创建 IAM 角色时出错.格式错误的策略文档:具有禁止的字段资源.地形

Question

我已经看到了几个链接，但我必须看到一个例子。 我有：

resource "aws_iam_role" "role" {
name = "role"
assume_role_policy = <<-EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1590217939125",
"Action": "s3:*",
"Effect": "Allow",
"Resource": "arn:aws:s3:::wwe"
},
{
"Sid": "Stmt1590217939125",
"Action": "s3:*",
"Effect": "Allow",
"Resource": "arn:aws:s3:::wwe/*"
},
{
"Sid": "Stmt1577967806846",
"Action": [
"secretsmanager:DescribeSecret",
"secretsmanager:GetRandomPassword",
"secretsmanager:GetResourcePolicy",
"secretsmanager:GetSecretValue",
"secretsmanager:ListSecretVersionIds",
"secretsmanager:ListSecrets"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
EOF
tags = {
Name        = wwe
Environment = STAGE
}
}

当我在制作时，

terraform apply

我看到这个：

# aws_iam_role.role will be created
+ resource "aws_iam_role" "role" {
+ arn                   = (known after apply)
+ assume_role_policy    = jsonencode(
{
+ Statement = [
+ {
+ Action   = "s3:*"
+ Effect   = "Allow"
+ Resource = "arn:aws:s3:::wwe"
+ Sid      = "Stmt1590217939125"
},
+ {
+ Action   = "s3:*"
+ Effect   = "Allow"
+ Resource = "arn:aws:s3:::wwe/*"
+ Sid      = "Stmt1590217939125"
},
+ {
+ Action   = [
+ "secretsmanager:DescribeSecret",
+ "secretsmanager:GetRandomPassword",
+ "secretsmanager:GetResourcePolicy",
+ "secretsmanager:GetSecretValue",
+ "secretsmanager:ListSecretVersionIds",
+ "secretsmanager:ListSecrets",
]
+ Effect   = "Allow"
+ Resource = "*"
+ Sid      = "Stmt1577967806846"
},
]
+ Version   = "2012-10-17"
}
)
+ create_date           = (known after apply)
+ force_detach_policies = false
+ id                    = (known after apply)
+ max_session_duration  = 3600
+ name                  = "role"
+ path                  = "/"
+ tags                  = {
+ "Environment" = "STAGE"
+ "Name"        = "wwe"
}
+ unique_id             = (known after apply)
}

之后，当我写yes时，我看到：

Error: Error creating IAM Role role: MalformedPolicyDocument: Has prohibited field Resource
status code: 400

在哪里，我有错误？请不要发布指向相同问题的链接。我不明白，我哪里有错误，你能不能写一个例子，我有错误的地方，如果可能的话。 感谢您的关注。

Answer 1

一个问题是你有两个语句具有相同的 Sid：Stmt1590217939125。

SID 必须是唯一的。从文档中：

在 IAM 中，Sid 值在 JSON 策略中必须是唯一的。

第二个问题是assume_role_policy是针对信托策略的。信任策略没有资源。它们有不同的形式。例如：

assume_role_policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Effect": "Allow",
"Sid": ""
}
]
}

若要将策略添加到角色，必须使用 aws_iam_role_policy_attachment。例如，您可以执行以下操作：

resource "aws_iam_policy" "policy" {
name = "my-role"
description = "My policy"
policy = <<-EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1590217939128",
"Action": "s3:*",
"Effect": "Allow",
"Resource": "arn:aws:s3:::wwe"
},
{
"Sid": "Stmt1590217939125",
"Action": "s3:*",
"Effect": "Allow",
"Resource": "arn:aws:s3:::wwe/*"
},
{
"Sid": "Stmt1577967806846",
"Action": [
"secretsmanager:DescribeSecret",
"secretsmanager:GetRandomPassword",
"secretsmanager:GetResourcePolicy",
"secretsmanager:GetSecretValue",
"secretsmanager:ListSecretVersionIds",
"secretsmanager:ListSecrets"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
EOF
}
resource "aws_iam_role_policy_attachment" "test-attach" {
role       = "${aws_iam_role.role.name}"
policy_arn = "${aws_iam_policy.policy.arn}"
}

Answer 2

现有代码有什么问题？

aws_iam_role资源的assume_role_policy属性不用于向sts：AssumeRole以外的调用 API 授予权限：

assume_role_policy - (必需(授予实体代入角色的权限的策略。

注意：此assume_role_policy与标准 IAM 策略非常相似，但略有不同，并且不能使用aws_iam_policy资源。但是，它可以使用aws_iam_policy_document数据源，请参阅下面的示例，了解其工作原理。

我该如何解决？

因此，假设您希望 EC2 代入此角色，您将使用aws_iam_role来声明 IAM 角色及其assume_role_policy：

resource "aws_iam_role" "role" {
name = "role"
assume_role_policy = <<-EOF
EOF
tags = {
Name        = wwe
Environment = STAGE
}
}

然后使用aws_iam_role_policy将内联策略附加到您希望授予该角色的 IAM 操作(以及资源和可能的条件(：

resource "aws_iam_role_policy" "policy" {
name = "policy"
role = aws_iam_role.role.id
policy = <<-EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "s3:*",
"Effect": "Allow",
"Resource": "arn:aws:s3:::wwe"
},
{
"Action": "s3:*",
"Effect": "Allow",
"Resource": "arn:aws:s3:::wwe/*"
},
{
"Action": [
"secretsmanager:DescribeSecret",
"secretsmanager:GetRandomPassword",
"secretsmanager:GetResourcePolicy",
"secretsmanager:GetSecretValue",
"secretsmanager:ListSecretVersionIds",
"secretsmanager:ListSecrets"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
EOF
}

您无需将 JSON 放在边距上，可以缩进以提高可读性：

Terraform 还接受由 <<- 序列引入的缩进 heredoc 字符串变体：

block {
value = <<-EOT
hello
world
EOT
}

我建议使用aws_iam_policy_document数据源来构建您的 IAM 策略。它避免了JSON的烦人怪癖(如没有尾随逗号(，并更好地支持需要在构建策略时使用变量的情况(在所有情况下都很难正确转义它们(：

resource "aws_iam_role_policy" "policy" {
name = "policy"
policy = data.aws_iam_policy_document.policy_doc.json
}
data "aws_iam_policy_document" "policy_doc" {
statement {
actions = [
"s3:*",
]
resources = [
"arn:aws:s3:::wwe",
]
}
statement {
actions = [
"s3:*",
]
resources = [
"arn:aws:s3:::wwe/*",
]
}
statement {
actions = [
"secretsmanager:DescribeSecret",
"secretsmanager:GetRandomPassword",
"secretsmanager:GetResourcePolicy",
"secretsmanager:GetSecretValue",
"secretsmanager:ListSecretVersionIds",
"secretsmanager:ListSecrets",
]
resources = [
"*",
]
}
}