Terraform如何通过模块变量为AWS资源设置provider值

核心原因 #

Terraform 不支持将 provider 作为字符串变量传递给资源的provider参数，provider 引用必须在规划阶段静态解析，需要通过模块内置的providers元参数传递 provider 对象，修改步骤如下：

步骤1：调整modules/codebuild子模块配置 #

删除input_aws_provider变量，添加 provider 声明，修改后的/modules/codebuild/codebuild.tf代码：

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 3.0"
    }
  }
}

variable "input_aws_env" {}

resource "aws_codebuild_project" "codebuild-iac" {
  name          = "${var.input_aws_env}-CodeBuild-IaC"
  # 其余原有配置保持不变，不需要手动指定provider参数
  # etc...
}

步骤2：调整MGMT模块的provider声明 #

在/MGMT目录下新增 provider 配置（可以直接加在cicd.tf顶部，也可以单独建versions.tf），声明需要接收的带别名provider：

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 3.0"
      configuration_aliases = [ aws.dev_us-east-1, aws.dev_us-west-2 ]
    }
  }
}

步骤3：修改根目录main.tf的MGMT模块调用，传入带别名的provider #

module "MGMT" { 
  source                         = "./MGMT"
  count                           = var.aws_env == "MGMT" ? 1 : 0
  aws_env                      = var.aws_env

  # 新增providers配置，向下传递带别名的provider对象
  providers = {
    aws.dev_us-east-1 = aws.dev_us-east-1
    aws.dev_us-west-2 = aws.dev_us-west-2
  }
}

步骤4：修改/MGMT/cicd.tf的codebuild模块调用，通过providers参数指定对应provider #

# create the codebuild resource in the assumed role's us-east-1 region
module "dev_cicd_iac_us_east_1" {
  source = "../modules/codebuild/"
  input_aws_env = var.dev_aws_env
  # 替换原有input_aws_provider变量，用providers元参数传provider
  providers = {
    aws = aws.dev_us-east-1
  }
}


# create the codebuild resource in the assumed role's us-west-2 region
module "dev_cicd_iac_us_west_2" {
  source = "../modules/codebuild/"
  input_aws_env = var.dev_aws_env
  providers = {
    aws = aws.dev_us-west-2
  }
}

修改完成后执行terraform init重新初始化模块，再执行terraform plan即可正常解析 provider。

内容的提问来源于stack exchange，提问作者Matthew