更新：iam_policy_document：错误：无效参数：无效参数：策略错误：null 状态代码：400，请求 ID

Question

所以我正在尝试迁移一个由模块组成的非模块化 Terraform 设置。 我遇到了这个错误。 我知道这不是 terraform 特定错误，但 Terraform 是我正在使用的错误。

实现这一目标所需的所有模块的整体结构包括：

%ls

caller_identity     event_rule  event_target    iam_policy_document sns_topic_policy

在 caller_dentity 中：

ls
main.tf     output.tf   variable.tf

在事件规则中：

main.tf     output.tf   variable.tf

在事件目标中：

main.tf     variable.tf  (i did not seem to need to have an output to be used somewhere else.)

在 iam_policy_document 中：

ls% main.tf     output.tf   variable.tf


data "aws_iam_policy_document" "this" {
  statement {
     actions  = [
      "SNS:GetTopicAttributes",
      "SNS:SetTopicAttributes",
      "SNS:AddPermission",
      "SNS:RemovePermission",
      "SNS:DeleteTopic",
      "SNS:Subscribe",
      "SNS:ListSubscriptionsByTopic",
      "SNS:Publish",
      "SNS:Receive"
    ]

    condition {
       test      = "StringEquals"
      variable = "AWS:SourceOwner"

      values = [
      var.account
      ]
    }

    effect = "Allow"

    principals {
       type         = "AWS"
      identifiers = ["*"]
    }

    resources = [
      var.arn
    ]

    sid = "__default_statement_ID"
  }

  statement {
     actions  = [
      "sns:Publish"
    ]

    effect = "Allow"

    principals {
       type         = "Service"
      identifiers = ["events.amazonaws.com"]
    }

    resources = [
      var.arn
    ]

    sid = "TrustCWEToPublishEventsToMyTopic"
  }
}

在 sns_topic_policy 中：

main.tf     output.tf   variable.tf

resource "aws_sns_topic_policy" "this" {
   arn = var.arn 
   policy = var.policy
}

我开始按照发布的顺序重做所有这些，而不是像我 go 那样进行测试。说完一切后，有 4 个项目 terraform 需要构建； 我知道肯定是因为非模块版本是我的基础

所以一切似乎都正常，直到我进入 aws_sns_topic_policy。

这是如果我敲出 sns_topic

        }
    }

Plan: 3 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: 

我点击“是”，它完成后给出了下面所述的 output。

现在，一旦我添加了 sns 模块，它就会在某处失控。

我的输出：

Apply complete! Resources: 0 added, 0 changed, 0 destroyed.

Outputs:

caller_identity_out = 012345678910
cloudwatch_event_rule_out = Detect-Local-User-Creations
iam_policy_document_out = {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "__default_statement_ID",
      "Effect": "Allow",
      "Action": [
        "SNS:Subscribe",
        "SNS:SetTopicAttributes",
        "SNS:RemovePermission",
        "SNS:Receive",
        "SNS:Publish",
        "SNS:ListSubscriptionsByTopic",
        "SNS:GetTopicAttributes",
        "SNS:DeleteTopic",
        "SNS:AddPermission"
      ],
      "Resource": "arn:aws:sns:us-east-1:012345678910:tf-SnsTopic-EmailSNSTopic-9JJZS66CE1CW",
      "Principal": {
        "AWS": "*"
      },
      "Condition": {
        "StringEquals": {
          "AWS:SourceOwner": "012345678910"
        }
      }
    },
    {
      "Sid": "TrustCWEToPublishEventsToMyTopic",
      "Effect": "Allow",
      "Action": "sns:Publish",
      "Resource": "arn:aws:sns:us-east-1:012345678910:tf-SnsTopic-EmailSNSTopic-9JJZS66CE1CW",
      "Principal": {
        "Service": "events.amazonaws.com"
      }
    }
  ]
}

根据我所看到的，我不知道它指的是什么。 我得到这个错误到 go 的唯一方法是使用 jsonencode。 然而，这是下一个错误发生的地方

iam_policy_document: Error: InvalidParameter: Invalid parameter: Policy Error: null status code: 400,

output.tf文件

output "iam_policy_document_out" {
  value = data.aws_iam_policy_document.this.json
}

有人提到不需要 jsonencode，如果我把它拿出来，就会发生这种情况。

当我更改 #policy = jsonencode("module.aws_iam_policy_document.iam_policy_document_out") 时收到错误

政策=“module.aws_iam_policy_document.iam_policy_document_out”

错误：：

dLocalUsers]
module.iam_policy_document.data.aws_iam_policy_document.this: Refreshing state...

Error: "policy" contains an invalid JSON: invalid character 'm' looking for beginning of value

  on ../../../modules/cloudwatch/sns_topic_policy/main.tf line 3, in resource "aws_sns_topic_policy" "this":
   3:    policy = var.policy

最新的事情是当我从答案中实施“替代方案”时。 我收到此错误，但我没有发现问题。 我不明白这是什么错误。 我有 output 工作，它在 sns_topic 中声明..所以要么我错过了明显的，我不知道......

Error: Reference to undeclared module

  on main.tf line 43, in module "sns_topic_policy":
  43:   policy = module.aws_iam_policy_document.iam_policy_document_out.json

No module call named "aws_iam_policy_document" is declared in the root module.

Answer 1

您的iam_policy_document_out已经是json形式：

value = data.aws_iam_policy_document.this.json

因此，在模块中，应使用以下内容：

module "sns_topic_policy" {
  source = "./sns_topic_policy/"
  arn    = module.SnsTopic.arn
  policy = module.aws_iam_policy_document.iam_policy_document_out
}

仍然可能存在其他问题，这些问题在您部署代码之前并不明显。

备选方案：

output "iam_policy_document_out" {
  value = data.aws_iam_policy_document.this
}

module "sns_topic_policy" {
  source = "./sns_topic_policy/"
  arn    = module.SnsTopic.arn
  policy = module.aws_iam_policy_document.iam_policy_document_out.json
}