Terraform 總是說 s3 存儲桶策略的模板文件更改

Question

我的 s3 存儲桶策略有問題，它似乎正確添加了策略，甚至在 AWS 中驗證了它，它顯示了 policy.tpl 中設置的確切策略，但它一直說有變化

我已經嘗試將操作和資源更改為 arrays，我聽說這可能會有所幫助.. 嘗試從策略中刪除“版本”，即 SID，一直說每次我運行它時都會發生變化

政策.tf

resource "aws_s3_bucket_policy" "bucket" {
  bucket = aws_s3_bucket.bucket.id
  policy = local.policy
}

本地人.tf

locals {
  template_dir       = "${path.module}/templates"
  template_vars      = {
    encrypt          = var.s3_require_encryption_enabled
    bucket_arn       = aws_s3_bucket.bucket.arn
    extra_statements = var.s3_bucket_policy
  }
  policy             = templatefile("${local.template_dir}/policy.tpl", local.template_vars)
}

模板/policy.tpl

{
    "Version": "2008-10-17",
    "Statement": [
        {
            "Sid" : "",
            "Effect" : "Deny",
            "Principal" : "*",
            "Action" : "s3:*",
            "Resource" : "${bucket_arn}/*",
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            }        
        }
    ]
  }

在 AWS

{
    "Version": "2008-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::test-bucket-us-east-1/*",
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            }
        }
    ]
}

說

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  #aws_s3_bucket_policy.bucket will be updated in-place
  ~ resource "aws_s3_bucket_policy" "bucket" {
        bucket = "test-bucket-us-east-1"
        id     = "test-bucket-us-east-1"
      + policy = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "s3:*"
                      + Condition = {
                          + Bool = {
                              + aws:SecureTransport = "false"
                            }
                        }
                      + Effect    = "Deny"
                      + Principal = "*"
                      + Resource  = "arn:aws:s3:::test-bucket-us-east-1/*"
                      + Sid       = ""
                    },
                ]
              + Version   = "2008-10-17"
            }
        )
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Answer 1

根據評論，底層存儲桶策略存在問題。

PutBucketPolicy有

Content-MD5 請求正文的MD5 hash。

對於使用 AWS 命令行界面 (CLI) 或 AWS 開發工具包發出的請求，此字段會自動計算。）

因此資源aws_s3_bucket_policy正在嘗試更新策略。