I am trying to create AWS SFTP server using terraform script.
I am able to validate using terraform validate command and able to get plan using terraform plan as well
but I am getting below error while trying to run terraform apply command
Error: Error creating Transfer Server: InvalidRequestException: Must specify IdentityProviderType with IdentityProviderDetails on .terraform/modules/sftp/sftp.tf line 1, in resource "aws_transfer_server" "sftp": 1: resource "aws_transfer_server" "sftp" {
I have provided the identity_provider_type = "SERVICE_MANAGED" in my script but still i am getting the error and unable to create AWS SFTP server.
Here is my scripts
sftp.tf
provider "aws" {
version = "~> 2.0"
region = "us-east-1"
}
resource "aws_transfer_server" "sftp" {
identity_provider_type = "SERVICE_MANAGED"
invocation_role = "arn:aws:iam::<id>"
tags = {
NAME = "test-sftp"
}
}
main.tf
provider "aws" {
version = "~> 2.0"
region = "us-east-1"
}
module "sftp" {
source = "/home/sasi/TerraForm/terraform-scripts/modules/sftp"
aws-transfer-server-name = "test-sftp"
iam-role-name-for-sftp = "test-sftp-role"
s3-access-policy-name = "s3-specific-bucket-access"
sftp-user-name = "sasi-sftp"
sftp-s3-bucket-name = "/sasi-learn-test-bucket"
ssh-public-key-file-location = "${file("/home/sasi/TerraForm/terraform-scripts/modules/sftp/rsa.pub")}"
}
It seems that you don't need the invocation_role when identity_provider_type is SERVICE_MANAGED. Here's the information from the Terraform transfer server resource page:
invocation_role - (Optional) Amazon Resource Name (ARN) of the IAM role used to authenticate the user account with an identity_provider_type of API_GATEWAY.
Since your identity_provider_type is not API_GATEWAY, you can probably try without providing the invocation_role.