{"id":48315,"date":"2022-12-21T15:54:32","date_gmt":"2023-06-30T22:32:08","guid":{"rendered":"https:\/\/www.silicloud.com\/zh\/blog\/%e7%94%a8terraform-cloud%e7%ae%a1%e7%90%86aws\/"},"modified":"2024-04-29T06:20:57","modified_gmt":"2024-04-28T22:20:57","slug":"%e7%94%a8terraform-cloud%e7%ae%a1%e7%90%86aws","status":"publish","type":"post","link":"https:\/\/www.silicloud.com\/zh\/blog\/%e7%94%a8terraform-cloud%e7%ae%a1%e7%90%86aws\/","title":{"rendered":"\u7528Terraform Cloud\u7ba1\u7406AWS"},"content":{"rendered":"

\u6211\u5c06\u8bb0\u5f55\u4e0b\u8fde\u63a5\u5230AWS\u5e76\u8fdb\u884c\u7ba1\u7406\u7684\u65b9\u6cd5\uff0c\u4f7f\u7528Terraform Cloud\u3002<\/p>\n

\u8bf7\u53c2\u8003<\/h1>\n

 <\/p>\n

\u524d\u63d0 t\u00ed)<\/h1>\n
    \n
  1. \n
      \u5df2\u5728Terraform Cloud\u4e0a\u521b\u5efa\u4e86\u9879\u76ee\u548c\u5de5\u4f5c\u533a\u3002<\/ol>\n<\/li>\n<\/ol>\n

       <\/p>\n

        \u7a0b\u5e8f\u4f7f\u7528VSC\u8fdb\u884c\u7ba1\u7406\u3002<\/ol>\n

        \u64cd\u4f5c\u6b65\u9aa4<\/h1>\n
          \n
        1. \n
            \u521b\u5efaOIDC\u8eab\u4efd\u63d0\u4f9b\u8005\u3002<\/ol>\n<\/li>\n<\/ol>\n

             <\/p>\n

              \n
            1. \n
                \u521b\u5efaIAM\u89d2\u8272\u3002<\/ol>\n<\/li>\n<\/ol>\n

                 <\/p>\n

                  \u5c06\u521b\u5efa\u7684IAM\u89d2\u8272\u4fe1\u606f\u6ce8\u518c\u5230\u5de5\u4f5c\u7a7a\u95f4\u7684\u53d8\u91cf\u4e2d\u3002<\/ol>\n

                  \u521b\u5efaOIDC\u8eab\u4efd\u63d0\u4f9b\u8005<\/h2>\n

                  \u4eceAWS\u7ba1\u7406\u63a7\u5236\u53f0\u7684IAM > \u8bbf\u95ee\u7ba1\u7406 > ID\u63d0\u4f9b\u7a0b\u5e8f > \u6dfb\u52a0\u63d0\u4f9b\u7a0b\u5e8f\u5904\u8fdb\u884c\u521b\u5efa\u3002<\/p>\n

