Terraform资源映射：如何关联KMS密钥到对应S3桶与KMS别名

解决方案 #

1. KMS别名资源的target_key_id赋值 #

因为aws_kms_alias和aws_kms_key都是用同一个local.keys作为for_each遍历源，同一个each.key对应同一个密钥的配置，直接关联对应KMS密钥的ID即可：

target_key_id = aws_kms_key.key[each.key].key_id

2. S3桶KMS密钥映射实现 #

首先需要调整local.buckets的kms_key字段取值：将原本的false替换为对应要绑定的local.keys中的键名，不需要自定义KMS密钥的桶可以设为null（会自动使用AWS托管的S3默认KMS密钥），示例调整如下：

locals {
  buckets = {
    "1" = { 
      name    = "bucket-1", 
      kms_key = "1" // 绑定local.keys中key为"1"的KMS密钥
    },
    "2" = { 
      name    = "bucket-2", 
      kms_key = "il5" // 绑定local.keys中key为"il5"的KMS密钥
    },
    "3" = { 
      name    = "bucket-3", 
      kms_key = "ebs" // 绑定local.keys中key为"ebs"的KMS密钥
    },
    "4" = { 
      name    = "bucket-4", 
      kms_key = null // 使用AWS默认托管S3密钥
    },
    "5" = { 
      name    = "bucket-5", 
      kms_key = "1"
    },
    "6" = { 
      name    = "bucket-6", 
      kms_key = "il5"
    }
  }
  // 原有keys配置保持不变
  keys = {
    "1"     = {
      description = "1"
      alias       = "alias/1-key"
    },
    "il5"      = {
      description = "2"
      alias       = "alias/2-key"
    },
    "ebs"      = {
      description = "3"
      alias       = "alias/3-key"
    }
  }
}

接着修改S3桶资源的kms_master_key_id字段，用HCL三目运算符做条件判断即可：

kms_master_key_id = each.value.kms_key != null ? aws_kms_key.key[each.value.kms_key].key_id : "alias/aws/s3"

完整修改后的代码示例 #

locals {
  buckets = {
    "1" = { 
      name    = "bucket-1", 
      kms_key = "1"
    },
    "2" = { 
      name    = "bucket-2", 
      kms_key = "il5"
    },
    "3"     = { 
      name    = "bucket-3", 
      kms_key = "ebs"
    },
    "4"     = { 
      name    = "bucket-4", 
      kms_key = null
    },
    "5"        = { 
      name    = "bucket-5", 
      kms_key = "1"
    },
    "6"          = { 
      name    = "bucket-6", 
      kms_key = "il5"
    }
  }
  keys = {
    "1"     = {
      description = "1"
      alias       = "alias/1-key"
    },
    "il5"      = {
      description = "2"
      alias       = "alias/2-key"
    },
    "ebs"      = {
      description = "3"
      alias       = "alias/3-key"
    }
  }
}

resource "aws_kms_key" "key" {
  for_each = local.keys

  description             = each.value.description
  enable_key_rotation     = true
  deletion_window_in_days = 30
}

resource "aws_kms_alias" "this" {
  for_each = local.keys

  name          = each.value.alias
  target_key_id = aws_kms_key.key[each.key].key_id
}

resource "aws_s3_bucket" "bucket" {
  for_each = local.buckets

  bucket = each.value.name
  acl    = "private"

  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        sse_algorithm     = "aws:kms"
        kms_master_key_id = each.value.kms_key != null ? aws_kms_key.key[each.value.kms_key].key_id : "alias/aws/s3"
      }
    }
  }
}

如果需要完全关闭未指定KMS密钥的桶的加密，直接调整三目运算符后的返回值和sse_algorithm字段的逻辑即可。

内容的提问来源于stack exchange，提问作者MasterShake