AWS VPC 端点服务：如何 append 委托人

Question

I am trying to create an AWS VPC Endpoint Service (PrivateLink) where I can add Principals to those that already exist. Here is my current code

resource "aws_vpc_endpoint_service" "privatelink" {
  provider                   = aws.customer
  acceptance_required        = true
  network_load_balancer_arns = ["${aws_lb.nlb.arn}"]
}

resource "aws_vpc_endpoint_service_allowed_principal" "addition" {
  provider                = aws.customer
  vpc_endpoint_service_id = aws_vpc_endpoint_service.privatelink.id
  principal_arn           = var.consumer_principal_arn
}

That works great for the one Principal specified in the variable but overwrites the existing Principal when I run it again with a different Principal. What I want is to append zero or more Principals to the list of existing Principals, each time I do a terraform apply . For example, the first time I run it, I specify Principal X. I run it again, specifying Principal Y. Now the list of allowed Principals is X and Y.

Answer 1

You would need to create multiple aws_vpc_endpoint_service_allowed_principal resources with each additional ARN. This way you can revoke principal(s) in the future without destroying other existing associations. Of course you can use for each loop and create aws_vpc_endpoint_service_allowed_principal resources with count and a list of principal ARNs. However, if you remove a principal from the list, associations for all the principals after the removed principal from the list will be recreated and the associations needs to be accepted again.

Answer 2

You can't edit the existing resource definition to add another principal. Terraform sees that as an update to the resource named "addition" and performs an update instead. Instead you need to add another aws_vpc_endpoint_service_allowed_principal resource.