Terraform远程执行无法上载脚本: scp: /tmp权限被拒绝

Question

我正与Terraform的本地执行人员进行着激烈的斗争。我正在使用来自amazon-linux-2的自己构建的AMI部署一个EC2实例。

我有这样的代码：

locals {
  ssh_user_home = "/home/ec2-user"
}

resource "null_resource" "rerun" {
  triggers = {
    rerun = uuid()
  }


  provisioner "file" {
    source      = "${path.module}/sources"
    destination = "${local.ssh_user_home}/tmp"

    connection {
      type        = "ssh"
      user        = "${var.aws_ssh_user}"
      private_key = "${data.aws_secretsmanager_secret_version.kibana_proxy_ssh_value.secret_string}"
      host        = "${aws_instance.logstash.private_ip}"
    }
  }

  provisioner "file" {
    source      = "./creds"
    destination = "${local.ssh_user_home}/tmp"

    connection {
      type        = "ssh"
      user        = "${var.aws_ssh_user}"
      private_key = "${data.aws_secretsmanager_secret_version.kibana_proxy_ssh_value.secret_string}"
      host        = "${aws_instance.logstash.private_ip}"
    }
  }

  provisioner "remote-exec" {
    inline = [

      "cd ${local.ssh_user_home}/tmp",
      "cp creds/.htpasswd.${var.aws_env} creds/.htpasswd",
      "bash -x sources/ansible.sh ${var.es_fqdn} ${var.kibana_domain}",
      # "rm -r /tmp/creds/",
      # "rm -r /tmp/sources/",
    ]

    connection {
      type        = "ssh"
      user        = "${var.aws_ssh_user}"
      private_key = "${data.aws_secretsmanager_secret_version.kibana_proxy_ssh_value.secret_string}"
      host        = "${aws_instance.logstash.private_ip}"
      #script_path = "${local.ssh_user_home}"
    }
  }
}

总是有这样的错误：

module.logstash-instance.null_resource.rerun (remote-exec): Connecting to remote host via SSH...
module.logstash-instance.null_resource.rerun (remote-exec):   Host: 10.135.202.29
module.logstash-instance.null_resource.rerun (remote-exec):   User: ec2-user
module.logstash-instance.null_resource.rerun (remote-exec):   Password: false
module.logstash-instance.null_resource.rerun (remote-exec):   Private key: true
module.logstash-instance.null_resource.rerun (remote-exec):   Certificate: false
module.logstash-instance.null_resource.rerun (remote-exec):   SSH Agent: false
module.logstash-instance.null_resource.rerun (remote-exec):   Checking Host Key: false
mmodule.logstash-instance.null_resource.rerun (remote-exec): Connected!

Failed to upload script: scp: /tmp: Permission denied

不知道我做错了什么，因为terraform使用ec2-user作为用户，并且所有内容都被复制到/home/ec2-user/tmp中

Answer 1

我找到了问题所在。amazon linux 2的强化方式是，它不允许来自外部源的ssh开箱即用。我没有找到一个解决方案来软化这个限制，但是我使用了user_data (使用cloud-init，这意味着ec2实例在重启后运行user_data脚本)，现在一切都正常了:)