主页 / user-9216229

Marco Caberletti's questions

Martin Hope
Marco Caberletti
Asked: 2025-01-19 19:53:20 +0800 CST
  • 5

我配置了 ElastiCache Redis 复制组以向 SNS 主题发送通知。SNS 主题使用自定义 KMS 密钥加密。

但我没有收到任何通知。检查 Redis 设置，我看到通知设置为“非活动”。如果我尝试强制将其设置为活动状态，它会被重新设置为非活动状态。我猜是因为 Elasticache 无法向主题发送通知。

KMS 密钥具有以下策略：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Default",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<account_id>:root"
      },
      "Action": "kms:*",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "elasticache.amazonaws.com"
      },
      "Action": [
        "kms:GenerateDataKey*",
        "kms:Decrypt"
      ],
      "Resource": "*"
    }
  ]
}

SNS 主题具有以下策略：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DefaultStatementID",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": [
        "sns:Subscribe",
        "sns:SetTopicAttributes",
        "sns:RemovePermission",
        "sns:Publish",
        "sns:ListSubscriptionsByTopic",
        "sns:GetTopicAttributes",
        "sns:DeleteTopic",
        "sns:AddPermission"
      ],
      "Resource": "arn:aws:sns:<region>:<account_id>:<topic_name>",
      "Condition": {
        "StringEquals": {
          "AWS:SourceOwner": "<account_id>"
        }
      }
    },
    {
      "Sid": "elasticache-allow-publish",
      "Effect": "Allow",
      "Principal": {
        "Service": "elasticache.amazonaws.com"
      },
      "Action": "sns:Publish",
      "Resource": "arn:aws:sns:<region>:<account_id>:<topic_name>"
    }
  ]
}

当然，地区、账户ID和主题名称都被删除了。

我错过了什么？

Martin Hope
Marco Caberletti
Asked: 2024-12-03 01:44:22 +0800 CST
  • 5

我有一个如下的数据结构：

locals {
  replication_tasks = {
    track_to_s3_live = {
      replication_task_id       = "track-to-s3"
      migration_type            = "full-load-and-cdc"
      replication_task_settings = file("files/s3_tracking_cdc_settings.json")
      table_mappings            = file("files/s3_tracking_table_mappings.json")
      source_endpoint_key       = "source"
      target_endpoint_key       = "s3_tracking"
    }
  }
}

由此，我尝试编写等效的 .tfvars 文件（用于另一个模块）。类似于：

resource "local_file" "file" {
  content  = <<EOF
replication_tasks = "${local.replication_tasks}"
EOF
  filename = "${path.module}/tasks.auto.tfvars"
}

但是我收到此错误：

Cannot include the given value in a string template: string required.

关于如何实现这一点有什么建议吗？

terraform