Amazon SNS(Terraform)无效参数:策略语句操作超出服务范围

Question

我想创建一个IAM策略文档，并在策略中附加两个从雪花错误集成中获得的值作为受信任关系。遵循本教程步骤5。

其想法是添加从创建的SF_AWS_IAM_USER_ARN和SF_AWS_EXTERNAL_ID雪花通知整合到政策中。

已成功创建集成。

这是我代码的一部分：

resource "random_id" "random" {
byte_length = 8
}
resource "aws_sns_topic" "my_sns_topic" {
name = "${var.bucket_name}-errors-${random_id.random.id}"
}
data "aws_iam_policy_document" "snowflake_notification_error" {
version = "2008-10-17"
statement {
sid = "__default_statement_ID"
actions = [
"SNS:GetTopicAttributes",
"SNS:SetTopicAttributes",
"SNS:AddPermission",
"SNS:RemovePermission",
"SNS:DeleteTopic",
"SNS:Subscribe",
"SNS:ListSubscriptionsByTopic",
"SNS:Publish",
"SNS:Receive",
]
principals {
type        = "AWS"
identifiers = ["*"]
}
resources = [aws_sns_topic.my_sns_topic.arn]
condition {
test     = "StringEquals"
variable = "AWS:SourceOwner"
values   = [data.aws_caller_identity.current.account_id]
}
}
statement {
sid = "allow_s3_notification"
principals {
type        = "Service"
identifiers = ["s3.amazonaws.com"]
}
actions   = ["SNS:Publish"]
resources = [aws_sns_topic.my_sns_topic.arn]
condition {
test     = "ArnLike"
variable = "aws:SourceArn"
values   = [data.aws_s3_bucket.bucket.arn]
}
}
statement {
sid = "allow_snowflake_subscription"
principals {
type        = "AWS"
identifiers = [snowflake_storage_integration.integration.storage_aws_iam_user_arn]
}
actions   = ["SNS:Subscribe"]
resources = [aws_sns_topic.my_sns_topic.arn]
}
# Error starts in this block I believe
# The json file looks like in the tutorial shown.
statement {
sid = "allow_error_integration"
principals {
type        = "AWS"
identifiers = [snowflake_notification_integration.error_integration.aws_sns_iam_user_arn]
}
actions = ["sts:AssumeRole"]
condition {
test     = "StringEquals"
variable = "sts:ExternalId"
values   = [snowflake_notification_integration.error_integration.aws_sns_external_id]
}
resources = [aws_sns_topic.my_sns_topic.arn]
}
}
# ERROR HERE
resource "aws_sns_topic_policy" "snowflake_s3_pipe_notification_error" {
arn    = aws_sns_topic.my_sns_topic.arn
policy = data.aws_iam_policy_document.snowflake_notification_error.json
}

错误为：

错误：InvalidParameter:无效参数：策略语句操作超出服务范围！状态代码：400，请求id:5c75a285-294b-56b7-ad4d-f915d5e0b01b

带有模块.datalake_dev["我的雪管"].module.s3_integration.aws_sns_topic_policy.snowlake_notification_error，位于/snowflake/s3_integration/s3_integration/error_integration.tf第79行；aws_sns_topic_policy"quot；雪花_通知_错误"：79：资源"；aws_sns_topic_policy"quot；雪花_通知_错误"；｛

Answer 1

策略语句中不允许出现操作"SNS:Receive"。AWS文档中列出了所有允许的操作https://docs.aws.amazon.com/sns/latest/dg/sns-access-policy-language-api-permissions-reference.html#sns-有效策略操作