Terraform中的实例配置文件资源是否可以具有多个内联策略

Question

我正在尝试将Cloud Formation脚本转换为Terraform。我在剧本中遇到的一个问题云层形成：

"Resources": {
"*******InstanceProfile": {
"Condition": "IsInstanceProfile",
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
},
"Policies": [
{
"PolicyName": "********-*******-instance",
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Resource": [
{
"Fn::Sub": "arn:aws:iam::*:role/${ReadOnlyRole}"
},
{
"Fn::Sub": "arn:aws:iam::${AWSOrganizationsAccountID}:role/${OrganizationsRole}"
}
]
}
]
}
}
],
"RoleName": {
"Ref": "AccessName"
}
}
}

我假设我可以在类似aws_iam_role的资源中使用inline_policy。这是我制作的Terraform片段，但出现了错误：

resource "aws_iam_role" "*****_instance_profile" {

assume_role_policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Action = "sts:AssumeRole"
Effect = "Allow"
Sid    = ""
Principal = {
Service = "ec2.amazonaws.com"
}
},
]
})

policy = jsonencode({
Version = "2012-10-17"
Statement = [
Action   = ["sts:AssumeRole"]
Effect   = "Allow"
Resource = "arn:aws:iam::*:role/${ReadOnlyRole"

]
})
}

我想我一直在策略中添加资源。有人会如何处理这种转换？你们认为我用aws_iam_role走上了正确的道路吗？如果是这样，您将如何处理inline_policy中的多个资源？

Answer 1

在向策略添加多个资源时，我只会使用官方文档。

data "aws_iam_policy_document" "example" {
statement {
actions = [
"s3:ListAllMyBuckets",
"s3:GetBucketLocation",
]
resources = [
"arn:aws:s3:::*",
]
}
statement {
actions = [
"s3:*",
]
resources = [
"arn:aws:s3:::${var.s3_bucket_name}/home/&{aws:username}",
"arn:aws:s3:::${var.s3_bucket_name}/home/&{aws:username}/*",
]
}
}
resource "aws_iam_user" "user" {
name = "test-user"
}
resource "aws_iam_policy" "policy" {
name        = "test-policy"
description = "A test policy"
policy      = data.aws_iam_policy_document.example.json
}
resource "aws_iam_user_policy_attachment" "test-attach" {
user       = aws_iam_user.user.name
policy_arn = aws_iam_policy.policy.arn
}