicyStmt-DO-NOT-MODIFY-1684330819758",
            "Effect": "Allow",
            "Principal": {
                "Service": "logging.s3.amazonaws.com"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::${aws_s3_bucket.s3.bucket}/*"
        }
    ]
}
  EOF
}

问题原因分析 #

1. Terraform相关自动操作 #

• VSCode的Terraform插件默认开启自动配置验证、状态刷新功能，即使关闭VSCode，后台残留进程仍可能持续调用AWS API检查S3桶状态。
• 若使用Terraform Cloud/Enterprise，服务会定期执行terraform plan同步状态，过程中发起的HeadBucket、ListBucket等请求会被日志记录。

2. AWS SSO凭证未过期 #

SSO假定角色生成的临时凭证会保存在本地缓存（路径通常为~/.aws/sso/cache），默认有效期最长可达12小时。即使关闭VSCode，其他后台进程（定时脚本、监控工具等）仍可使用有效凭证发起S3请求。

3. S3访问日志的默认行为 #

S3访问日志会记录所有针对桶的API请求，包括只读类操作（如HeadBucket、ListBucket），哪怕未修改桶内数据，都会被写入日志桶。

限制不必要日志的解决方案 #

1. 关闭Terraform自动操作 #

• 在VSCode Terraform插件设置中，禁用"Auto Refresh"、"Auto Validate"等自动触发功能，确保退出VSCode后无后台进程残留。
• 若使用Terraform Cloud，调整工作区设置，关闭自动计划（Auto Plan），仅在手动提交代码变更时触发执行。

2. 手动清理AWS凭证缓存 #

直接删除本地SSO缓存文件，强制终止当前会话：

rm -rf ~/.aws/sso/cache/*

或通过AWS CLI主动退出SSO会话：

aws sso logout

3. 细化IAM角色权限 #

遵循最小权限原则，给SSO角色仅授予必要的S3操作权限，减少无关请求。例如：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketLocation",
        "s3:ListBucket",
        "s3:GetBucketAcl",
        "s3:GetBucketLogging"
      ],
      "Resource": [
        "arn:aws:s3:::public-*",
        "arn:aws:s3:::private-*",
        "arn:aws:s3:::logging-*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:CreateBucket",
        "s3:PutBucketAcl",
        "s3:PutBucketLogging"
      ],
      "Resource": [
        "arn:aws:s3:::public-*",
        "arn:aws:s3:::private-*",
        "arn:aws:s3:::logging-*"
      ],
      "Condition": {
        "Bool": {
          "aws:MultiFactorAuthPresent": "true"
        }
      }
    }
  ]
}

4. 避免日志循环 #

不要给日志桶本身开启访问日志（当前配置已符合要求），否则会生成大量冗余循环日志。

内容的提问来源于stack exchange，提问作者EBox