                  \"image.png\"<\/div>\n

                  \u521b\u5efaIAM\u89d2\u8272<\/h2>\n
                  \"test.png\"<\/div>\n
                  {<\/span>\r\n    \"Version\"<\/span>:<\/span> \"2012-10-17\"<\/span>,<\/span>\r\n    \"Statement\"<\/span>:<\/span> [<\/span>\r\n        {<\/span>\r\n            \"Effect\"<\/span>:<\/span> \"Allow\"<\/span>,<\/span>\r\n            \"Principal\"<\/span>:<\/span> {<\/span>\r\n                \"Federated\"<\/span>:<\/span> \"arn:aws:iam::<\u30a2\u30ab\u30a6\u30f3\u30c8ID>:oidc-provider\/app.terraform.io\"<\/span>\r\n            },<\/span>\r\n            \"Action\"<\/span>:<\/span> \"sts:AssumeRoleWithWebIdentity\"<\/span>,<\/span>\r\n            \"Condition\"<\/span>:<\/span> {<\/span>\r\n                \"StringEquals\"<\/span>:<\/span> {<\/span>\r\n                    \"app.terraform.io:aud\"<\/span>:<\/span> \"aws.workload.identity\"<\/span>,<\/span>\r\n+<\/span>                    \"app.terraform.io:sub\"<\/span>:<\/span> \"organization:urushibata-org:project:urushibata-aws-management:workspace:aws-managed-terraform:run_phase:*\"<\/span>\r\n<\/span>                }<\/span>\r\n            }<\/span>\r\n        }<\/span>\r\n    ]<\/span>\r\n}<\/span>\r\n<\/code><\/pre>\n
                  \u53d8\u91cf\u6ce8\u518c<\/h2>\n
                  \"image.png\"<\/div>\n
                  \u6267\u884c (sh\u00ed<\/h1>\n
                  \"image.png\"<\/div>\n
                  \u672c\u571f\u5f00\u53d1<\/h1>\n
                  Terraform Cloud\u5185\u8d1f\u8d23\u7ba1\u7406state\u6587\u4ef6\u3002\u5728\u672c\u5730\u8fdb\u884c\u5f00\u53d1\u65f6\uff0c\u5e0c\u671b\u80fd\u53c2\u8003\u4e91\u7aef\u7684state\u6587\u4ef6\u8fdb\u884c\u6d4b\u8bd5\u8ba1\u5212\uff0c\u4ee5\u4e0b\u4f1a\u8be6\u7ec6\u63cf\u8ff0\u8fd9\u79cd\u65b9\u6cd5\u3002<\/p>\n
                  \u5728Terraform\u4e2d\u6dfb\u52a0\u7ec4\u7ec7\u548c\u5de5\u4f5c\u7a7a\u95f4\u7684\u540d\u79f0\u5982\u4e0b\u3002<\/p>\n
                  terraform<\/span> {<\/span>\r\n  cloud<\/span> {<\/span>\r\n    organization<\/span> =<\/span> \"urushibata-org\"<\/span>\r\n    workspaces<\/span> {<\/span>\r\n      name<\/span> =<\/span> \"aws-managed-terraform\"<\/span>\r\n    }<\/span>\r\n  }<\/span>\r\n}<\/span>\r\n<\/code><\/pre>\n
                  \u6211\u5c06\u767b\u5f55\u5e76\u5c1d\u8bd5\u6267\u884c\u8ba1\u5212\u3002<\/p>\n
                  $<\/span> terraform login\r\nTerraform will request an API token for app.terraform.io using your browser.\r\n\r\nIf login is successful, Terraform will store the token in plain text in\r\nthe following file for use by subsequent commands:\r\n    \/home\/s-urushibata\/.terraform.d\/credentials.tfrc.json\r\n\r\nDo you want to proceed?\r\n  Only 'yes' will be accepted to confirm.\r\n\r\n  Enter a value: yes\r\n\r\n\r\n---------------------------------------------------------------------------------\r\n\r\nOpen the following URL to access the tokens page for app.terraform.io:\r\n    https:\/\/app.terraform.io\/app\/settings\/tokens?source=terraform-login\r\n\r\n\r\n---------------------------------------------------------------------------------\r\n\r\nGenerate a token using your browser, and copy-paste it into this prompt.\r\n\r\nTerraform will store the token in plain text in the following file\r\nfor use by subsequent commands:\r\n    \/home\/s-urushibata\/.terraform.d\/credentials.tfrc.json\r\n\r\nToken for app.terraform.io:\r\n  Enter a value:\r\n\r\n\r\nRetrieved token for user urush1batalala\r\n\r\n\r\n---------------------------------------------------------------------------------\r\n\r\n                                          -\r\n                                          -----                           -\r\n                                          ---------                      --\r\n                                          ---------  -                -----\r\n                                           ---------  ------        -------\r\n                                             -------  ---------  ----------\r\n                                                ----  ---------- ----------\r\n                                                  --  ---------- ----------\r\n   Welcome to Terraform Cloud!                     -  ---------- -------\r\n                                                      ---  ----- ---\r\n   Documentation: terraform.io\/docs\/cloud             --------   -\r\n                                                      ----------\r\n                                                      ----------\r\n                                                       ---------\r\n                                                           -----\r\n                                                               -\r\n\r\n\r\n   New to TFC? Follow these steps to instantly apply an example configuration:\r\n\r\n<\/span>   $<\/span> git clone https:\/\/github.com\/hashicorp\/tfc-getting-started.git\r\n   $<\/span> cd <\/span>tfc-getting-started\r\n   $<\/span> scripts\/setup.sh\r\n\r\n$<\/span> terraform plan\r\nRunning plan in Terraform Cloud. Output will stream here. Pressing Ctrl-C\r\nwill stop streaming the logs, but will not stop the plan running remotely.