Terraform API Gateway HTTP API - 获取错误 Insufficient permissions to enable logging答案

【问题标题】：Terraform API Gateway HTTP API - Getting the error Insufficient permissions to enable loggingTerraform API Gateway HTTP API - 获取错误 Insufficient permissions to enable logging
【发布时间】：2021-08-20 01:23:38
【问题描述】：

我用于部署 HTTP API 的 terraform 脚本如下所示。运行此程序时出现以下错误-

创建 API Gateway v2 阶段时出错：BadRequestException: Insufficient permissions to enable logging

是否需要添加其他内容才能使其正常工作？

resource "aws_cloudwatch_log_group" "api_gateway_log_group" {
  name              = "/aws/apigateway/${var.location}-${var.custom_tags.Layer}-demo-publish-api"
  retention_in_days = 7
  tags = var.custom_tags
}

resource "aws_apigatewayv2_api" "demo_publish_api" {
  name = "${var.location}-${var.custom_tags.Layer}-demo-publish-api"
  description = "API to publish event payloads"
  protocol_type = "HTTP"
  tags = var.custom_tags
}

resource "aws_apigatewayv2_vpc_link" "demo_vpc_link" {
  name = "${var.location}-${var.custom_tags.Layer}-demo-vpc-link"
  security_group_ids = local.security_group_id_list
  subnet_ids = local.subnet_ids_list
  tags = var.custom_tags
}

resource "aws_apigatewayv2_integration" "demo_apigateway_integration" {
  api_id           = aws_apigatewayv2_api.demo_publish_api.id
  integration_type = "HTTP_PROXY"
  connection_type = "VPC_LINK"
  integration_uri = var.alb_listener_arn
  connection_id = aws_apigatewayv2_vpc_link.demo_vpc_link.id
  integration_method = "POST"
  timeout_milliseconds = var.api_timeout_milliseconds
}

resource "aws_apigatewayv2_route" "demo_publish_api_route" {
  api_id    = aws_apigatewayv2_api.demo_publish_api.id
  route_key = "POST /api/event"
  target = "integrations/${aws_apigatewayv2_integration.demo_apigateway_integration.id}"
}

resource "aws_apigatewayv2_stage" "demo_publish_api_default_stage" {
  depends_on = [aws_cloudwatch_log_group.api_gateway_log_group]

  api_id = aws_apigatewayv2_api.demo_publish_api.id
  name   = "$default"
  auto_deploy = true
  tags = var.custom_tags

  route_settings {
    route_key = aws_apigatewayv2_route.demo_publish_api_route.route_key
    throttling_burst_limit = var.throttling_burst_limit
    throttling_rate_limit = var.throttling_rate_limit
  }

  default_route_settings {
    detailed_metrics_enabled = true
    logging_level = "INFO"
  }

  access_log_settings {
    destination_arn = aws_cloudwatch_log_group.api_gateway_log_group.arn
    format = jsonencode({ "requestId":"$context.requestId", "ip": "$context.identity.sourceIp"})
  }
}

【问题讨论】：

您是否使用aws_api_gateway_account为api网关设置角色以允许访问cloudwatch？
我的理解是资源 aws_api_gateway_account 仅适用于 REST API，不适用于 HTTP API。如果这不正确，那么您能否分享代码 sn-p 以了解如何设置它。谢谢，
我认为你是对的。如果是这样，您是否需要权限来启用 http api 的日志记录，如 here 所示？
我尝试添加类似于 Terraform 脚本的内容，但无法使其正常工作。这就是为什么我正在寻找有效的东西。

标签： terraform terraform-provider-aws

【解决方案1】：

在联系 AWS 支持之前，我被困在这个问题上几天。如果您一直在部署大量 HTTP API，那么您可能会遇到同样的问题，即 IAM 策略变得非常大。

运行此 AWS CLI 命令以查找关联的 CloudWatch Logs 资源策略： aws logs describe-resource-policies
寻找AWSLogDeliveryWrite20150319。您会注意到此策略具有大量关联的 LogGroup 资源。您有三个选择：i>

通过删除一些可能未使用的条目来调整此策略。
将资源列表改为"*"
您可以添加其他策略。根据此策略，拆分它们之间的资源记录。

通过此 AWS CLI 命令应用更新： aws logs put-resource-policy

这是我用来设置资源的命令。使用"*" 作为策略：

aws logs put-resource-policy --policy-name AWSLogDeliveryWrite20150319 --policy-document "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"AWSLogDeliveryWrite\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"delivery.logs.amazonaws.com\"},\"Action\":[\"logs:CreateLogStream\",\"logs:PutLogEvents\"],\"Resource\":[\"*\"]}]}"

【讨论】：

虽然这可能会解决它（没有尝试），但解释是什么？如果资源名称定义正确，为什么需要*？
询问了 AWS 支持（因为我遇到了同样的问题）。解释是......这是他们知道并计划修复的错误。上述解决方法确实正是他们所建议的。

【解决方案2】：

@Marcin 您对 aws_api_gateway_account 的最初评论是正确的。我添加了以下资源，现在它工作正常 -

resource "aws_api_gateway_account" "demo" {
  cloudwatch_role_arn = var.apigw_cloudwatch_role_arn
}

data "aws_iam_policy_document" "demo_apigw_allow_manage_resources" {
  version = "2012-10-17"
  statement {
    actions = [
      "logs:DescribeLogGroups",
      "logs:DescribeLogStreams",
      "logs:GetLogEvents",
      "logs:FilterLogEvents"
    ]

    resources = [
      "*"
    ]
  }

  statement {
    actions = [
      "logs:CreateLogDelivery",
      "logs:PutResourcePolicy",
      "logs:UpdateLogDelivery",
      "logs:DeleteLogDelivery",
      "logs:CreateLogGroup",
      "logs:DescribeResourcePolicies",
      "logs:GetLogDelivery",
      "logs:ListLogDeliveries"
    ]

    resources = [
      "*"
    ]
  }
}

data "aws_iam_policy_document" "demo_apigw_allow_assume_role" {
  version = "2012-10-17"
  statement {
    effect = "Allow"
    actions = [
      "sts:AssumeRole"]
    principals {
      type = "Service"
      identifiers = ["apigateway.amazonaws.com"]
    }
  }
}

resource "aws_iam_role_policy" "demo_apigw_allow_manage_resources" {
  policy = data.aws_iam_policy_document.demo_apigw_allow_manage_resources.json
  role = aws_iam_role.demo_apigw_cloudwatch_role.id
  name = var.demo-apigw-manage-resources_policy_name
}

resource "aws_iam_role" "demo_apigw_cloudwatch_role" {
  name = "demo_apigw_cloudwatch_role"
  tags = var.custom_tags
  assume_role_policy = data.aws_iam_policy_document.demo_apigw_allow_assume_role.json
}

【讨论】：

第二组 statement.actions 对我有用

【解决方案3】：

您可以将 CW 日志 (aws_cloudwatch_log_group) 路由到 /aws/vendedlogs/*，它将解决问题。或创建 aws_api_gateway_account

【讨论】：