如何通过aws_cloudwatch_event_target覆盖AWS Batch作业的资源需求？

问题描述 #

我在Terraform中定义了一个可正常运行的AWS Batch作业，通过CloudWatch Event定时规则触发。目前使用aws_cloudwatch_event_rule和aws_cloudwatch_event_target配置，规则能正常触发、命令也能成功覆盖，但资源需求（VCPU和MEMORY）始终无法通过Terraform配置生效。

已确认ContainerOverrides和Command需要使用大驼峰（PascalCase）格式才能生效，且通过AWS CLI执行submit-job命令可以成功覆盖资源需求，但Terraform配置始终无效。

我的简化Terraform代码 #

resource "aws_cloudwatch_event_rule" "batchjob" {
  name       = "foo"
  is_enabled = true
  # 每月1日15:00 UTC运行
  schedule_expression = "cron(0 15 1 * ? *)"
}

resource "aws_cloudwatch_event_target" "batchjob_target" {
  rule     = "foo"
  arn      = "<queue arn>"
  role_arn = "<role arn>"
  input = jsonencode({
    # 参考AWS Batch ContainerOverrides API文档
    "ContainerOverrides" : {
      "Command" : [
        "/bin/java",
        "-jar",
        "/batch-jobs.jar",
        "foobar"
      ],
      # VCPU和MEMORY需关联配置
      "ResourceRequirements" : [
        {
          "Type"  = "VCPU"
          "Value" = "4"
        },
        {
          "Type"  = "MEMORY"
          "Value" = "8192"
        }
      ]
    }
  })
  batch_target {
    job_name       = "foo"
    job_definition = aws_batch_job_definition.job_definition.arn
  }
}

可正常运行的AWS CLI命令 #

AWS_PROFILE=dev aws batch submit-job \
        --job-name "foobar" \
        --job-queue "arn:aws:batch:us-west-2:<queue>" \
        --job-definition "arn:aws:batch:us-west-2:<definition>" \
        --container-overrides '{"command": ["/bin/java","-jar","/batch-jobs.jar","foobar"], "resourceRequirements": [{"value": "4", "type": "VCPU"}, {"value": "8192", "type": "MEMORY"}]}'

问题原因 #

你的Terraform代码中，jsonencode内的ResourceRequirements数组对象里，键值对错误地使用了HCL的赋值符号=，而非JSON要求的冒号:。这会导致生成的JSON格式无效，AWS无法正确解析资源需求配置。

虽然你已经注意到了大驼峰格式的要求，但JSON语法错误才是导致资源覆盖失效的核心问题。

修正后的Terraform代码 #

将ResourceRequirements中的=替换为:即可：

resource "aws_cloudwatch_event_rule" "batchjob" {
  name       = "foo"
  is_enabled = true
  # 每月1日15:00 UTC运行
  schedule_expression = "cron(0 15 1 * ? *)"
}

resource "aws_cloudwatch_event_target" "batchjob_target" {
  rule     = "foo"
  arn      = "<queue arn>"
  role_arn = "<role arn>"
  input = jsonencode({
    "ContainerOverrides" : {
      "Command" : [
        "/bin/java",
        "-jar",
        "/batch-jobs.jar",
        "foobar"
      ],
      "ResourceRequirements" : [
        {
          "Type"  : "VCPU"
          "Value" : "4"
        },
        {
          "Type"  : "MEMORY"
          "Value" : "8192"
        }
      ]
    }
  })
  batch_target {
    job_name       = "foo"
    job_definition = aws_batch_job_definition.job_definition.arn
  }
}

验证要点 #

• 修正后，可通过terraform plan查看input字段的生成结果，确认JSON格式正确
• 触发定时规则后，检查Batch作业的资源配置是否已更新为指定的VCPU和MEMORY

内容的提问来源于stack exchange，提问作者Eric Liprandi