\r\n\r\nPreparing the remote plan...\r\n\r\nThe remote workspace is configured to work with configuration at\r\n.\/environment\/mng relative to the target repository.\r\n\r\nTerraform will upload the contents of the following directory,\r\nexcluding files or directories as defined by a .terraformignore file\r\nat \/home\/s-urushibata\/work\/terraform\/aws-managed-terraform\/.terraformignore (if it is present),\r\nin order to capture the filesystem context the remote workspace expects:\r\n    \/home\/s-urushibata\/work\/terraform\/aws-managed-terraform\r\n\r\nTo view this run in a browser, visit:\r\nhttps:\/\/app.terraform.io\/app\/urushibata-org\/aws-managed-terraform\/runs\/run-AXSufPxmKGuezL13\r\n\r\nWaiting for the plan to start...\r\n\r\nTerraform v1.5.3\r\non linux_amd64\r\nInitializing plugins and modules...\r\nmodule.organization.data.aws_iam_policy_document.region_restriction: Refreshing...\r\nmodule.organization.data.aws_iam_policy_document.region_restriction: Refresh complete after 0s [id=1127618634]\r\nmodule.organization.aws_organizations_policy.region_restriction_policy: Refreshing state... [id=p-4kuo19vh]\r\nmodule.organization.aws_organizations_policy.region_restriction_policy: Drift detected (update)\r\n\r\nNo changes. Your infrastructure matches the configuration.\r\n\r\nTerraform has compared your real infrastructure against your configuration and found no differences, so no changes are\r\nneeded.\r\n\r\n------------------------------------------------------------------------\r\n\r\nCost Estimation:\r\n\r\nResources: 0 of 1 estimated\r\n<\/span>           $<\/span>0.0\/mo +$0<\/span>.0\r\n<\/code><\/pre>\n
                  \"image.png\"<\/div>\n
                  \u5982\u679c\u60a8\u5728\u7248\u672c\u63a7\u5236\u7cfb\u7edf(VCS)\u4e2d\u7ba1\u7406\u6e90\u4ee3\u7801\uff0c\u5373\u4f7f\u610f\u5916\u5730\u5728\u672c\u5730\u5e94\u7528\u4e86\u5b83\uff0c\u4e5f\u4f1a\u51fa\u73b0\u9519\u8bef\uff0c\u56e0\u6b64\u53ef\u4ee5\u653e\u5fc3\u3002<\/p>\n
                  $<\/span> terraform apply\r\n\u2577\r\n\u2502 Error: Apply not allowed for workspaces with a VCS connection\r\n\u2502\r\n\u2502 A workspace that is connected to a VCS requires the VCS-driven workflow to ensure that the VCS remains the single\r\n\u2502 source of truth.\r\n\u2575\r\n<\/span><\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
                  \u6211\u5c06\u8bb0\u5f55\u4e0b\u8fde\u63a5\u5230AWS\u5e76\u8fdb\u884c\u7ba1\u7406\u7684\u65b9\u6cd5\uff0c\u4f7f\u7528Terraform Cloud\u3002 \u8bf7\u53c2\u8003   \u524d\u63d0 t\u00ed […]<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-48315","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"yoast_head":"\n\u7528Terraform Cloud\u7ba1\u7406AWS - Blog - Silicon Cloud<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.silicloud.com\/zh\/blog\/\u7528terraform-cloud\u7ba1\u7406aws\/\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u7528Terraform Cloud\u7ba1\u7406AWS\" \/>\n<meta property=\"og:description\" content=\"\u6211\u5c06\u8bb0\u5f55\u4e0b\u8fde\u63a5\u5230AWS\u5e76\u8fdb\u884c\u7ba1\u7406\u7684\u65b9\u6cd5\uff0c\u4f7f\u7528Terraform Cloud\u3002 \u8bf7\u53c2\u8003   \u524d\u63d0 t\u00ed […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.silicloud.com\/zh\/blog\/\u7528terraform-cloud\u7ba1\u7406aws\/\" \/>\n<meta property=\"og:site_name\" content=\"Blog - Silicon Cloud\" \/>\n<meta property=\"article:published_time\" content=\"2023-06-30T22:32:08+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-04-28T22:20:57+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/657d84b7913a08637a6b6fcd\/10-2.png\" \/>\n<meta name=\"author\" content=\"\u65b0, \u97f5\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u65b0, \u97f5\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e7%94%a8terraform-cloud%e7%ae%a1%e7%90%86aws\/\",\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e7%94%a8terraform-cloud%e7%ae%a1%e7%90%86aws\/\",\"name\":\"\u7528Terraform Cloud\u7ba1\u7406AWS - Blog - Silicon Cloud\",\"isPartOf\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#website\"},\"datePublished\":\"2023-06-30T22:32:08+00:00\",\"dateModified\":\"2024-04-28T22:20:57+00:00\",\"author\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/4ba4019495123db3038fd0809e6959c9\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e7%94%a8terraform-cloud%e7%ae%a1%e7%90%86aws\/#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.silicloud.com\/zh\/blog\/%e7%94%a8terraform-cloud%e7%ae%a1%e7%90%86aws\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e7%94%a8terraform-cloud%e7%ae%a1%e7%90%86aws\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.silicloud.com\/zh\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u7528Terraform