使用Terraform创建流水线时，无法从AWS CodeBuild工件获取源码

我来帮你理清这个Terraform配置的问题——你想要搭建一条包含CodeBuild构建步骤的CodePipeline流水线，并且让CodeBuild从流水线的工件中获取源码对吧？先看你现有的代码片段，我来补全并拆解关键部分，帮你搞定这个配置。

1. 补全你的CodeBuild项目配置 #

你的现有代码有两个核心问题：镜像标签不完整，且缺少source类型配置——只有把source类型设为CODEPIPELINE，CodeBuild才会从流水线传递的工件中拉取源码，而不是直接连接GitHub/CodeCommit这类源。

补全后的完整CodeBuild资源：

resource "aws_codebuild_project" "authorization" {
  name        = "authorization"
  description = "BuildProject for authorization service"
  build_timeout = "5" # 单位是分钟，这里设置为5分钟超时
  service_role = aws_iam_role.codebuild_role.arn # 建议用Terraform 0.12+的简洁语法，去掉${}

  # 核心配置：指定从CodePipeline接收源码工件
  source {
    type = "CODEPIPELINE"
    buildspec = "buildspec.yml" # 指向源码根目录的构建步骤配置文件，也可以直接内嵌
  }

  artifacts {
    type = "CODEPIPELINE" # 构建产物回传给CodePipeline作为后续阶段的工件
  }

  environment {
    compute_type = "BUILD_GENERAL1_SMALL"
    image        = "aws/codebuild/docker:19.03.12" # 补全完整的镜像标签，这里用官方Docker镜像
    type         = "LINUX_CONTAINER" # 必须指定环境类型，默认是LINUX_CONTAINER

    # 可选：添加构建所需的环境变量
    environment_variable {
      name  = "DEPLOY_ENV"
      value = "staging"
    }
  }

  # 可选：配置CloudWatch日志，方便排查构建问题
  logs_config {
    cloudwatch_logs {
      group_name  = "/aws/codebuild/authorization"
      stream_name = "build-stream"
    }
  }
}

2. 配套的CodePipeline配置（串联源码与构建步骤） #

接下来需要创建CodePipeline，把源码源（比如S3、GitHub、CodeCommit）和上面的CodeBuild项目串联起来——流水线会先拉取源码作为初始工件，再传递给CodeBuild处理：

resource "aws_codepipeline" "authorization_pipeline" {
  name     = "authorization-pipeline"
  role_arn = aws_iam_role.codepipeline_role.arn

  # 指定流水线的工件存储桶（用来暂存源码、构建产物等）
  artifact_store {
    location = aws_s3_bucket.pipeline_bucket.bucket
    type     = "S3"

    # 可选：用KMS加密工件
    encryption_key {
      id   = aws_kms_key.pipeline_key.arn
      type = "KMS"
    }
  }

  # 阶段1：拉取源码（这里以S3为例，可替换为GitHub/CodeCommit）
  stage {
    name = "Source"

    action {
      name             = "Fetch-Source"
      category         = "Source"
      owner            = "AWS"
      provider         = "S3"
      version          = "1"
      output_artifacts = ["source_artifact"] # 输出的工件会传给下一个阶段

      configuration = {
        S3Bucket = aws_s3_bucket.source_bucket.bucket
        S3ObjectKey = "authorization-service-source.zip" # 你的源码压缩包路径
      }
    }
  }

  # 阶段2：执行CodeBuild构建
  stage {
    name = "Build"

    action {
      name             = "Build-Service"
      category         = "Build"
      owner            = "AWS"
      provider         = "CodeBuild"
      version          = "1"
      input_artifacts  = ["source_artifact"] # 用Source阶段的输出作为构建输入
      output_artifacts = ["build_artifact"] # 构建产物作为输出，可用于后续部署

      configuration = {
        ProjectName = aws_codebuild_project.authorization.name
      }
    }
  }

  # 可选：添加部署阶段（比如部署到ECS、EC2或Lambda）
  stage {
    name = "Deploy"
    # 这里可以添加部署相关的Action，比如ECS部署、CloudFormation栈更新等
  }
}

3. 关键细节说明 #

• Buildspec文件：你需要在源码根目录下创建buildspec.yml，定义具体的构建步骤，比如：

  version: 0.2
  phases:
    install:
      commands:
        - echo Installing dependencies...
        - npm install
    build:
      commands:
        - echo Building authorization service...
        - npm run build
    post_build:
      commands:
        - echo Build completed successfully!
  artifacts:
    files:
      - '**/*'
    base-directory: 'dist' # 把构建后的dist目录作为输出工件
  

• IAM权限：确保CodeBuild角色有读取流水线工件（S3）、写入CloudWatch日志的权限；CodePipeline角色有调用CodeBuild、读写S3的权限。比如CodeBuild角色的权限政策可以这样配置：

  resource "aws_iam_role_policy" "codebuild_policy" {
    name = "codebuild-authorization-policy"
    role = aws_iam_role.codebuild_role.id
  
    policy = jsonencode({
      Version = "2012-10-17"
      Statement = [
        {
          Effect = "Allow"
          Action = ["s3:GetObject", "s3:PutObject"]
          Resource = "${aws_s3_bucket.pipeline_bucket.arn}/*"
        },
        {
          Effect = "Allow"
          Action = ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"]
          Resource = "arn:aws:logs:*:*:*"
        }
      ]
    })
  }
  

常见问题排查 #

• 如果CodeBuild报错找不到源码：检查CodePipeline的Source阶段是否正确输出了工件，以及CodeBuild的source.type是否设置为CODEPIPELINE。
• 如果Buildspec不生效：确认文件路径正确，或者可以直接在CodeBuild的source块内嵌Buildspec内容，比如：

  source {
    type = "CODEPIPELINE"
    buildspec = <<EOF
  version: 0.2
  phases:
    build:
      commands:
        - echo Hello from CodeBuild!
  EOF
  }
  

内容的提问来源于stack exchange，提问作者Nephilimrising