Terraform不断迫使aws_iam_server_certificate资源的再创造

Question

✦ ➜ terraform --version                       
Terraform v0.12.28
+ provider.aws v2.60.0
+ provider.kubernetes v1.11.3
+ provider.local v1.4.0
+ provider.null v2.1.2
+ provider.random v2.2.1
+ provider.template v2.1.2

只需为SSL证书放置2个新文件即可。

  # module.ssl-certificate.aws_iam_server_certificate.cert must be replaced
+/- resource "aws_iam_server_certificate" "cert" {
      ~ arn               = "arn:aws:iam::XXX:server-certificate/xxx-ssl-certxxx" -> (known after apply)
      ~ certificate_body  = "721e444119806928d19ef830740057c52580ba71" -> "cd6882dff1edb0223a20fe5f1c2b4b594f07526f" # forces replacement
      - certificate_chain = "7e85cb3e40dff5a9f83ff75576d71fd98fdfdd89" -> null # forces replacement
      ~ id                = "XXX" -> (known after apply)
      ~ name              = "XXX-ssl-cert20200716210119477600000001" -> (known after apply)
        name_prefix       = "XXX-ssl-cert"
        path              = "/"
        private_key       = (sensitive value)
    }

每次运行terraform apply时，我总是要求“替换”证书。每次创建一个新的。

文件(crt，key)没有改变

/main.tf

module "ssl-certificate" {
  source = "./modules/certificates"
  certificate = {
    name        = "xxx-ssl-cert"
    body        = file("assets/ssl/_.xxx.com/xxx.crt")
    private_key = file("assets/ssl/_.xxx.com/xxx.key")
  }
  team        = var.team
  project     = var.project
  component   = ""
  environment = var.environment
  tags        = module.project_config.tags
}

/modules/certificates/main.tf

resource "aws_iam_server_certificate" "cert" {
  name_prefix      = var.certificate.name
  certificate_body = var.certificate.body
  private_key      = var.certificate.private_key

  lifecycle {
    create_before_destroy = true
  }
}

怎么啦？在此之前，我有自己签署的证书，从来没有这种行为。添加了新的证书--并开始在apply中获得这些“重新创建”所需的计划。

有什么想法吗？

Answer 1

我建议对ignore_changes使用生命周期。

Example:   lifecycle {
    ignore_changes = [certificate_body]
  }

Answer 2

若要防止在证书内容不发生更改时terraform重新创建证书，

1. 将证书链内容从"certificate_body“移动到"aws_iam_server_certificate”资源中的"certificate_chain“terraform参数&

1. 确保certificate_body & certificate_contents中的行尾与实际行尾相同(对于我的用例，cert中的行尾为LF)