如何通过Terraform启用AWS Elastic Beanstalk负载均衡器访问日志？

我正尝试通过Terraform创建AWS Elastic Beanstalk环境，需要为其自动创建的负载均衡器启用访问日志，但在Terraform官方文档中未找到实现该功能的示例代码。现有Terraform代码如下：

resource "aws_elastic_beanstalk_application" "tftest" {
  name        = "tf-test-name"
  description = "tf-test-desc"
}

resource "aws_elastic_beanstalk_environment" "tfenvtest" {
  name                = "tf-test-name"
  application         = aws_elastic_beanstalk_application.tftest.name
  solution_stack_name = "64bit Amazon Linux 2015.03 v2.0.3 running Go 1.4"
}

实现方法 #

要为Elastic Beanstalk自动创建的负载均衡器启用访问日志，需要完成两个核心步骤：创建用于存储日志的S3桶并配置权限，然后在Elastic Beanstalk环境中添加对应的配置项。

1. 创建S3存储桶及权限策略 #

首先创建一个全局唯一的S3桶，同时配置桶策略允许AWS负载均衡器服务向桶内写入日志文件：

# 创建存储ELB访问日志的S3桶
resource "aws_s3_bucket" "elb_logs" {
  name = "your-unique-elb-log-bucket" # 替换为全局唯一的桶名
}

# 配置桶策略，允许ELB服务写入日志
resource "aws_s3_bucket_policy" "elb_logs_policy" {
  bucket = aws_s3_bucket.elb_logs.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          Service = "elasticloadbalancing.amazonaws.com"
        }
        Action = "s3:PutObject"
        Resource = "${aws_s3_bucket.elb_logs.arn}/*"
        Condition = {
          StringEquals = {
            "s3:x-amz-acl" = "bucket-owner-full-control"
          }
        }
      }
    ]
  })
}

2. 配置Elastic Beanstalk环境启用日志 #

在你的aws_elastic_beanstalk_environment资源中添加setting块，指定负载均衡器访问日志的存储桶、启用状态及可选的日志前缀：

resource "aws_elastic_beanstalk_application" "tftest" {
  name        = "tf-test-name"
  description = "tf-test-desc"
}

resource "aws_elastic_beanstalk_environment" "tfenvtest" {
  name                = "tf-test-name"
  application         = aws_elastic_beanstalk_application.tftest.name
  solution_stack_name = "64bit Amazon Linux 2015.03 v2.0.3 running Go 1.4"

  # 启用CLB访问日志并指定存储桶
  setting {
    namespace = "aws:elb:loadbalancer"
    name      = "AccessLogsS3Bucket"
    value     = aws_s3_bucket.elb_logs.name
  }

  setting {
    namespace = "aws:elb:loadbalancer"
    name      = "AccessLogsS3Enabled"
    value     = "true"
  }

  # 可选：设置日志文件前缀，方便分类管理
  setting {
    namespace = "aws:elb:loadbalancer"
    name      = "AccessLogsS3Prefix"
    value     = "elb-logs/tf-test-env"
  }
}

注意事项 #

• 你的解决方案栈使用的是经典负载均衡（CLB），因此配置命名空间为aws:elb:loadbalancer；如果是应用负载均衡（ALB），需要改用aws:elbv2:loadbalancer命名空间。
• S3桶名必须全局唯一，不能与AWS区域内任何其他用户的桶名重复。
• 桶策略中的条件确保日志文件的ACL为桶所有者完全控制，避免出现无法访问日志的情况。

内容的提问来源于stack exchange，提问作者huju vert