Cloud\u7ba1\u7406AWS\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#website\",\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/\",\"name\":\"Blog - Silicon Cloud\",\"description\":\"\",\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/4ba4019495123db3038fd0809e6959c9\",\"name\":\"\u65b0, \u97f5\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d484b6c6e4ae82e8a9efea989e1d2af46d9b6ef128101e63b18f559fca0ae627?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d484b6c6e4ae82e8a9efea989e1d2af46d9b6ef128101e63b18f559fca0ae627?s=96&d=mm&r=g\",\"caption\":\"\u65b0, \u97f5\"},\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/author\/yunxin\/\"},{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e7%94%a8terraform-cloud%e7%ae%a1%e7%90%86aws\/#local-main-organization-logo\",\"url\":\"\",\"contentUrl\":\"\",\"caption\":\"Blog - Silicon Cloud\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"\u7528Terraform Cloud\u7ba1\u7406AWS - Blog - Silicon Cloud","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.silicloud.com\/zh\/blog\/\u7528terraform-cloud\u7ba1\u7406aws\/","og_locale":"zh_CN","og_type":"article","og_title":"\u7528Terraform Cloud\u7ba1\u7406AWS","og_description":"\u6211\u5c06\u8bb0\u5f55\u4e0b\u8fde\u63a5\u5230AWS\u5e76\u8fdb\u884c\u7ba1\u7406\u7684\u65b9\u6cd5\uff0c\u4f7f\u7528Terraform Cloud\u3002 \u8bf7\u53c2\u8003   \u524d\u63d0 t\u00ed […]","og_url":"https:\/\/www.silicloud.com\/zh\/blog\/\u7528terraform-cloud\u7ba1\u7406aws\/","og_site_name":"Blog - Silicon Cloud","article_published_time":"2023-06-30T22:32:08+00:00","article_modified_time":"2024-04-28T22:20:57+00:00","og_image":[{"url":"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/657d84b7913a08637a6b6fcd\/10-2.png"}],"author":"\u65b0, \u97f5","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"\u65b0, \u97f5","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"3 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e7%94%a8terraform-cloud%e7%ae%a1%e7%90%86aws\/","url":"https:\/\/www.silicloud.com\/zh\/blog\/%e7%94%a8terraform-cloud%e7%ae%a1%e7%90%86aws\/","name":"\u7528Terraform Cloud\u7ba1\u7406AWS - Blog - Silicon Cloud","isPartOf":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/#website"},"datePublished":"2023-06-30T22:32:08+00:00","dateModified":"2024-04-28T22:20:57+00:00","author":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/4ba4019495123db3038fd0809e6959c9"},"breadcrumb":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e7%94%a8terraform-cloud%e7%ae%a1%e7%90%86aws\/#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.silicloud.com\/zh\/blog\/%e7%94%a8terraform-cloud%e7%ae%a1%e7%90%86aws\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e7%94%a8terraform-cloud%e7%ae%a1%e7%90%86aws\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.silicloud.com\/zh\/blog\/"},{"@type":"ListItem","position":2,"name":"\u7528Terraform Cloud\u7ba1\u7406AWS"}]},{"@type":"WebSite","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#website","url":"https:\/\/www.silicloud.com\/zh\/blog\/","name":"Blog - Silicon Cloud","description":"","inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/4ba4019495123db3038fd0809e6959c9","name":"\u65b0, \u97f5","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d484b6c6e4ae82e8a9efea989e1d2af46d9b6ef128101e63b18f559fca0ae627?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d484b6c6e4ae82e8a9efea989e1d2af46d9b6ef128101e63b18f559fca0ae627?s=96&d=mm&r=g","caption":"\u65b0, \u97f5"},"url":"https:\/\/www.silicloud.com\/zh\/blog\/author\/yunxin\/"},{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e7%94%a8terraform-cloud%e7%ae%a1%e7%90%86aws\/#local-main-organization-logo","url":"","contentUrl":"","caption":"Blog - Silicon Cloud"}]}},"_links":{"self":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/48315","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/comments?post=48315"}],"version-history":[{"count":2,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/48315\/revisions"}],"predecessor-version":[{"id":83569,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/48315\/revisions\/83569"}],"wp:attachment":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/media?parent=48315"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/categories?post=48315"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/tags?post=48315"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}