Terraform中API Gateway日志策略文档超出CloudWatch长度限制的解决办法

1. 修复日志格式的语法错误 #

你的日志格式字符串存在语法错误：responseLength:\"$context.responseLength\"中键名未闭合双引号，会导致格式解析异常，甚至间接影响策略长度。修正后的格式（同时移除冗余空格压缩长度）：

format = "{\"requestId\":\"$context.requestId\",\"ip\":\"$context.identity.sourceIp\",\"requestTime\":\"$context.requestTime\",\"httpMethod\":\"$context.httpMethod\",\"routeKey\":\"$context.routeKey\",\"status\":\"$context.status\",\"protocol\":\"$context.protocol\",\"responseLength\":\"$context.responseLength\"}"

2. 简化日志格式（可选） #

若修正语法后仍触发长度限制，可移除非必要字段进一步压缩格式字符串长度，比如删除protocol或routeKey：

format = "{\"requestId\":\"$context.requestId\",\"ip\":\"$context.identity.sourceIp\",\"requestTime\":\"$context.requestTime\",\"httpMethod\":\"$context.httpMethod\",\"status\":\"$context.status\",\"responseLength\":\"$context.responseLength\"}"

3. 手动创建IAM角色与策略（彻底解决长度问题） #

默认情况下Terraform会自动生成API Gateway写入CloudWatch的IAM策略，若该策略长度超标，可手动创建精简的角色和策略：

步骤1：创建IAM角色（信任API Gateway服务） #

resource "aws_iam_role" "api_gateway_logging" {
  name = "api-gateway-logging-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "apigateway.amazonaws.com"
        }
      }
    ]
  })
}

步骤2：创建精简的IAM策略 #

resource "aws_iam_policy" "api_gateway_logging" {
  name        = "api-gateway-logging-policy"
  description = "Allow API Gateway to write logs to specified CloudWatch Log Group"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect   = "Allow"
        Action   = ["logs:CreateLogStream", "logs:PutLogEvents"]
        Resource = aws_cloudwatch_log_group.api_gateway.arn
      }
    ]
  })
}

步骤3：绑定策略到角色 #

resource "aws_iam_role_policy_attachment" "api_gateway_logging" {
  role       = aws_iam_role.api_gateway_logging.name
  policy_arn = aws_iam_policy.api_gateway_logging.arn
}

步骤4：在Stage配置中指定自定义角色 #

修改aws_apigatewayv2_stage资源，添加role_arn字段：

resource "aws_apigatewayv2_stage" "main" {
  api_id      = aws_apigatewayv2_api.main.id
  name        = contains(["dev", "qa", "prod"], var.environment) ? "$default" : "${var.environment}"
  auto_deploy = true
  access_log_settings {
    destination_arn = aws_cloudwatch_log_group.api_gateway.arn
    format          = "{\"requestId\":\"$context.requestId\",\"ip\":\"$context.identity.sourceIp\",\"requestTime\":\"$context.requestTime\",\"httpMethod\":\"$context.httpMethod\",\"routeKey\":\"$context.routeKey\",\"status\":\"$context.status\",\"protocol\":\"$context.protocol\",\"responseLength\":\"$context.responseLength\"}"
    role_arn        = aws_iam_role.api_gateway_logging.arn
  }
}

手动指定角色后，Terraform不会自动生成冗长的默认策略，而是使用你定义的精简策略，彻底规避长度限制问题。

额外修正：日志组ARN引用语法 #

原配置中destination_arn = resource.aws_cloudwatch_log_group.api_gateway.arn的写法错误，应改为aws_cloudwatch_log_group.api_gateway.arn（移除resource前缀）。

内容的提问来源于stack exchange，提问作者Abhishek Jha