Terraform：创建 IAM 角色时出错。 MalformedPolicyDocument：已禁止字段资源

Question

我的 TF 代码给了我一个错误：

  /*
   * Policy: AmazonEC2ReadOnlyAccess
   */
  assume_role_policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ec2:Describe*",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "elasticloadbalancing:Describe*",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "cloudwatch:ListMetrics",
                "cloudwatch:GetMetricStatistics",
                "cloudwatch:Describe*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "autoscaling:Describe*",
            "Resource": "*"
        }
    ]
}
EOF

我从https://console.aws.amazon.com/iam/home?region=us-west-2#/policies/arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess $jsonEditor 复制并粘贴了策略

* aws_iam_role.<role name>: Error creating IAM Role <role name>: MalformedPolicyDocument: Has prohibited field Resource
status code: 400, request id: <request id>

不知道为什么它说资源被禁止。

Answer 1

• 需要使用sts:AssumeRole assume_role_policy假设角色策略（谁可以担任此角色，例如：EC2 服务）。

• 可以使用aws_iam_role_policy_attachment直接附加策略，而不是复制现有策略。

   resource "aws_iam_role" "ec2_iam_role" { name = "ec2_iam_role" assume_role_policy = <<EOF { "Version": "2012-10-17", "Statement": [ { "Sid": "", "Effect": "Allow", "Principal": { "Service": [ "ec2.amazonaws.com" ] }, "Action": "sts:AssumeRole" } ] } EOF } resource "aws_iam_role_policy_attachment" "ec2-read-only-policy-attachment" { role = "${aws_iam_role.ec2_iam_role.name}" policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess" }

Answer 2

我在使用角色 arn 时遇到了类似的问题。 当我尝试使用aws_iam_role_policy_attachment - 我收到错误，因为角色名称包含不受支持的字符。

对我有用的创建aws_iam_role_policy如下：

resource "aws_iam_role_policy" "api-invoker" {
    provider = <some provider>
    role     = aws_iam_role.api-invoker.id
    policy   = data.aws_iam_policy_document.execute-api.json
}

data "aws_iam_policy_document" "execute-api" {
    statement {
     sid = "all"
     actions = [
       "execute-api:*",
     ]
     resources = [
       "*"
     ]
   }
}

Answer 3

在创建策略以从另一个 AWS 账户担任角色时，我遇到了同样的问题。 因此，我在受信任的实体中添加了另一个 AWS 账户 ID，然后问题就解决了。

Answer 4

 #create i am user for account-1
resource "aws_iam_user" "user-1" {
  name = "my-user"
  tags = {
    "Name" = "my-user"
  }
}

# create policy for 2nd account
resource "aws_iam_policy" "prod_s3" {
  provider    = aws.aws02
  name        = "prod_s3"
  description = "allow assuming prod_s3 role"
  policy = jsonencode({
    Version = "2012-10-17",
    Statement = [
      {
        Effect   = "Allow",
        Action   = "sts:AssumeRole",
        Resource = "arn:aws:iam::940883708906:user/my-user"
    }]
  })
}
# Attach the policy
resource "aws_iam_user_policy_attachment" "prod_s3" {
  provider   = aws.aws02
  user       = aws_iam_user.user-1.name
  policy_arn = aws_iam_policy.prod_s3.arn
}
# create assume role
resource "aws_iam_role" "prod_list_s3" {
  provider = aws.aws02
  name     = "role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17",
    Statement = [
      {
        Effect    = "Allow",
        Action    = "sts:AssumeRole",
        Principal = { "AWS" : "arn:aws:iam::${data.aws_caller_identity.utils.account_id}:root" }
    }]
  })
}
# output arn
output "role-arn" {
  value = aws_iam_role.prod_list_s3.arn

}
# create caller identity
data "aws_caller_identity" "utils" {
  provider = aws.aws02
}
# create s3 full access for 2nd account and attach the file
resource "aws_iam_policy" "s3_all" {
  provider    = aws.aws02
  name        = "s3_all"
  description = "allows listing all s3 buckets"
  policy      = file("role_permissions_policy.json")
}
# inside the file 
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": "*"
        }
    ]
}
**strong text**
# Attach the assume role
resource "aws_iam_policy_attachment" "s3-all-att" {
  name       = "list s3 buckets policy to role"
  roles      = ["${aws_iam_role.prod_list_s3.name}"]
  policy_arn = aws_iam_policy.s3_all.arn
  provider   = aws.aws02