Terraform应用lambda函数在ValidationException中失败，相同参数的AWS创建函数成功

Question

当尝试在Terraform中运行Terraform (试图创建AWS函数资源)时，应用程序会失败，出现一个无法描述的ValidationException。不返回其他错误。在terraform-provider-aws中有一个问题来解决这个问题.

这是描述函数的Terraform代码：

module "lambda" {
  source  = "terraform-aws-modules/lambda/aws"
  version = "~> 4.7"

  function_name = "${module.this.s3_bucket_id}-to-cloudwatch"

  handler = "index.handler"
  runtime = "nodejs12.x"
  timeout = 60

  create_package         = false
  local_existing_package = "${path.module}/assets/code.zip"

  environment_variables = {
    LOG_GROUP_NAME     = aws_cloudwatch_log_group.log_group.name
    LOAD_BALANCER_TYPE = var.load_balancer_type
  }

  allowed_triggers = {
    S3EventPermission = {
      principal  = "s3.amazonaws.com"
      source_arn = module.this.s3_bucket_arn
    }
  }

  role_path   = "/tf-managed/"
  policy_path = "/tf-managed/"

  attach_cloudwatch_logs_policy = true
  attach_tracing_policy         = true
  tracing_mode                  = "active"

  attach_policy_statements = true
  policy_statements = {
    describe_log_groups = {
      effect    = "Allow"
      actions   = ["logs:DescribeLogGroups"]
      resources = ["*"]
    }

    create_logs = {
      effect = "Allow"
      actions = [
        "logs:DescribeLogStreams",
        "logs:CreateLogStream",
        "logs:PutLogEvents",
      ]
      resources = [aws_cloudwatch_log_group.log_group.arn]
    }

    get_logs = {
      effect    = "Allow"
      actions   = ["s3:GetObject"]
      resources = ["${module.this.s3_bucket_arn}/*"]
    }
  }
}

这是函数的terraform plan输出：

  # module.cluster_nlb.module.log_bucket.module.lambda.aws_lambda_function.this[0] will be created
  + resource "aws_lambda_function" "this" {
      + architectures                  = (known after apply)
      + arn                            = (known after apply)
      + filename                       = "../../../modules/lb-log-bucket-with-cloudwatch-export/assets/code.zip"
      + function_name                  = "nlb-access-logs-04916534-to-cloudwatch"
      + handler                        = "index.handler"
      + id                             = (known after apply)
      + invoke_arn                     = (known after apply)
      + last_modified                  = (known after apply)
      + memory_size                    = 128
      + package_type                   = "Zip"
      + publish                        = false
      + qualified_arn                  = (known after apply)
      + reserved_concurrent_executions = -1
      + role                           = "arn:aws:iam::585685634436:role/tf-managed/nlb-access-logs-04916534-to-cloudwatch"
      + runtime                        = "nodejs12.x"
      + signing_job_arn                = (known after apply)
      + signing_profile_version_arn    = (known after apply)
      + source_code_hash               = "/pwL7Szm/wc/8dP8/Relzc8vy7nkAUQm9jtvgfWJa5c="
      + source_code_size               = (known after apply)
      + tags_all                       = (known after apply)
      + timeout                        = 60
      + version                        = (known after apply)

      + environment {
          + variables = {
              + "LOAD_BALANCER_TYPE" = "network"
              + "LOG_GROUP_NAME"     = "/aws/elb/network"
            }
        }

      + ephemeral_storage {
          + size = 512
        }

      + tracing_config {
          + mode = "active"
        }
    }

Terraform中显示的错误：

Error: error creating Lambda Function (1): ValidationException: status code: 400, request id: [...]
with module.cluster_alb.module.log_bucket.module.lambda.aws_lambda_function.this[0]
on .terraform/modules/cluster_alb.log_bucket.lambda/main.tf line 24, in resource "aws_lambda_function" "this":

resource "aws_lambda_function" "this" {

我一直试图在AWS lambda create-function命令中复制计划中的应用程序，从而获得更详细的错误。但是，该命令完成并成功地创建了Lambda函数。

这是AWS CLI命令：

aws lambda create-function \
  --zip-file fileb://../../../modules/lb-log-bucket-with-cloudwatch-export/assets/code.zip \
  --function-name 'nlb-access-logs-04916534-to-cloudwatch' \
  --handler 'index.handler' \
  --memory-size '128' \
  --package-type 'Zip' \
  --no-publish \
  --role 'arn:aws:iam::585685634436:role/tf-managed/nlb-access-logs-04916534-to-cloudwatch' \
  --runtime 'nodejs12.x' \
  --timeout '60' \
  --environment 'Variables={LOG_GROUP_NAME=/aws/elb/network,LOAD_BALANCER_TYPE=network}' \
  --tracing-config 'Mode=Active' \
  --description '' \
  --debug

我无法识别AWS CLI命令之间的任何差异，也无法确定验证在Terraform中失败的原因。

Answer 1

我在Terraform配置中设置了tracing_mode = "active"，但将--tracing-config 'Mode=Active'传递给AWS。

tracing_mode的有效值是"PassThrough“和"Active”。请注意，"Active“一词必须大写。