Terraform引用模块内Firehose资源ARN触发Unsupported attribute错误

问题场景与配置 #

我在/modules/firehose目录下定义了如下配置：

resource "aws_kinesis_firehose_delivery_stream" "purchase_logs_firehose_stream" {
  name        = var.firehose_stream_name
  destination = "extended_s3"
  extended_s3_configuration {
    role_arn        = var.firehose_role_arn
    buffer_interval = 60
    buffer_size     = 64
    bucket_arn      = var.destination_bucket_arn
  }
}
variable "firehose_stream_name" {
  description = "流名称"
}

variable "firehose_role_arn" {
}

variable "destination_bucket_arn" {
}

根目录中引入该模块的配置：

module "purchase_logs_firehose_prod" {
  source                 = "./modules/firehose"
  firehose_stream_name   = "purchase_logs_firehose_prod"
  firehose_role_arn      = aws_iam_role.purchase_logs_firehose_role.arn
  destination_bucket_arn = aws_s3_bucket.purchase_logs_destination_prod.arn
}
resource "aws_s3_bucket" "purchase_logs_destination_prod" {
  bucket = "purchase-logs-prod-dump"
}

问题描述 #

根据AWS Terraform Provider文档，aws_kinesis_firehose_delivery_stream资源确实存在arn属性，但我在iam.tf中尝试通过module.purchase_logs_firehose_prod.arn引用时，报错如下：

│ Error: Unsupported attribute
│ 
│   on iam.tf line 83, in resource "aws_iam_policy" "ec2_policy":
│   83:             ${module.purchase_logs_firehose_prod.arn}
│     ├────────────────
│     │ module.purchase_logs_firehose_prod is a object
│ 
│ This object does not have an attribute named "arn".

即使移除报错代码执行terraform apply后，状态文件里能看到该Firehose资源的arn属性，但就是无法通过模块引用，求排查原因。

引用位置配置（iam.tf） #

resource "aws_iam_policy" "ec2_policy" {
  name        = "ec2-policy"


  policy = <<EOF
{
  "Version":"2012-10-17",
  "Statement":[
      {
        "Effect":"Allow",
        "Action":[
            "*"
        ],
        "Resource":[
            "${module.purchase_logs_firehose_prod.arn}" 
        ]
      }
  ]
}
EOF

}

解决方案 #

问题核心是Terraform模块不会自动导出内部资源的属性，必须显式声明输出（output）才能让外部引用。

在/modules/firehose目录下新建outputs.tf文件，添加以下内容：

output "arn" {
  description = "Kinesis Firehose投递流ARN"
  value       = aws_kinesis_firehose_delivery_stream.purchase_logs_firehose_stream.arn
}

添加完成后重新执行terraform plan，即可正常通过module.purchase_logs_firehose_prod.arn引用该ARN属性。

内容的提问来源于stack exchange，提问作者OctaveParango