Terraform旧版AWS Provider创建CodeBuild环境类型冲突问题咨询

问题描述 #

尝试使用Terraform创建AWS CodeBuild，配置如下：

resource "aws_codebuild_project" "cicd_codebuild" {
  name          = "cicd-${var.profile}-build"
  description   = "cicd ${var.profile} CodeBuild"
  service_role  = "${aws_iam_role.cicd_role.arn}"

  source {
    type = "GITHUB_ENTERPRISE"
    location = "https://git.xxx.com/yyy/zzz.git"
    git_clone_depth = 0
    buildspec = "NO_SOURCE"
  }

  environment {
    compute_type                = "BUILD_GENERAL1_MEDIUM"
    image                       = "aws/codebuild/windows-base:2019-1.0"
    type                        = "WINDOWS_SERVER_2019_CONTAINER"
    image_pull_credentials_type = "CODEBUILD"
  }

  artifacts {
    type = "NO_ARTIFACTS"
  }
}

执行terraform apply时报错如下：

Error: aws_codebuild_project.cicd_codebuild: expected environment.0.type to be one of [LINUX_CONTAINER LINUX_GPU_CONTAINER WINDOWS_CONTAINER ARM_CONTAINER], got WINDOWS_SERVER_2019_CONTAINER

将environment.0.type的值改为"WINDOWS_CONTAINER"后，再次执行又出现如下报错：

Error: Error applying plan:

1 error occurred:
        * aws_codebuild_project.cicd_codebuild: 1 error occurred:
        * aws_codebuild_project.cicd_codebuild: Error creating CodeBuild project: InvalidInputException: The environment type WINDOWS_CONTAINER is deprecated for new projects or existing project environment updates. Please consider using Windows Server 2019 instead.

已知该问题在更高版本AWS Provider中已修复，要求不升级当前Terraform和AWS Provider版本，给出临时绕过方案。

可用临时解决方案 #

方案1：用null_resource + AWS CLI直接创建（推荐） #

完全绕过旧版AWS Provider的参数硬编码校验，直接调用AWS CLI操作资源，步骤如下：

• 保留原有IAM角色等依赖资源配置不变
• 替换原有aws_codebuild_project资源为如下配置：

resource "null_resource" "cicd_codebuild" {
  triggers = {
    project_name = "cicd-${var.profile}-build"
    desc         = "cicd ${var.profile} CodeBuild"
    role_arn     = aws_iam_role.cicd_role.arn
  }

  # 创建/更新CodeBuild项目
  provisioner "local-exec" {
    command = <<EOT
aws codebuild create-project --name ${self.triggers.project_name} \
  --description "${self.triggers.desc}" \
  --service-role ${self.triggers.role_arn} \
  --source '{"type":"GITHUB_ENTERPRISE","location":"https://git.xxx.com/yyy/zzz.git","gitCloneDepth":0,"buildspec":"NO_SOURCE"}' \
  --environment '{"computeType":"BUILD_GENERAL1_MEDIUM","image":"aws/codebuild/windows-base:2019-1.0","type":"WINDOWS_SERVER_2019_CONTAINER","imagePullCredentialsType":"CODEBUILD"}' \
  --artifacts '{"type":"NO_ARTIFACTS"}'
EOT
  }

  # 销毁时同步清理资源
  provisioner "local-exec" {
    when    = destroy
    command = "aws codebuild delete-project --name ${self.triggers.project_name}"
  }
}

注意：本地需提前配置好有权限操作CodeBuild的AWS CLI环境，CLI版本支持WINDOWS_SERVER_2019_CONTAINER参数即可。如果是更新已有项目，可将create-project替换为update-project使用。

方案2：搭配lifecycle忽略规则+手动更新 #

如果不想引入null_resource和CLI调用，可按如下步骤操作：

1. 修改原有aws_codebuild_project配置，添加lifecycle.ignore_changes规则忽略环境类型校验：

resource "aws_codebuild_project" "cicd_codebuild" {
  name          = "cicd-${var.profile}-build"
  description   = "cicd ${var.profile} CodeBuild"
  service_role  = aws_iam_role.cicd_role.arn

  source {
    type = "GITHUB_ENTERPRISE"
    location = "https://git.xxx.com/yyy/zzz.git"
    git_clone_depth = 0
    buildspec = "NO_SOURCE"
  }

  environment {
    compute_type                = "BUILD_GENERAL1_MEDIUM"
    image                       = "aws/codebuild/windows-base:2019-1.0"
    type                        = "WINDOWS_CONTAINER"
    image_pull_credentials_type = "CODEBUILD"
  }

  artifacts {
    type = "NO_ARTIFACTS"
  }

  lifecycle {
    ignore_changes = [environment[0].type]
  }
}

2. 执行一次terraform apply，此时会触发WINDOWS_CONTAINER废弃的报错，无需调整配置，直接手动执行AWS CLI命令更新环境类型：

aws codebuild update-project --name cicd-<你的环境标识>-build \
  --environment '{"computeType":"BUILD_GENERAL1_MEDIUM","image":"aws/codebuild/windows-base:2019-1.0","type":"WINDOWS_SERVER_2019_CONTAINER","imagePullCredentialsType":"CODEBUILD"}'

3. 后续执行terraform plan/apply时，因为已经配置了忽略环境类型变更，不会触发校验报错，也不会覆盖已经修改正确的环境类型配置。

注意：后续如果需要修改环境的其他参数，需同步检查ignore_changes规则，避免出现配置漂移。

内容的提问来源于stack exchange，提问作者CK__