能否在AWS DLM单计划的retain_rule中混用count与interval参数？

核心结论 #

不能在单个aws_dlm_lifecycle_policy的retain_rule中同时配置count和interval（含interval_unit）参数。

原因说明 #

• 虽然Terraform的AWS Provider文档未将这两个参数标记为互斥，但AWS DLM服务本身不支持这种组合配置——这就是你无法在AWS控制台创建此类策略的根本原因。
• DLM的保留规则逻辑为二选一：要么保留指定数量的最新快照，要么保留未超过指定时长的快照，两个条件无法同时生效。如果强行通过Terraform同时配置，AWS会忽略其中一个条件，或直接拒绝策略的创建/更新请求。

替代方案 #

若需同时满足「保留N个最新快照」和「删除超过指定时长的快照」，可在同一个DLM策略中创建两个独立的计划：

1. 第一个计划负责按数量保留最新快照
2. 第二个计划负责删除超过指定时长的快照

修改后的Terraform代码示例 #

data "aws_iam_policy_document" "dlm_assume_role" {
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["dlm.amazonaws.com"]
    }

    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_role" "dlm_lifecycle_role" {
  name               = "dlm-lifecycle-role"
  assume_role_policy = data.aws_iam_policy_document.dlm_assume_role.json
}

data "aws_iam_policy_document" "dlm_lifecycle" {
  statement {
    effect = "Allow"

    actions = [
      "ec2:CreateSnapshot",
      "ec2:CreateSnapshots",
      "ec2:DeleteSnapshot",
      "ec2:DescribeInstances",
      "ec2:DescribeVolumes",
      "ec2:DescribeSnapshots",
    ]

    resources = ["*"]
  }

  statement {
    effect    = "Allow"
    actions   = ["ec2:CreateTags"]
    resources = ["arn:aws:ec2:*::snapshot/*"]
  }
}

resource "aws_iam_role_policy" "dlm_lifecycle" {
  name   = "dlm-lifecycle-policy"
  role   = aws_iam_role.dlm_lifecycle_role.id
  policy = data.aws_iam_policy_document.dlm_lifecycle.json
}

resource "aws_dlm_lifecycle_policy" "ebs_snapshot" {
  description        = "EC2 EBS DLM lifecycle policy"
  execution_role_arn = aws_iam_role.dlm_lifecycle_role.arn
  state              = "ENABLED"

  policy_details {
    resource_types = ["VOLUME"]

    # 计划1：保留指定数量的最新快照
    schedule {
      name = "${var.name_prefix} 保留最新N个快照"

      create_rule {
        interval      = var.ebs_snapshot_interval
        interval_unit = "HOURS"
      }

      retain_rule {
        count = var.ebs_snapshot_retain_count # 示例：保留最新5个快照
      }

      copy_tags = true
    }

    # 计划2：删除超过指定时长的快照
    schedule {
      name = "${var.name_prefix} 删除超期快照"

      create_rule {
        interval      = var.ebs_snapshot_interval
        interval_unit = "HOURS"
      }

      retain_rule {
        interval      = var.ebs_snapshot_max_retain_period
        interval_unit = "DAYS" # 示例：删除超过30天的快照
      }

      copy_tags = true
    }

    target_tags = {
      Name = "${var.name_prefix}"
    }
  }
}

注意事项 #

• 两个计划使用相同的create_rule配置，确保快照创建频率一致
• DLM会分别执行两个计划的保留逻辑，最终实现既保留最新N个、又清理超期快照的效果

内容的提问来源于stack exchange，提问作者s3-m-bocian