Brian G's questions

我在模块根目录中有一个 Terraform Variables.tf，其内容类似于以下内容：

variable "parameters" {
  description = "Parameter Store key/values"
  type = map(string)
  default = {
    "/customer1/prod/keycloak/password" = "password123"
    "/customer1/prod/keycloak/realm" = "default"
    "/customer1/prod/keycloak/url" = "https://customer1-sso.app.something.cloud/auth"
    "/customer1/prod/keycloak/userid" = "f:48c1ce1f:monitoring"
    "/customer1/uat/keycloak/password" = "password123"
    "/customer1/uat/keycloak/realm" = "uat"
    "/customer1/uat/keycloak/url" = "https://customer1-sso.npr.app.something.cloud/auth"
    "/customer1/uat/keycloak/userid" = "f:d48d4452:monitoring"
    "/customer1/uat2/keycloak/password" = "password123"
    "/customer1/uat2/keycloak/realm" = "uat2"
    "/customer1/uat2/keycloak/url" = "https://customer1-sso.npr.app.something.cloud/auth"
    "/customer1/uat2/keycloak/userid" = "f:5fe762fd:monitoring"
    "/customer2/prod/keycloak/password" = "password123"
    "/customer2/prod/keycloak/realm" = "default"
    "/customer2/prod/keycloak/url" = "https://customer2-sso.app.something.cloud/auth"
    "/customer2/prod/keycloak/userid" = "f:a053a488:monitoring"
    "/customer2/uat/keycloak/password" = "password123"
    "/customer2/uat/keycloak/realm" = "uat"
    "/customer2/uat/keycloak/url" = "https://customer2-sso.npr.app.something.cloud/auth"
    "/customer2/uat/keycloak/userid" = "f:225118c6:monitoring"
    "/customer2/uat2/keycloak/password" = "password123"
    "/customer2/uat2/keycloak/realm" = "uat2"
    "/customer2/uat2/keycloak/url" = "https://customer2-sso.npr.app.something.cloud/auth"
    "/customer2/uat2/keycloak/userid" = "f:9d8b2d30:monitoring
 }
}

我想将其转换为如下所示的对象图：

{
  "customer1_prod" = {
    customer = "customer1"
    password = "password123"
    realm    = "default"
    url      = "https://customer1-sso.app.something.cloud/auth"
    userid   = "f:48c1ce1f:monitoring"
  }
  ...
}

我已经在根模块（main.tf）代码中尝试过这个：

# Transform flat map of strings into a grouped map of customer-env -> { password, realm, url, userid }
locals {
  # Step 1: Flatten parameters to tuples of [group_key, key_in_object, value]
  parameter_tuples = [
    for full_key, value in var.parameters : {
      group_key = join("_", slice(split("/", full_key), 1, 3))     # e.g. customer1_prod
      key       = split("/", full_key)[3]                          # e.g. password
      value     = value
    }
  ]

  # Step 2: Group by environment and assemble objects with customer field
  customers = {
    for group_key in distinct([for p in local.parameter_tuples : p.group_key]) :
    group_key => merge(
      {
        customer = split("_", group_key)[0]
      },
      merge([
        for p in local.parameter_tuples : {
          for inner in [p] :
          inner.key => inner.value
        } if p.group_key == group_key
      ]...)
    )
  }
}

output "all_customers" {
  value = local.customers
}

module "dd_synthetic_browser" {
  source = "./modules/dd_synthetic_browser"
  customers = local.customers
}

然而，输出显示如下：

+ all_customers             = {
      + customer1_prod = {
          + customer = "customer1"
          + keycloak = "f:48c1ce1f:monitoring"
        }
    ...
    ...

如何修复这个错误的对象映射？有两个错误：

1. 对象中应该有五项（客户、密码、领域、url 和用户 ID），但实际上只有两项。
2. 该keycloak = "f:48c1ce1f:monitoring"项目应该是userid = "f:48c1ce1f:monitoring"

此外，我愿意接受有关更好的 Terraform 代码的建议来执行此转换，因为我认为我的代码对于其任务来说太复杂了，并且可能可以用更少的代码行以更简单的方式完成。

我正在使用

aws_s3_bucket_website_configuration

资源来配置 S3 网站重定向，当我在origin资源块中引用该资源时aws_cloudfront_distribution，出现以下错误：

Error: creating CloudFront Distribution: operation error CloudFront: CreateDistributionWithTags, https response error StatusCode: 400, RequestID: 123456789, InvalidArgument: The parameter Origin DomainName does not refer to a valid S3 bucket.

完整代码如下：

resource "aws_s3_bucket" "cf_s3_bucket" {
  bucket = var.cf_s3_bucket
}

resource "aws_s3_bucket_website_configuration" "cf_s3_bucket" {
  bucket = aws_s3_bucket.cf_s3_bucket.id

 redirect_all_requests_to {
  host_name = var.s3_redirect_destination
  protocol = "https"
  }
}

resource "aws_cloudfront_origin_access_control" "cf_oac" {
  name                              = "travel"
  description                       = "travel policy"
  origin_access_control_origin_type = "s3"
  signing_behavior                  = "always"
  signing_protocol                  = "sigv4"
}

resource "aws_cloudfront_distribution" "s3_distribution" {
  comment = var.cf_dist_comment
  aliases = var.alt_domain_names

  default_cache_behavior {
    allowed_methods  = ["GET", "HEAD"]
    cached_methods   = ["GET", "HEAD"]
    target_origin_id = local.s3_origin_id

    forwarded_values {
      query_string = false

      cookies {
        forward = "none"
      }
    }

    viewer_protocol_policy = "redirect-to-https"
  }

  default_root_object = "index.html"
  enabled             = true
  http_version        = "http2"
  is_ipv6_enabled     = false

   origin {
    connection_attempts      = 3
    connection_timeout       = 10
    domain_name              = aws_s3_bucket_website_configuration.cf_s3_bucket.website_endpoint
    origin_access_control_id = aws_cloudfront_origin_access_control.cf_oac.id
    origin_id                = local.s3_origin_id
  }

  price_class = "PriceClass_100"

  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }

  viewer_certificate {
    acm_certificate_arn = var.acm_cert_arn
    minimum_protocol_version = "TLSv1.2_2021"
    ssl_support_method = "sni-only"
  }
}

如果我改变

domain_name

到

domain_name=aws_s3_bucket.cf_s3_bucket.bucket_regional_domain_name

那么我就不会收到错误。但是，当我在 CloudFront 控制台中查看 Origin 时，我看到了此消息

This S3 bucket has static web hosting enabled. If you plan to use this distribution as a website, we recommend using the S3 website endpoint rather than the bucket endpoint.

因此，我在 CloudFront 中输入了错误的 Origin 域值，导致Access Denied我的浏览器出现问题，我必须在 CloudFront 控制台中手动更改它才能使重定向正常工作。

我的问题是，我可以使用

domain_name = aws_s3_bucket_website_configuration.cf_s3_bucket.website_endpoint

如果不是，我如何获得正确的值

domain_name

在街区里origin？