在AWS Terraform CodePipeline中能否用S3 Bucket ARN替代Bucket Name？

不能直接在CodePipeline的S3 Deploy Action的BucketName参数里填写ARN，AWS的这个Action明确要求传入Bucket名称而非ARN。不过你可以通过Terraform的字符串处理函数，从MWAA模块输出的ARN中提取出Bucket名称，具体做法如下：

从ARN提取Bucket名称的方法 #

S3 Bucket ARN的格式固定为 arn:aws:s3:::<bucket-name>，可以用Terraform的split()函数按:::分隔ARN字符串，取拆分后的第二个元素（Terraform列表索引从0开始）就能得到Bucket名称。

修改后的CodePipeline配置示例 #

把原来硬编码的Bucket名称替换为函数调用：

resource "aws_codepipeline" "codepipeline" {
    name     = "airflow-pipeline-dev"
    role_arn = "<role arn>"
    tags     = {}
    tags_all = {}

    artifact_store {
        location = "codepipeline-us-east-1"
        type     = "S3"
    }

    stage {
        name = "Source"
        action {
            .....
        }
    }
    stage {
        name = "Build"
        action {
            ....
        }
    }
    stage {
        name = "Deploy"
        action {
            category         = "Deploy"
            configuration    = {
                # 从MWAA模块输出的ARN中提取Bucket名称
                "BucketName" = split(":::", module.mwaa.bucket_arn)[1]
                "Extract"    = "true"
            }
            input_artifacts  = [
                "BuildArtifact",
            ]
            name             = "Deploy"
            output_artifacts = []
            owner            = "AWS"
            provider         = "S3"
            region           = "us-east-1"
            run_order        = 1
            version          = "1"
        }
    }
}

验证逻辑 #

假设MWAA模块输出的ARN是arn:aws:s3:::airflow-dev-s3，split(":::", "arn:aws:s3:::airflow-dev-s3")会返回列表["arn:aws:s3", "airflow-dev-s3"]，取索引1的元素就是正确的Bucket名称。

内容的提问来源于stack exchange，提问作者Sasan Ahmadi