Terraform模块导入AWS S3桶后执行plan仍显示创建资源求助

问题描述 #

已成功通过Terraform模块导入现有AWS S3桶，但执行terraform plan时，Terraform仍显示将创建该桶的7个关联资源（包括aws_s3_bucket_acl、aws_s3_bucket_logging等）。相关配置与操作如下：

模块配置 #

module "log_s3" {
  source               = "../modules/s3/"
  env_name             = var.env_name
  bucket_name          = "${var.product_name}-logs-${var.env_name}"
  enable_versioning    = false
  enable_cors          = false
  logging_bucket       = module.log_s3.log_bucket_id
  enable_bucket_policy = true
  enable_static_site   = false
}

资源定义（模块内） #

resource "aws_s3_bucket" "my_protected_bucket" {
  bucket = var.bucket_name
  tags = {
    environment              = var.env_name
  }
}

resource "aws_s3_bucket_acl" "my_protected_bucket_acl" {
  bucket = aws_s3_bucket.my_protected_bucket.id
  acl    = var.enable_static_site == true ? "public-read" : "private"
}

resource "aws_s3_bucket_public_access_block" "my_protected_bucket_access" {
  bucket = aws_s3_bucket.my_protected_bucket.id

  # Block public access
  block_public_acls       = var.enable_static_site == true ? false : true
  block_public_policy     = var.enable_static_site == true ? false : true
  ignore_public_acls      = var.enable_static_site == true ? false : true
  restrict_public_buckets = var.enable_static_site == true ? false : true
}

resource "aws_s3_bucket_versioning" "my_protected_bucket_versioning" {
  count  = var.enable_versioning ? 1 : 0
  bucket = aws_s3_bucket.my_protected_bucket.id
  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_cors_configuration" "my_protected_bucket_cors" {
  count  = var.enable_cors ? 1 : 0
  bucket = aws_s3_bucket.my_protected_bucket.id

  cors_rule {
    allowed_headers = ["*"]
    allowed_methods = ["PUT", "POST", "DELETE", "GET", "HEAD"]
    allowed_origins = ["*"]
    expose_headers  = [""]
  }
  lifecycle {
    ignore_changes = [
      cors_rule
    ]
  }

}

resource "aws_s3_bucket_ownership_controls" "my_protected_bucket_ownership" {
  bucket = aws_s3_bucket.my_protected_bucket.id

  rule {
    object_ownership = "ObjectWriter"
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "my_protected_bucket_sse_config" {
  bucket = aws_s3_bucket.my_protected_bucket.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}


resource "aws_s3_bucket_policy" "my_protected_bucket_policy" {
  count  = var.enable_bucket_policy ? 1 : 0
  bucket = aws_s3_bucket.my_protected_bucket.id
  policy = <<EOF
{
    "Version": "2012-10-17",
    "Id": "S3-Console-Auto-Gen-Policy-1659086042176",
    "Statement": [
        {
            "Sid": "S3PolicyStmt-DO-NOT-MODIFY-1659086041783",
            "Effect": "Allow",
            "Principal": {
                "Service": "logging.s3.amazonaws.com"
            },
            "Action": "s3:PutObject",
            "Resource": "${aws_s3_bucket.my_protected_bucket.arn}/*"
        }
    ]
}
EOF
}

resource "aws_s3_object" "my_protected_bucket_object" {
  bucket = var.logging_bucket
  key    = "s3_log/${aws_s3_bucket.my_protected_bucket.id}/"
}

resource "aws_s3_bucket_logging" "my_protected_bucket_logging" {
  bucket = aws_s3_bucket.my_protected_bucket.id
  target_bucket = var.logging_bucket
  target_prefix = "s3_log/${aws_s3_bucket.my_protected_bucket.id}/"
  depends_on    = [aws_s3_bucket.my_protected_bucket, aws_s3_object.my_protected_bucket_object]
}

resource "aws_s3_bucket_website_configuration" "my_protected_bucket_static" {
  bucket = aws_s3_bucket.my_protected_bucket.id
  count  = var.enable_static_site ? 1 : 0

  index_document {
    suffix = "index.html"
  }

  error_document {
    key = "error.html"
  }
}

输出配置（模块内） #

output "log_bucket_id" {
  value = aws_s3_bucket.my_protected_bucket.id
}

导入命令与结果 #

执行导入命令：

terraform import module.log_s3.aws_s3_bucket.my_protected_bucket abcd-logs-dev

导入输出：

module.log_s3.aws_s3_bucket.my_protected_bucket: Import prepared!
  Prepared aws_s3_bucket for import
module.log_s3.aws_s3_bucket.my_protected_bucket: Refreshing state... [id=abcd-logs-deveu]

Import successful!

The resources that were imported are shown above. These resources are now in
your Terraform state and will henceforth be managed by Terraform.

Terraform Plan结果 #

执行terraform plan后，显示将创建7个关联资源，具体内容如下：

module.log_s3.aws_s3_bucket.my_protected_bucket: Refreshing state... [id=abcd-logs-dev]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # module.log_s3.aws_s3_bucket_acl.my_protected_bucket_acl will be created
  + resource "aws_s3_bucket_acl" "my_protected_bucket_acl" {
      + acl    = "private"
      + bucket = "abcd-logs-dev"
      + id     = (known after apply)

      + access_control_policy {
          + grant {
              + permission = (known after apply)

              + grantee {
                  + display_name  = (known after apply)
                  + email_address = (known after apply)
                  + id            = (known after apply)
                  + type          = (known after apply)
                  + uri           = (known after apply)
                }
            }

          + owner {
              + display_name = (known after apply)
              + id           = (known after apply)
            }
        }
    }

