如何在单个data.tf中跨多区域获取AWS KMS密钥？

1. 确认多区域Provider配置 #

确保providers.tf中已配置双区域AWS Provider并设置别名：

provider "aws" {
  region = "us-east-1"
  alias  = "us_east_1"
}

provider "aws" {
  region = "us-west-2"
  alias  = "us_west_2"
}

2. 在data.tf中跨区域拉取KMS密钥 #

在同一data.tf文件内，给不同区域的KMS密钥数据资源绑定对应Provider别名，即可自动获取目标区域的密钥ARN：

# 获取us-east-1区域的KMS密钥ARN
data "aws_kms_key" "primary_region" {
  provider = aws.us_east_1
  key_id   = "alias/your-kms-key-alias" # 替换为你的密钥别名或ID
}

# 获取us-west-2区域的KMS密钥ARN
data "aws_kms_key" "secondary_region" {
  provider = aws.us_west_2
  key_id   = "alias/your-kms-key-alias" # 需确保该别名在us-west-2区域存在对应密钥
}

3. 在RDS集群中引用密钥ARN #

后续全局Aurora RDS集群资源可直接调用这两个数据资源的ARN：

resource "aws_rds_global_cluster" "aurora_global" {
  global_cluster_identifier = "aurora-global-cluster"
  engine                    = "aurora-mysql"
  engine_version            = "8.0.mysql_aurora.3.03.2"
  storage_encrypted         = true
  kms_key_id                = data.aws_kms_key.primary_region.arn
}

resource "aws_db_instance" "primary" {
  provider                  = aws.us_east_1
  global_cluster_identifier = aws_rds_global_cluster.aurora_global.id
  db_instance_identifier    = "aurora-primary"
  engine                    = aws_rds_global_cluster.aurora_global.engine
  engine_version            = aws_rds_global_cluster.aurora_global.engine_version
  instance_class            = "db.r5.large"
  storage_encrypted         = true
  kms_key_id                = data.aws_kms_key.primary_region.arn
}

resource "aws_db_instance" "secondary" {
  provider                  = aws.us_west_2
  global_cluster_identifier = aws_rds_global_cluster.aurora_global.id
  db_instance_identifier    = "aurora-secondary"
  engine                    = aws_rds_global_cluster.aurora_global.engine
  engine_version            = aws_rds_global_cluster.aurora_global.engine_version
  instance_class            = "db.r5.large"
  storage_encrypted         = true
  kms_key_id                = data.aws_kms_key.secondary_region.arn
}

关键注意点 #

• 需保证us-west-2区域存在对应KMS密钥，且key_id（别名或ID）在该区域有效
• 若使用同一密钥别名，需在两个区域分别创建同名密钥，或使用AWS多区域KMS密钥（需对应权限支持）
• Provider别名可自定义，只要与data资源的provider字段对应即可

内容的提问来源于stack exchange，提问作者Somethingwhatever