如何使用Terraform创建关联S3桶的AWS NFS文件共享

前置要求 #

• 已完成Terraform AWS Provider的基础身份认证配置，账号权限覆盖S3、Storage Gateway、IAM的读写操作
• 已获取现有正常运行的AWS Storage Gateway的ARN标识

完整配置代码 #

# 配置AWS Provider
provider "aws" {
  region = "us-east-1" # 替换为你的实际业务区域
}

# 1. 新建S3存储桶
resource "aws_s3_bucket" "gw_s3_bucket" {
  bucket = "my-storage-gw-nfs-bucket-xxxx" # 替换为全局唯一的S3桶名
  force_destroy = false # 生产环境建议设为false防止桶被误删
}

# 创建Storage Gateway访问S3所需的IAM角色
resource "aws_iam_role" "s3_gw_access_role" {
  name = "storage-gateway-s3-access-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "storagegateway.amazonaws.com"
        }
      }
    ]
  })
}

# 绑定S3访问权限策略到角色
resource "aws_iam_role_policy" "s3_gw_access_policy" {
  name = "storage-gateway-s3-access-policy"
  role = aws_iam_role.s3_gw_access_role.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "s3:GetObject",
          "s3:PutObject",
          "s3:DeleteObject",
          "s3:ListBucket"
        ]
        Effect   = "Allow"
        Resource = [
          aws_s3_bucket.gw_s3_bucket.arn,
          "${aws_s3_bucket.gw_s3_bucket.arn}/*"
        ]
      }
    ]
  })
}

# 2. 在已有Storage Gateway上创建关联S3桶的NFS文件共享
resource "aws_storagegateway_nfs_file_share" "s3_nfs_share" {
  gateway_arn = "arn:aws:storagegateway:us-east-1:123456789012:gateway/sgw-XXXXXX" # 替换为你自己的现有Storage Gateway ARN
  location_arn = aws_s3_bucket.gw_s3_bucket.arn
  role_arn     = aws_iam_role.s3_gw_access_role.arn

  # NFS客户端访问配置，示例允许192.168.1.0/24网段读写
  client_list {
    client     = "192.168.1.0/24"
    permission = "READ_WRITE"
    squash     = "RootSquash"
  }

  object_acl = "private"
  read_only  = false
}

部署执行步骤 #

• 执行terraform init初始化工作目录，自动下载依赖的AWS Provider
• 执行terraform plan校验配置语法，预览待创建的资源清单，确认无异常
• 执行terraform apply输入yes确认后，等待资源创建完成即可

注意事项：

• 配置中的桶名、网关ARN、区域、允许访问的NFS客户端网段请根据实际业务场景修改
• 生产环境可根据需求为S3桶添加服务端加密、版本控制、生命周期规则等配置
• 需确保Storage Gateway与NFS客户端之间的网络连通，安全组已放行NFS协议所需的111、2049端口及挂载动态端口

内容的提问来源于stack exchange，提问作者Tony Wong