能否通过Terraform实现服务器间文件传输？有哪些可行方案？

你提出的「从s1通过WinRM下载keytab到本地、再通过Terraform上传到s2」的方案完全合理，完全适配当前Terraform不支持直接跨服务器拉取文件的限制，落地成本低，Windows环境下兼容性好。唯一需要注意的是keytab属于敏感凭据，执行完成后要及时清理本地缓存的文件，避免泄露。

• 无中转直传方案：直接在s1上通过WinRM执行远程命令，将keytab文件直接推送到s2，无需本地暂存文件，安全性更高，适合单对单的文件传输场景
• 共享存储中转方案：先将s1的keytab上传到内部SMB共享目录，s2直接从共享目录拉取文件，适合需要批量向多台服务器分发密钥的场景

本地中转方案代码 #

# 定义路径变量
locals {
  local_keytab_cache = "${path.root}/temp/app.keytab"
  s1_keytab_path     = "C:\\ProgramData\\keytab\\app.keytab"
  s2_keytab_path     = "C:\\Service\\app.keytab"
}

# 声明WinRM凭据变量，加sensitive避免日志泄露
variable "winrm_user" {
  type      = string
  sensitive = true
}
variable "winrm_pass" {
  type      = string
  sensitive = true
}

# WinRM从s1拉取keytab到本地
data "external" "pull_keytab" {
  program = ["powershell", "-Command", <<EOT
$ErrorActionPreference = "Stop"
# 配置s1 WinRM连接参数
$cred = New-Object System.Management.Automation.PSCredential ("${var.winrm_user}", (ConvertTo-SecureString "${var.winrm_pass}" -AsPlainText -Force))
# 远程读取文件转Base64
$fileBase64 = Invoke-Command -ComputerName "s1.your-domain.com" -Credential $cred -UseSSL -ScriptBlock {
  param($path)
  [Convert]::ToBase64String([IO.File]::ReadAllBytes($path))
} -ArgumentList "${local.s1_keytab_path}"
# 写入本地缓存
[IO.File]::WriteAllBytes("${local.local_keytab_cache}", [Convert]::FromBase64String($fileBase64))
Write-Output '{"result":"ok"}'
EOT
  ]
}

# 上传keytab到s2
resource "null_resource" "push_keytab_to_s2" {
  depends_on = [data.external.pull_keytab]

  connection {
    type     = "winrm"
    host     = "s2.your-domain.com"
    user     = var.winrm_user
    password = var.winrm_pass
    use_https = true
  }

  provisioner "file" {
    source      = local.local_keytab_cache
    destination = local.s2_keytab_path
  }

  # 执行完成自动删除本地缓存
  provisioner "local-exec" {
    interpreter = ["powershell", "-Command"]
    command     = "Remove-Item -Path '${local.local_keytab_cache}' -Force -ErrorAction SilentlyContinue"
  }
}

无中转直传方案代码 #

resource "null_resource" "direct_transfer_keytab" {
  connection {
    type     = "winrm"
    host     = "s1.your-domain.com"
    user     = var.winrm_user
    password = var.winrm_pass
    use_https = true
  }

  provisioner "remote-exec" {
    inline = [
      <<EOT
$ErrorActionPreference = "Stop"
# 读取s1本地keytab
$keytabBytes = [IO.File]::ReadAllBytes("${local.s1_keytab_path}")
# 配置s2连接参数
$cred = New-Object System.Management.Automation.PSCredential ("${var.winrm_user}", (ConvertTo-SecureString "${var.winrm_pass}" -AsPlainText -Force))
# 直接写入s2目标路径
Invoke-Command -ComputerName "s2.your-domain.com" -Credential $cred -UseSSL -ScriptBlock {
  param($bytes, $targetPath)
  [IO.File]::WriteAllBytes($targetPath, $bytes)
} -ArgumentList $keytabBytes, "${local.s2_keytab_path}"
EOT
    ]
  }
}

• WinRM需要提前在两台服务器上配置HTTPS监听，放通防火墙5986端口，避免明文传输凭据
• 生产环境建议配合Terraform的敏感数据保护能力，禁止keytab内容输出到任何日志或状态文件中

内容的提问来源于stack exchange，提问作者Michael Barfs