Terraform配置支持CMS-KMS加密的S3桶报错求助

错误原因 #

你代码里直接写的server_side_encryption_kms_key是无效引用——Terraform无法识别这个标识符，它既不是已定义的变量，也不是合法资源。要实现「指定KMS密钥则用KMS加密，否则默认用AES256」的逻辑，首先需要将这个值定义为输入变量，再通过var.前缀正确引用。

修正步骤及代码 #

1. 添加变量定义 #

在代码开头补充变量声明，允许用户传入KMS密钥ID/ARN，默认值设为null表示可选：

variable "server_side_encryption_kms_key" {
  type        = string
  description = "可选：用于S3加密的KMS密钥ID或ARN，不指定则使用AES256默认加密"
  default     = null
}

# 确保以下两个变量也已定义（原代码中用到但未声明）
variable "udl-tenant" {
  type        = string
  description = "租户标识"
}

variable "udl-core" {
  type        = string
  description = "核心服务标识"
}

2. 修正加密配置的引用逻辑 #

把加密配置里的server_side_encryption_kms_key改为var.server_side_encryption_kms_key，同时调整判断逻辑（用空值判断替代can函数，逻辑更直观）：

// server_side_encryption 
resource "aws_s3_bucket_server_side_encryption_configuration" "delivery" {
  bucket = aws_s3_bucket.delivery.id

  rule {
    apply_server_side_encryption_by_default {
      kms_master_key_id = try(var.server_side_encryption_kms_key, null)
      sse_algorithm     = var.server_side_encryption_kms_key != null ? "aws:kms" : "AES256"
    }
  }
}

3. 额外注意事项 #

• 如果用户传入KMS密钥，需确保Terraform执行账号拥有该密钥的kms:Encrypt、kms:Decrypt等权限；
• 日志目标桶${var.udl-tenant}-${var.udl-core}-s3-accesslogging需提前创建，或在当前模块中补充该桶的资源定义。

修正后的完整代码 #

# 变量定义
variable "server_side_encryption_kms_key" {
  type        = string
  description = "可选：用于S3加密的KMS密钥ID或ARN，不指定则使用AES256默认加密"
  default     = null
}

variable "udl-tenant" {
  type        = string
  description = "租户标识"
}

variable "udl-core" {
  type        = string
  description = "核心服务标识"
}

// s3 bucket
resource "aws_s3_bucket" "delivery" {
  bucket        = "${var.udl-tenant}-${var.udl-core}-delivery"
  force_destroy = true
}

// server_side_encryption 
resource "aws_s3_bucket_server_side_encryption_configuration" "delivery" {
  bucket = aws_s3_bucket.delivery.id

  rule {
    apply_server_side_encryption_by_default {
      kms_master_key_id = try(var.server_side_encryption_kms_key, null)
      sse_algorithm     = var.server_side_encryption_kms_key != null ? "aws:kms" : "AES256"
    }
  }
}

// bucket_versioning  
resource "aws_s3_bucket_versioning" "delivery" {
  bucket = aws_s3_bucket.delivery.id
  versioning_configuration {
    status = "Disabled"
  }
}

// bucket_public_access_block
resource "aws_s3_bucket_public_access_block" "delivery" {
  bucket                  = aws_s3_bucket.delivery.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

// object_ownership
resource "aws_s3_bucket_ownership_controls" "delivery" {
  bucket = aws_s3_bucket.delivery.id
  rule {
    object_ownership = "BucketOwnerPreferred"
  }
}

// S3 bucket logging 
resource "aws_s3_bucket_logging" "delivery" {
  bucket        = aws_s3_bucket.delivery.id
  target_bucket = "${var.udl-tenant}-${var.udl-core}-s3-accesslogging"
  target_prefix = aws_s3_bucket.delivery.id
}

内容的提问来源于stack exchange，提问作者Touhid Alam