IAM中子网的Terraform Arn ID

Question

我正在尝试使用Terraform创建自定义IAM角色：

resource "aws_iam_role" "prod_role" {
  name = "test_role"
  assume_role_policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:Describe*",
                "ec2:GetConsole*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "ec2:RunInstances",
            "Resource": [
                "arn:aws:ec2:${var.aws_region}:*:subnet/${aws_subnet.prod1.id}",
                "arn:aws:ec2:${var.aws_region}:*:subnet/${aws_subnet.prod2.id}",
                "arn:aws:ec2:${var.aws_region}:*:network-interface/*",
                "arn:aws:ec2:${var.aws_region}:*:instance/*",
                "arn:aws:ec2:${var.aws_region}:*:volume/*",
                "arn:aws:ec2:${var.aws_region}::image/ami-*",
                "arn:aws:ec2:${var.aws_region}:*:key-pair/*",
                "arn:aws:ec2:${var.aws_region}:*:security-group/*"
            ]
        }
    ]
}
EOF
}

我的问题是，将子网ID引入策略是错误的。我的arn looke这样：

arn:aws:ec2:us-east-1:*:subnet/subnet-0bbg694edda209ab9

，应该像这样：

arn:aws:ec2:us-east-1:*:subnet/0bbg694edda209ab9

我如何仅获得子网(无子网(的ID供IAM使用？

Answer 1

这可能不是最佳解决方案，但是您可以利用Terraform的replace插值语法。用""替换"subnet-"。结果看起来像

arn:aws:ec2:${var.aws_region}:*:subnet/${replace(aws_subnet.prod1.id, "subnet-", "")}