是否可以在Terraform API网关域名资源上更改标签信息？

Question

I am creating a Route53 URL which points to a CloudFront distribution and hits an API Gateway endpoint. I got the Terraform definitions to work and everything deployed correctly. However, I need to add tags to the CloudFront distribution.

Here is the relevant Terraform code:

resource "aws_api_gateway_domain_name" "api-gateway-domain" {
    domain_name = "${var.domain_name}"
    certificate_arn = "${var.arn}
    count        = "${var.count}"
}


resource "aws_route53_record" "route53" {
    zone_id = "${data.aws_route53_zone.route53-zone.zone_id}"
    name    = "${var.domain_name}"
    type    = "A"
    alias {
      name                   = "${aws_api_gateway_domain_name.api-gateway-domain.cloudfront_domain_name}"
      zone_id                = "${aws_api_gateway_domain_name.api-gateway-domain.cloudfront_zone_id}"
      evaluate_target_health = true
    }
    count   = "${var.count}"
}

I'm wondering if I can do something like "${aws_api_gateway_domain_name.api-gateway-domain.cloudfront_domain_name.id.tags}" = { TAGS = "foobar" } or something to that effect.

Is this possible? Or will I have to manually set up a CloudFront distribution to point my Route53 URL at?

Answer 1

No, you cannot.

The CloudFront Distribution that API Gateway creates is completely invisible to you; you have no way of seeing it, no way of altering it. Really, the fact that they even tell you that's what it is and then give you some information such as the "Target Domain name" is incredibly confusing. It's the same as when they say "Instance store-backed AMIs are stored by S3" - But you don't have any access to the actual S3 object.

Also, no - you will not need to create your own CloudFront Distribution; however you should be able to point your Route53 record at the CloudFront Target Domain Name that shows up in the "Custom Domain Names" section of API Gateway.

Neither the route53_record nor api_gateway_domain_name support a Tag block; likely due to AWS not supporting tags on them (Which I know - crazy, considering AWS always says you should tag everything, but then doesn't provide the option to).

So you're just kinda SOL on being able to tag these resources; and it won't be the last time you run into this unfortunately.