  # module.log_s3.aws_s3_bucket_logging.my_protected_bucket_logging will be created
  + resource "aws_s3_bucket_logging" "my_protected_bucket_logging" {
      + bucket        = "abcd-logs-dev"
      + id            = (known after apply)
      + target_bucket = "abcd-logs-dev"
      + target_prefix = "s3_log/abcd-logs-dev/"
    }

  # module.log_s3.aws_s3_bucket_ownership_controls.my_protected_bucket_ownership will be created
  + resource "aws_s3_bucket_ownership_controls" "my_protected_bucket_ownership" {
      + bucket = "abcd-logs-dev"
      + id     = (known after apply)

      + rule {
          + object_ownership = "ObjectWriter"
        }
    }

  # module.log_s3.aws_s3_bucket_policy.my_protected_bucket_policy[0] will be created
  + resource "aws_s3_bucket_policy" "my_protected_bucket_policy" {
      + bucket = "abcd-logs-dev"
      + id     = (known after apply)
      + policy = jsonencode(
            {
              + Id        = "S3-Console-Auto-Gen-Policy-145342356879"
              + Statement = [
                  + {
                      + Action    = "s3:PutObject"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "logging.s3.amazonaws.com"
                        }
                      + Resource  = "arn:aws:s3:::abcd-logs-dev/*"
                      + Sid       = "S3PolicyStmt-DO-NOT-MODIFY-145342356879"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
    }

  # module.log_s3.aws_s3_bucket_public_access_block.my_protected_bucket_access will be created
  + resource "aws_s3_bucket_public_access_block" "my_protected_bucket_access" {
      + block_public_acls       = true
      + block_public_policy     = true
      + bucket                  = "abcd-logs-dev"
      + id                      = (known after apply)
      + ignore_public_acls      = true
      + restrict_public_buckets = true
    }

  # module.log_s3.aws_s3_bucket_server_side_encryption_configuration.my_protected_bucket_sse_config will be created
  + resource "aws_s3_bucket_server_side_encryption_configuration" "my_protected_bucket_sse_config" {
      + bucket = "abcd-logs-dev"
      + id     = (known after apply)

      + rule {
          + apply_server_side_encryption_by_default {
              + sse_algorithm = "AES256"
            }
        }
    }

  # module.log_s3.aws_s3_object.my_protected_bucket_object will be created
  + resource "aws_s3_object" "my_protected_bucket_object" {
      + acl                    = "private"
      + bucket                 = "abcd-logs-dev"
      + bucket_key_enabled     = (known after apply)
      + content_type           = (known after apply)
      + etag                   = (known after apply)
      + force_destroy          = false
      + id                     = (known after apply)
      + key                    = "s3_log/abcd-logs-dev/"
      + kms_key_id             = (known after apply)
      + server_side_encryption = (known after apply)
      + storage_class          = (known after apply)
      + tags_all               = (known after apply)
      + version_id             = (known after apply)
    }

Plan: 7 to add, 0 to change, 0 to destroy.

原因分析 #

1. 仅导入核心桶资源：Terraform中aws_s3_bucket是独立资源，aws_s3_bucket_acl、aws_s3_bucket_logging等是关联的独立资源，必须单独导入到Terraform状态。你仅导入了aws_s3_bucket，其他关联资源未被纳入状态，因此Terraform认为这些资源不存在，计划创建。
2. 循环引用隐患：模块配置中logging_bucket = module.log_s3.log_bucket_id形成循环依赖（模块引用自身输出），会导致Terraform处理配置时出现异常，也可能影响资源状态识别。
3. 配置与实际资源可能不匹配：如果现有S3桶的实际配置（如ACL、加密设置）与Terraform代码定义不一致，导入后也可能导致计划差异，但当前核心问题是未导入关联资源。

解决方案 #

1. 逐个导入关联资源 #

针对每个计划创建的资源，执行对应的terraform import命令，将现有AWS资源纳入Terraform状态：

• 导入ACL资源：

terraform import module.log_s3.aws_s3_bucket_acl.my_protected_bucket_acl abcd-logs-dev

• 导入公共访问块资源：

terraform import module.log_s3.aws_s3_bucket_public_access_block.my_protected_bucket_access abcd-logs-dev

• 导入所有权控制资源：

terraform import module.log_s3.aws_s3_bucket_ownership_controls.my_protected_bucket_ownership abcd-logs-dev

• 导入服务器端加密配置：

terraform import module.log_s3.aws_s3_bucket_server_side_encryption_configuration.my_protected_bucket_sse_config abcd-logs-dev

• 导入桶策略资源（注意count索引[0]）：

terraform import module.log_s3.aws_s3_bucket_policy.my_protected_bucket_policy[0] abcd-logs-dev

• 导入日志配置资源：

terraform import module.log_s3.aws_s3_bucket_logging.my_protected_bucket_logging abcd-logs-dev

• 导入S3对象资源：

terraform import module.log_s3.aws_s3_object.my_protected_bucket_object abcd-logs-dev/s3_log/abcd-logs-dev/

2. 修复循环引用问题 #

模块配置中的循环依赖需修改为直接引用桶名称：

module "log_s3" {
  source               = "../modules/s3/"
  env_name             = var.env_name
  bucket_name          = "${var.product_name}-logs-${var.env_name}"
  enable_versioning    = false
  enable_cors          = false
  logging_bucket       = "${var.product_name}-logs-${var.env_name}" # 替换为直接引用桶名
  enable_bucket_policy = true
  enable_static_site   = false
}

3. 验证导入结果 #

完成所有资源导入后，执行terraform plan，确认不再显示创建关联资源的计划。如果仍有差异，需对比现有AWS资源的实际配置与Terraform代码，调整代码或修正资源配置。

内容的提问来源于stack exchange，提问作者Muneeshpandi