从terraform调用SSM文档

Question

我想知道是否有人可以帮助解决这个问题?我试图使用terraform调用SSM文档来停止ec2实例。但是，它似乎不起作用。我一直有错误:

Automation Step Execution fails when it is changing the state of each instance. Get Exception from StopInstances API of ec2 Service. Exception Message from StopInstances API: [You are not authorized to perform this operation. 

有什么建议吗?

正如您所看到的，有正确的角色。我把它传入参数

provider "aws" {
profile = "profile"
region  = "eu-west-1"
}

data "aws_ssm_document" "stop_ec2_doc" {
name            = "AWS-StopEC2Instance"
document_format = "JSON"
}

data "aws_iam_policy_document" "assume_role" {
version = "2012-10-17"
statement {
sid     = "EC2AssumeRole"
effect  = "Allow"
actions = ["sts:AssumeRole"]
principals {
identifiers = ["ec2.amazonaws.com"]
type        = "Service"
}
principals {
identifiers = ["ssm.amazonaws.com"]
type        = "Service"
}
}
}
data "aws_ami" "latest_amazon_2" {
most_recent = true
owners      = ["amazon"]
name_regex = "^amzn2-ami-hvm-.*x86_64-gp2"
}

#
resource "aws_iam_role" "iam_assume_role" {
name                 = "iam_assume_role"
assume_role_policy   = data.aws_iam_policy_document.assume_role.json
}
# 
resource "aws_iam_role_policy_attachment" "role_1" {
role       = aws_iam_role.iam_assume_role.name
policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
}
# the instance profile
resource "aws_iam_instance_profile" "iam_instance_profile" {
name = "iam_instance_profile"
role = aws_iam_role.iam_assume_role.name
}
# amazon ec2 instances
resource "aws_instance" "ec2_instances" {
count                = 2
ami                  = data.aws_ami.latest_amazon_2.id
instance_type        = "t2.micro"
subnet_id            = "subnet-12345678901"
iam_instance_profile = aws_iam_instance_profile.iam_instance_profile.name
root_block_device {
volume_size = 8
volume_type = "gp2"
delete_on_termination = true
}
}

resource "aws_ssm_association" "example" {
name = data.aws_ssm_document.stop_ec2_doc.name

parameters = {
AutomationAssumeRole = "arn:aws:iam::12345678901:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM"
InstanceId = aws_instance.ec2_instances[0].id
}
}

欢迎提出任何建议。我尝试创建一个简单的Terraform代码来说明我要做的事情。对我来说应该是直截了当的。我创建这个角色。我创建实例概要文件。我通过适当的角色和实例id创建关联。

Answer 1

AWSServiceRoleForAmazonSSM角色没有停止实例的权限。相反，您应该为SSM创建新角色。有这样的权限。最简单的方法如下:

resource "aws_iam_role" "ssm_role" {
name = "ssm_role"
assume_role_policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Action = "sts:AssumeRole"
Effect = "Allow"
Sid    = ""
Principal = {
Service = "ssm.amazonaws.com"
}
},
]
})
}
resource "aws_iam_role_policy_attachment" "ec2-attach" {
role       = aws_iam_role.ssm_role.name
policy_arn = "arn:aws:iam::aws:policy/AmazonEC2FullAccess"
}
resource "aws_ssm_association" "example" {
name = data.aws_ssm_document.stop_ec2_doc.name

parameters = {
AutomationAssumeRole = aws_iam_role.ssm_role.arn
InstanceId = aws_instance.ec2_instances[0].id
}
}

AmazonEC2FullAccess对于停止实例来说太宽松了，但是我用它作为一个工作示例。