使用 terraform 通过 SNS 处理 AWS S3 事件答案

【问题标题】：AWS S3 events handling with SNS using terraform使用 terraform 通过 SNS 处理 AWS S3 事件
【发布时间】：2021-02-13 03:30:21
【问题描述】：

尝试设置 AWS S3 事件规则，但未捕获事件。可能我在 event-pattern 或 sns 目标策略中遗漏了一些东西。为了测试它，我正在使用 aws 控制台创建电子邮件订阅，因为 terraform 目前不支持 sns 电子邮件订阅。有人遇到过同样的问题吗？

事件规则声明：

resource "aws_cloudwatch_event_rule" "this" {
  name        = "some-rule"
  is_enabled  = true
  description = "some-rule"

  event_pattern = <<PATTERN
{
  "source": [
    "aws.s3"
  ],
  "detail-type": [
   "Events S3"
  ],
  "detail": {
    "eventSource": [
      "s3.amazonaws.com"
    ],
    "eventName": [
      "CopyObject",
      "CompleteMultipartUpload",
      "PutObject"
    ],
    "requestParameters": {
      "bucketName": [
          "${local.bucket_name}"
      ]
    }
  }
}
PATTERN
}

SNS 主题声明：

resource "aws_cloudwatch_event_target" "this" {
  rule      = aws_cloudwatch_event_rule.this.name
  target_id = null
  arn       = aws_sns_topic.topic.arn
}



resource "aws_sns_topic" "topic" {
  name = "some-topic"
  kms_master_key_id = data.aws_kms_key.common_key.key_id
  policy = <<POLICY
  {
      "Version":"2012-10-17",
      "Statement":[{
          "Effect": "Allow",
          "Principal": {"Service":"s3.amazonaws.com"},
          "Action": "SNS:Publish",
          "Resource":  "arn:aws:sns:${var.aws_region}:${data.aws_caller_identity.current.account_id}:some-topic",
          "Condition":{
              "ArnLike":{"aws:SourceArn":"${aws_s3_bucket.artifact-store.arn}"}
          }
      }]
  }
  POLICY
}

有趣的是，替代方法正在发挥作用：

resource "aws_s3_bucket_notification" "s3_notif" {
  bucket = "${aws_s3_bucket.artifact-store.id}"
  topic {
    topic_arn = "${aws_sns_topic.topic.arn}"
    events = [
      "s3:ObjectCreated:*",
    ]
  }
}

【问题讨论】：

标签： amazon-web-services amazon-s3 amazon-cloudwatch amazon-sns

【解决方案1】：

RCA：我忘记添加 CloudWatch 权限才能发布 sns 消息：

resource "aws_sns_topic_policy" "default" {
  count  = 1
  arn    = aws_sns_topic.topic.arn
  policy = "${data.aws_iam_policy_document.sns_topic_policy_cw.0.json}"
}

resource "aws_sns_topic_policy" "default2" {
  count  = 1
  arn    = aws_sns_topic.topic.arn
  policy = "${data.aws_iam_policy_document.sns_topic_policy_s3.0.json}"
}

data "aws_iam_policy_document" "sns_topic_policy_cw" {
  count = "1"
  statement {
    sid       = "Allow CloudwatchEvents"
    actions   = ["sns:Publish"]
    resources = [aws_sns_topic.topic.arn]

    principals {
      type        = "Service"
      identifiers = ["events.amazonaws.com"]
    }
  }
}

Terraform: CloudWatch Event that notifies SNS

【讨论】：