Terraform部署关联KMS密钥的CloudWatch日志组报错求助

部署关联KMS密钥的AWS CloudWatch日志组时出现以下错误：

Error: creating CloudWatch Logs Log Group (blah-blah-blah-cloudwatch-log-group): InvalidParameterException: The specified KMS Key Id could not be found.

模块代码 #

resource "aws_cloudwatch_log_group" "main" {
  count = var.create ? 1 : 0

  name              = module.cloudwatch_name_generator.id
  name_prefix       = var.name_prefix
  retention_in_days = var.retention_in_days
  kms_key_id        = var.kms_key_id

  tags = var.tags
}

模块调用代码 #

provider "aws" {
  region = "eu-west-2"
}

resource "aws_kms_key" "terratest" {
  description             = "Ths key is for testing only"
  deletion_window_in_days = 7
  enable_key_rotation     = true
}

resource "aws_kms_alias" "terratest" {
  name          = "alias/cloud-watch-terratest"
  target_key_id = aws_kms_key.terratest.key_id
}

module "cloudwatch_log_group" {
  source            = "../../modules/log-group"
  depends_on = [
    aws_kms_key.terratest
  ]
  namespace         = "blah"
  application       = "blah"
  environment       = "blah"
  retention_in_days = 7
  kms_key_id        = aws_kms_key.terratest.key_id
}

核心原因 #

1. KMS密钥权限缺失：CloudWatch Logs服务没有被授予使用该KMS密钥的权限，AWS会返回"密钥找不到"的混淆错误提示。
2. 依赖处理不严谨：depends_on仅确保Terraform资源创建顺序，无法保证AWS端KMS密钥完全就绪，且使用key_id不如arn识别可靠。

修复步骤 #

1. 给KMS密钥添加CloudWatch Logs权限 #

修改aws_kms_key资源，添加服务权限策略：

resource "aws_kms_key" "terratest" {
  description             = "This key is for testing only"
  deletion_window_in_days = 7
  enable_key_rotation     = true

  policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "logs.eu-west-2.amazonaws.com"
      },
      "Action": [
        "kms:Encrypt*",
        "kms:Decrypt*",
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*",
        "kms:Describe*"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "${data.aws_caller_identity.current.arn}"
      },
      "Action": "kms:*",
      "Resource": "*"
    }
  ]
}
POLICY
}

data "aws_caller_identity" "current" {}

2. 优化依赖传递方式 #

移除depends_on，改用KMS密钥的ARN传递给模块，Terraform会自动处理依赖，且ARN的识别更稳定：

module "cloudwatch_log_group" {
  source            = "../../modules/log-group"
  namespace         = "blah"
  application       = "blah"
  environment       = "blah"
  retention_in_days = 7
  kms_key_id        = aws_kms_key.terratest.arn
}

3. 验证区域一致性 #

确保CloudWatch日志组与KMS密钥处于同一区域（当前均为eu-west-2），跨区域KMS密钥无法被CloudWatch日志组调用。

内容的提问来源于stack exchange，提问作者Nick Barton-Wells