{客户端错误}调用 RunJobFlow 操作时发生错误(验证异常):无效的实例配置文件

Question

我使用 Terraform 部署了一个要在 EMR 中使用的 IAM 角色：

data "aws_iam_policy_document" "emr_assume_role" {
statement {
sid     = "EMRAssume"
effect  = "Allow"
actions = ["sts:AssumeRole"]
principals {
type = "Service"
identifiers = [
"elasticmapreduce.amazonaws.com"
]
}
}
}
resource "aws_iam_role" "my_emr_ec2_instance_role" {
name               = "my_emr_ec2_instance_role"
assume_role_policy = data.aws_iam_policy_document.emr_assume_role.json
}
resource "aws_iam_policy" "emr_ec2_instances_policy" {
name    = "emr_ec2_instances_policy"
policy  = file("${path.module}/my/path/my_emr_instance_role_policy.json")
}
resource "aws_iam_role_policy_attachment" "policy_attachment" {
role       = aws_iam_role.my_emr_ec2_instance_role.name
policy_arn = aws_iam_policy.emr_ec2_instances_policy.arn
}

然后当我尝试从 boto3 运行run_job_flow()方法时，如下所示：

client.run_job_flow(
Name="EMR",
LogUri=logs_uri,
ReleaseLabel='emr-6.2.0',
Instances=instances,
VisibleToAllUsers=True,
Steps=steps,
BootstrapActions=ba,
Applications=[{'Name': 'Spark'}],
ServiceRole='my_service_role_emr',
JobFlowRole='my_emr_ec2_instance_role',
Tags=tags)

但我立即收到以下错误消息：

{ClientError}An error occurred (ValidationException) when calling the RunJobFlow operation: Invalid InstanceProfile my_emr_ec2_instance_role

如何解决？

Answer 1

我正在分享我的经验，希望帮助其他人，如果不同，请分享你的。

在我的情况下，第一个错误是identifiers字段，它应该"ec2.amazonaws.com"作为值，所以aws_iam_policy_document块将得到：

data "aws_iam_policy_document" "emr_assume_role" {
statement {
sid     = "EMRAssume"
effect  = "Allow"
actions = ["sts:AssumeRole"]
principals {
type = "Service"
identifiers = [
"ec2.amazonaws.com"
]
}
}
}

另一个问题是与如果角色是从 AWS 控制台生成的，但 Terraform 不会自动提供角色，则会自动创建的Instance Profile。所以在Terraform中，这个代码块应该可以解决这个问题：

resource "aws_iam_instance_profile" "emr_ec2_instance_profile" {
name = aws_iam_role.my_emr_ec2_instance_role.name
role = aws_iam_role.my_emr_ec2_instance_role.name
}