將 cloudformation 無服務器模板轉換為 Terraform 的最佳方法

Question

我正在嘗試將serverless framework YML 文件轉換為 Terraform 腳本。

這是我第一次使用terraform ，我對基礎設施也沒有太多經驗。

我的 Terraform 出現了一些錯誤，但我的問題更多是關於我的方法。

是否有更好/更簡單/更智能的方法在 Terraform 中編寫相同的無服務器 yml？

也許那里的模塊會讓我的生活更輕松。

地形

# Lambda invoke function role data
data "aws_iam_policy_document" "lambda_invoke_function_role" {
  version = "2012-10-17"
  statement {
    sid     = ""
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      service = "lambda.amazonaws.com"
    }
  }
}

# Lambda ec2
data "aws_iam_policy_document" "ec2_lambda_policies_role" {
  version = "2012-10-17"
  statement {
    sid    = ""
    effect = "Allow"
    actions = [
      "ec2:CreateNetworkInterface",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DetachNetworkInterface",
      "ec2:DeleteNetworkInterface"
    ]
    resources = "*"
  }
}

# Lambda allow invoke
data "aws_iam_policy_document" "allow_invoke_role" {
  version = "2012-10-17"
  statement {
    sid    = ""
    effect = "Allow"
    actions = [
      "lambda:InvokeFunction"
    ]
    resources = "*"
  }
}


# Lambda invoke function role
resource "aws_iam_role" "lambda_invoke_function_role" {
  name               = "lambdaRole"
  assume_role_policy = "${data.aws_iam_policy_document.lambda_invoke_function_role.json}"
}


# EC2 ##############################################################################
resource "aws_iam_policy" "ec2_lambda_policies_policy" {
  name               = "ec2LambdaPolicy"
  assume_role_policy = "${data.aws_iam_policy_document.ec2_lambda_policies_role.json}"
}

resource "aws_iam_role_policy_attachment" "ec2_lambda_policies_policy_attachment" {
  role       = "${aws_iam_role.lambda_invoke_function_role.name}"
  policy_arn = "${aws_iam_policy.ec2_lambda_policies_policy.arn}"
}
###############################################################################


# Allow Invoke #####################################################################
resource "aws_iam_policy" "allow_invoke_policy" {
  name               = "allowInvokePolicy"
  assume_role_policy = "${data.aws_iam_policy_document.allow_invoke_role.json}"
}

resource "aws_iam_role_policy_attachment" "allow_invoke_policy_attachment" {
  role       = "${aws_iam_role.lambda_invoke_function_role.name}"
  policy_arn = "${aws_iam_policy.allow_invoke_policy.arn}"
}
###############################################################################


# Lambda invoke function role policy attachment
resource "aws_iam_role_policy_attachment" "aws_lambda_basic_execution_role" {
  role       = "${aws_iam_role.lambda_invoke_function_role.name}"
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}

# Lambda invoke function role policy attachment
resource "aws_iam_role_policy_attachment" "aws_lambda_vpc_access_execution_role" {
  role       = "${aws_iam_role.lambda_invoke_function_role.name}"
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
}

無服務器 YML（雲形成）

  LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      Path: '/'
      RoleName: LambdaRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: ec2LambdaPolicies
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - ec2:CreateNetworkInterface
                  - ec2:DescribeNetworkInterfaces
                  - ec2:DetachNetworkInterface
                  - ec2:DeleteNetworkInterface
                Resource: "*"
        - PolicyName: 'AllowInvoke'
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: 'Allow'
                Action: 'lambda:InvokeFunction'
                Resource: '*'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole

Answer 1

您可能想看看cf-to-tf ，它將雲形成轉換為 terraform。

cf-to-tf --stack foobarbaz config | json2hcl | cf-to-tf clean-hcl | terraform fmt -

這將從 AWS 導入您的堆棧foobarbaz並將其轉換為 terraform 並將其打印到標准輸出。