使用 Terraform 部署到多个 AWS 账户? [英] Deploying to multiple AWS accounts with Terraform?

问题描述

我一直在寻找一种能够在 Terraform 中同时部署到多个 AWS 账户的方法，但最终还是会枯竭.AWS 有使用 Stacks 执行此操作的概念，但我不确定在 Terraform 中是否可以执行此操作?如果是这样，有哪些解决方案?

I've been looking for a way to be able to deploy to multiple AWS accounts simultaneously in Terraform and coming up dry. AWS has the concept of doing this with Stacks but I'm not sure if there is a way to do this in Terraform? If so what would be some solutions?

您可以阅读有关 Cloudformation 解决方案的更多信息 这里.

You can read more about the Cloudformation solution here.

推荐答案

您可以定义 多个提供商别名，可用于在不同区域甚至不同 AWS 账户中运行操作.

You can define multiple provider aliases which can be used to run actions in different regions or even different AWS accounts.

因此要在您的默认区域执行某些操作(或者如果未在 环境变量 或 ~/.aws/config) 以及在美国东部 1 中，您会遇到这样的情况:

So to perform some actions in your default region (or be prompted for it if not defined in environment variables or ~/.aws/config) and also in US East 1 you'd have something like this:

provider "aws" {
  # ...
}

# Cloudfront ACM certs must exist in US-East-1
provider "aws" {
  alias  = "cloudfront-acm-certs"
  region = "us-east-1"
}

然后你会这样称呼他们:

You'd then refer to them like so:

data "aws_acm_certificate" "ssl_certificate" {
  provider    = aws.cloudfront-acm-certs
  ...
}

resource "aws_cloudfront_distribution" "cloudfront" {
  ...
  viewer_certificate {
    acm_certificate_arn = data.aws_acm_certificate.ssl_certificate.arn
    ...
  }
}

因此，如果您想同时跨多个帐户执行操作，则可以 在另一个帐户中扮演一个角色，如下所示:

So if you want to do things across multiple accounts at the same time then you could assume a role in the other account with something like this:

provider "aws" {
  # ...
}

# Assume a role in the DNS account so we can add records in the zone that lives there
provider "aws" {
  alias   = "dns"
  assume_role {
    role_arn     = "arn:aws:iam::ACCOUNT_ID:role/ROLE_NAME"
    session_name = "SESSION_NAME"
    external_id  = "EXTERNAL_ID"
  }
}

并像这样引用它:

data "aws_route53_zone" "selected" {
  provider     = aws.dns
  name         = "test.com."
}

resource "aws_route53_record" "www" {
  provider = aws.dns
  zone_id  = data.aws_route53_zone.selected.zone_id
  name     = "www.${data.aws_route53_zone.selected.name"
  ...
}

或者，您可以通过多种其他方式为不同的 AWS 账户提供凭证 例如 在提供程序中对它们进行硬编码或使用不同的 Terraform 变量, AWS SDK 特定环境变量 或使用 配置文件.

Alternatively you can provide credentials for different AWS accounts in a number of other ways such as hardcoding them in the provider or using different Terraform variables, AWS SDK specific environment variables or by using a configured profile.

这篇关于使用 Terraform 部署到多个 AWS 账户?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！