cn-terraform / terraform-aws-logs-s3-bucket Goto Github PK
View Code? Open in Web Editor NEWAWS S3 bucket for logs delivery
Home Page: https://registry.terraform.io/modules/cn-terraform/logs-s3-bucket
License: Apache License 2.0
AWS S3 bucket for logs delivery
Home Page: https://registry.terraform.io/modules/cn-terraform/logs-s3-bucket
License: Apache License 2.0
This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
This repository currently has no open or pending branches.
.github/workflows/pipeline.yml
actions/checkout v4
actions/checkout v4
versions.tf
aws >= 4
hashicorp/terraform >= 0.13
So, it looks like the bug is more in this module than in the static website module.
cn-terraform/terraform-aws-s3-static-website#38
Getting this error trying to create a static web site.
Error: Error putting S3 policy: MalformedPolicy: Missing required field Principal cannot be empty!
status code: 400, request id: [redacted], host id: [redacted]
with module.mainsite.module.main_static_site.module.s3_logs_bucket.aws_s3_bucket_policy.logs_access_policy,
on .terraform/modules/mainsite.main_static_site.s3_logs_bucket/main.tf line 70, in resource "aws_s3_bucket_policy" "logs_access_policy":
70: resource "aws_s3_bucket_policy" "logs_access_policy" {
This is the terraform code taht produces this issue:
module "main_static_site" {
source = "cn-terraform/s3-static-website/aws"
version = "0.0.17"
name_prefix=var.deployment_name
website_domain_name=var.main_site_domain_name
create_route53_hosted_zone = false
route53_hosted_zone_id = aws_route53_zone.main.zone_id
providers = {
aws.main = aws
aws.acm_provider = aws
}
}
Where the following applies:
* var.main_deployment_name = "production"
* var.main_site_domain_name = "mydomain.com"
I'm creating a hosted zone manually and passing it in.
The line in the associated module shows this on line 70:
```hcl
resource "aws_s3_bucket_policy" "logs_access_policy" {
bucket = aws_s3_bucket.logs.id
policy = data.aws_iam_policy_document.logs_access_policy_document.json
}
I'm not sure which field is missing, but this is the result from AWS. Is there a known workaround for this?
ptwohig@ryzen:~/git/terraform-aws-logs-s3-bucket$ terraform version
Terraform v1.2.6
on linux_amd64
+ provider registry.terraform.io/hashicorp/aws v4.15.0
+ provider registry.terraform.io/hashicorp/random v3.2.0
The error is:
Error: Provider produced inconsistent final plan
│
│ When expanding the plan for module.ecs_fargate_service.module.ecs-alb[0].module.lb_logs_s3[0].aws_s3_bucket.logs to include new values learned so far during apply, provider "registry.terraform.io/hashicorp/aws" produced an invalid new value for .tags_all: new element
│ "Name" has appeared.
│
│ This is a bug in the provider, which should be reported in the provider's own issue tracker.
╵
╷
│ Error: Provider produced inconsistent final plan
│
│ When expanding the plan for module.ecs_fargate_service.module.ecs-alb[0].module.lb_logs_s3[0].aws_s3_bucket.logs to include new values learned so far during apply, provider "registry.terraform.io/hashicorp/aws" produced an invalid new value for .tags_all: new element
│ "Type" has appeared.
│
│ This is a bug in the provider, which should be reported in the provider's own issue tracker.
It seems to be caused by using dynamic value in the tag: hashicorp/terraform-provider-aws#19583
Also curious why is the name of the generated bucket has random string while all other resources in ECS, load balancer and other modules are deterministic.
The AWS S3 console for the generated log bucket shows the following security warning:
Ln 15, Col 15 | Restrict Access To Service Principal: Granting access to a service principal without specifying a source is overly permissive. Use aws:SourceArn or aws:SourceAccount condition key to grant fine-grained access.
-- | --
Referring to the getBucketAcl
action for ELB log delivery. I agree, adding a variable for sourceArn
or sourceAccount
would be best.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.