在Terraform中创建具有不同策略的多个IAM角色

Question

大家好，我是terraform的新手，试图解决一个问题，但却陷入了困境。我想使用输入变量创建多个AWS IAM角色，然后为这些角色分配不同的策略。我正在尝试在for_each循环中执行此操作。然而，我无法解开如何提供不同政策的谜题。我正试图使用映射变量来解决这个问题。这是我的测试代码

terraform {
required_providers {
aws = {
source  = "hashicorp/aws"
}
}
}

provider "aws" {
region = "region"
shared_credentials_file = "path_to_creds"
profile                 = "profile_name"
}
variable "roles" {
type = map
default = {
*   # These bucket names should be different in each policy
"TestRole1"  = "module.s3_bucket_raw.s3_bucket_arn, module.s3_bucket_bronze.s3_bucket_arn"
"TestRole2" = "module.s3_bucket_bronze.s3_bucket_arn, module.s3_bucket_silver.s3_bucket_arn"
}
}
resource "aws_iam_role" "example" {
for_each = var.roles
name    = "${each.key}"
assume_role_policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Action = [
"s3:PutObject",
"s3:GetObject",
"s3:ListBucket",
"s3:GetBucketAcl",
"s3:DeleteObject",
"s3:GetBucketLocation"
]
Effect   = "Allow"
Resource = [
each.value,
"${each.value}/*"
]
}
]
})

}

正如您在策略的Resource块中看到的，bucket名称将是each.value，它将是

module.s3_bucket_raw.s3_bucket_arn, module.s3_bucket_bronze.s3_bucket_arn

这很好，但是我也想做

module.s3_bucket_raw.s3_bucket_arn/*, module.s3_bucket_bronze.s3_bucket_arn/*

这在我的方法中是不可能的，因为当我这样做时${each.value}/*"；这将转化为

module.s3_bucket_raw.s3_bucket_arn, module.s3_bucket_bronze.s3_bucket_arn/*

我希望一些专家能为我抽出几分钟的时间，为此我满怀期待地感谢大家。

Answer 1

如果不能更新变量定义，我会首先更新变量定义以将bucket存储为列表，或者在创建资源之前添加一个本地变量以将变量转换为一个漂亮的对象。使用此变量会更好：

variable "roles" {
type = map
default = {
"TestRole1" = ["module.s3_bucket_raw.s3_bucket_arn", "module.s3_bucket_bronze.s3_bucket_arn"]
"TestRole2" = ["module.s3_bucket_bronze.s3_bucket_arn", "module.s3_bucket_silver.s3_bucket_arn"]
}
}

然后你可以在资源中使用一个for循环，如下所示：

resource "aws_iam_role" "example" {
for_each = var.roles
name    = "${each.key}"
assume_role_policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Action = [
"s3:PutObject",
"s3:GetObject",
"s3:ListBucket",
"s3:GetBucketAcl",
"s3:DeleteObject",
"s3:GetBucketLocation"
]
Effect   = "Allow"
Resource = flatten([for bucket in each.value: [bucket, "${bucket}/*"]]),
}]
}) 
}

对于复杂的策略，我更喜欢aws_iam_policy_document数据源，但我将把它留给您。