创建IAM policy example_policy: malformmedpolicydocument错误:策略文档

Question

我正在尝试创建桶策略来授予CloudFront origin access identity (OAI)权限来获取(读取)Amazon S3桶中的所有对象。但我面对这个错误为"一个错误发生:

Error: error creating IAM policy example_policy: MalformedPolicyDocument: Policy document should not specify a principal.
│       status code: 400, request id: 95044f55-e4bf-403e-8233-95964ffe09d1
│
│   with module.iam.aws_iam_policy.s3Frontend,
│   on ..modulesiamresources.tf line 65, in resource "aws_iam_policy" "s3Frontend":
│   65: resource "aws_iam_policy" "s3Frontend" {

data "aws_iam_policy_document" "s3Frontend" {
version = "2012-10-17"
statement {
effect = "Allow"
actions = [
"s3:GetObject",
"s3:ListBucket"
]
principals {
type        = "AWS"
identifiers = ["arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity $MYID"] # 
}
resources = [ "arn:aws:s3:::WebSitefrontend/*" ]  
}
} 
resource "aws_iam_policy" "s3Frontend" {
name   = "example_policy"
path   = "/"
policy = data.aws_iam_policy_document.s3Frontend.json
}
output "s3FrontendId" {
description     = "IDs of frontend deploy artifect on s3"
value           = aws_iam_policy.s3-Frontend.id
} 

谢谢你的帮助。

Answer 1

错误MalformedPolicyDocument: Policy document should not specify a principal是指在resource "aws_iam_policy"中创建的基于IAM身份的策略，不能包含principal。

您正在尝试创建基于S3 Bucket资源的策略，该策略可以在aws_s3_bucket_policy Terraform资源中使用。示例用法:

resource "aws_s3_bucket_policy" "s3Frontend" {
bucket = aws_s3_bucket.WebSitefrontend.id
policy = data.aws_iam_policy_document.s3Frontend.json
}