如何在Terraform中创建相互依赖的S3 Bucket与Lambda资源？

问题背景 #

用Terraform创建Lambda函数和存储其代码的S3 Bucket时，遇到循环依赖：

• S3 Bucket的IAM权限策略需要Lambda的ARN作为授权主体
• Lambda创建时必须指定已存在的S3 Bucket来读取代码包
  当前创建Lambda时报错，提示目标Bucket不存在。

现有模块代码 #

S3 Bucket模块

# S3 Bucket module
resource "aws_s3_bucket" "s3-lambda" {
  bucket = var.bucket_name
  acl = "private"
  policy = data.aws_iam_policy_document.s3_lambda_permissions.json

  tags = {
    Name        = var.tag_name
    Environment = var.env_name
  }
}

Lambda模块

# Lambda module
resource "aws_lambda_function" "redirect_lambda" {
  s3_bucket     = var.bucket_name
  s3_key        = var.key
  handler       = var.handler
  runtime       = var.runtime
  role          = aws_iam_role.redirect_lambda.arn
  function_name = "redirect_lambda-${var.env_name}"
  publish       = true
}

main.tf模块调用

module "qr_redirect_lambda" {
  source = "./modules/qr-redirect"

  env_name    = var.env_name
  bucket_name = var.qr_redirect_lambda_bucket_name
  key         = var.lambda_key
  runtime     = var.lambda_runtime_16
  handler     = var.lambda_handler
  tag_name = "tag name"
}

报错信息 #

Error: error creating Lambda Function (1): InvalidParameterValueException: Error occurred while GetObject. S3 Error Code: NoSuchBucket. S3 Error Message: The specified bucket does not exist
│ {
│ RespMetadata: {
│ StatusCode: 400,
│ RequestID: "xxx-xxx"
│ },
│ Message_: "Error occurred while GetObject. S3 Error Code: NoSuchBucket. S3 Error Message: The specified bucket does not exist",
│ Type: "User"
│ }
│
│ with module.qr_redirect_lambda.aws_lambda_function.qr_redirect_lambda,
│ on modules/qr-lambda/main.tf line 1, in resource "aws_lambda_function" "qr_redirect_lambda":
│ 1: resource "aws_lambda_function" "qr_redirect_lambda" {

解决方案 #

核心思路是拆分资源创建顺序：先建基础S3 Bucket（不带依赖Lambda的策略），再创建Lambda，最后给Bucket添加上包含Lambda ARN的权限策略。

1. 修改S3 Bucket模块，拆分策略资源 #

把内嵌在Bucket中的策略拆成独立的aws_s3_bucket_policy资源，延迟策略创建时机，直到Lambda生成ARN后再关联：

# S3 Bucket module
resource "aws_s3_bucket" "s3-lambda" {
  bucket = var.bucket_name
  acl = "private"

  tags = {
    Name        = var.tag_name
    Environment = var.env_name
  }
}

# 单独定义Bucket策略，依赖传入的Lambda ARN
resource "aws_s3_bucket_policy" "s3_lambda_permissions" {
  bucket = aws_s3_bucket.s3-lambda.id
  policy = data.aws_iam_policy_document.s3_lambda_permissions.json

  # 显式依赖Lambda ARN，确保Lambda先创建完成
  depends_on = [var.lambda_arn]
}

# IAM策略文档，使用传入的Lambda ARN作为授权主体
data "aws_iam_policy_document" "s3_lambda_permissions" {
  statement {
    actions = ["s3:GetObject"]
    resources = ["${aws_s3_bucket.s3-lambda.arn}/*"]
    principals {
      type        = "AWS"
      identifiers = [var.lambda_arn]
    }
  }
}

2. 调整Lambda模块，输出ARN #

在Lambda模块中添加输出，把生成的ARN暴露给其他模块使用：

# Lambda module
resource "aws_lambda_function" "redirect_lambda" {
  s3_bucket     = var.bucket_name
  s3_key        = var.key
  handler       = var.handler
  runtime       = var.runtime
  role          = aws_iam_role.redirect_lambda.arn
  function_name = "redirect_lambda-${var.env_name}"
  publish       = true
}

# 输出Lambda ARN供其他模块调用
output "lambda_arn" {
  value = aws_lambda_function.redirect_lambda.arn
}

3. 调整main.tf的模块调用顺序 #

按"Bucket → Lambda → Bucket策略"的顺序调用模块，传递必要的依赖值：

# 1. 先创建基础S3 Bucket（无Lambda依赖的策略）
module "qr_redirect_bucket" {
  source = "./modules/s3-lambda"

  bucket_name = var.qr_redirect_lambda_bucket_name
  tag_name    = "tag name"
  env_name    = var.env_name
}

# 2. 创建Lambda，引用已创建的Bucket
module "qr_redirect_lambda" {
  source = "./modules/qr-redirect"

  env_name    = var.env_name
  bucket_name = module.qr_redirect_bucket.s3-lambda.bucket # 直接引用Bucket资源的名称
  key         = var.lambda_key
  runtime     = var.lambda_runtime_16
  handler     = var.lambda_handler
}

# 3. 更新S3 Bucket策略，传入Lambda生成的ARN
module "qr_redirect_bucket_policy" {
  source = "./modules/s3-lambda" # 复用原S3模块，传入Lambda ARN变量
  bucket_name = module.qr_redirect_bucket.s3-lambda.bucket
  tag_name    = "tag name"
  env_name    = var.env_name
  lambda_arn  = module.qr_redirect_lambda.lambda_arn
}

关键逻辑 #

• 通过depends_on显式控制资源创建顺序，确保Lambda先完成创建并生成ARN
• 拆分内嵌的Bucket策略为独立资源，打破循环依赖链，让Bucket和Lambda的创建流程解耦

内容的提问来源于stack exchange，提问作者Stretch0