如何让Terraform等待EFS挂载目标就绪后再创建Lambda函数？

不用time_sleep的话，有几种更优雅的方式实现状态依赖等待：

方法1：使用Time Provider的time_wait_for_resource（推荐） #

Terraform的Time Provider提供了time_wait_for_resource资源，可轮询指定资源的属性直到满足条件，相比固定等待时间更灵活且可靠。

示例配置：

# 创建EFS挂载目标
resource "aws_efs_mount_target" "example" {
  file_system_id  = aws_efs_file_system.example.id
  subnet_id       = aws_subnet.example.id
  security_groups = [aws_security_group.example.id]
}

# 等待挂载目标进入available状态
resource "time_wait_for_resource" "wait_efs_mount_target" {
  resource_type = "aws_efs_mount_target"
  resource_name = aws_efs_mount_target.example.name

  condition {
    attribute  = "status"
    value      = "available"
    comparison = "equals"
  }

  # 设置超时时间，避免无限等待
  timeout       = "10m"
  # 轮询间隔
  poll_interval = "30s"
}

# Lambda函数依赖等待资源，确保挂载目标就绪后再创建
resource "aws_lambda_function" "example" {
  # ... 其他Lambda配置（如runtime、handler、code等） ...
  file_system_config {
    arn                = aws_efs_access_point.example.arn
    local_mount_path   = "/mnt/efs"
  }

  depends_on = [time_wait_for_resource.wait_efs_mount_target]
}

方法2：用数据源轮询+null_resource #

如果无法使用Time Provider，可结合aws_efs_mount_target数据源和null_resource的local-exec手动检查状态：

resource "aws_efs_mount_target" "example" {
  file_system_id  = aws_efs_file_system.example.id
  subnet_id       = aws_subnet.example.id
  security_groups = [aws_security_group.example.id]
}

# 数据源实时获取挂载目标状态
data "aws_efs_mount_target" "example" {
  mount_target_id = aws_efs_mount_target.example.id
}

# 执行脚本轮询状态，直到挂载目标就绪
resource "null_resource" "wait_efs_mount_target" {
  triggers = {
    mount_target_status = data.aws_efs_mount_target.example.status
  }

  provisioner "local-exec" {
    command = <<EOF
      until aws efs describe-mount-targets --mount-target-id ${aws_efs_mount_target.example.id} --query 'MountTargets[0].LifeCycleState' --output text | grep -q "available"; do
        echo "Waiting for EFS mount target to become available..."
        sleep 10
      done
    EOF
    interpreter = ["/bin/bash", "-c"]
  }

  lifecycle {
    replace_triggered_by = [data.aws_efs_mount_target.example.status]
  }
}

# Lambda依赖null_resource，确保状态检查完成后再创建
resource "aws_lambda_function" "example" {
  # ... 其他Lambda配置 ...
  file_system_config {
    arn                = aws_efs_access_point.example.arn
    local_mount_path   = "/mnt/efs"
  }

  depends_on = [null_resource.wait_efs_mount_target]
}

方法3：利用状态条件控制Lambda创建时机 #

通过count或for_each结合挂载目标状态，仅当状态为available时才创建Lambda（需Terraform 0.13+支持）：

resource "aws_efs_mount_target" "example" {
  file_system_id  = aws_efs_file_system.example.id
  subnet_id       = aws_subnet.example.id
  security_groups = [aws_security_group.example.id]
}

# 仅当挂载目标就绪时创建Lambda
resource "aws_lambda_function" "example" {
  count = aws_efs_mount_target.example.status == "available" ? 1 : 0

  # ... 其他Lambda配置 ...
  file_system_config {
    arn                = aws_efs_access_point.example.arn
    local_mount_path   = "/mnt/efs"
  }
}

这种方式的局限性在于，如果第一次执行时挂载目标未就绪，Terraform会跳过Lambda创建，需要再次执行terraform apply直到状态满足，因此前两种方法更适合生产环境。

内容的提问来源于stack exchange，提问作者raphael.oester