IAM 实例配置文件名称无效

Question

我正在创建一个 Terraform 脚本，该脚本创建一个 IAM 角色，由 EC2 实例通过启动模板承担。 我有一个简单的 lambda function (boto3/python)，它使用启动模板创建/启动 EC2 实例。 但是，当我运行 lambda function 时出现此错误：

"errorMessage": "An error occurred (InvalidParameterValue) when calling the RunInstances operation:
Value (arn:aws:iam::xxx:instance-profile/RigstopgapInstanceProfile) for parameter iamInstanceProfile.name is invalid. Invalid IAM Instance Profile name",
  "errorType": "ClientError",

我的 terraform 代码是这个：

resource "aws_launch_template" "rig_stopgap" {
  name          = "rig_stopgap"
  image_id      = var.ami_image
  instance_type = var.instance_type

  iam_instance_profile {
    name = aws_iam_instance_profile.rig_stopgap.arn
  }
  ...
}

resource "aws_iam_instance_profile" "rig_stopgap" {
  name = "RigstopgapInstanceProfile"
  role = aws_iam_role.rigs_stopgap_ec2.name
}

# EC2 "Trust relationships" policy (necessary to allow the instance to assume a role)
data "aws_iam_policy_document" "trust_relationships_ec2_policy" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

# EC2 main policy
resource "aws_iam_policy" "rigs_stopgap_ec2_policy" {
  name        = "RigsStopgapPolicy"
  description = "Rigs Stopgap Policy allowing access to all of the necessary resources"

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "dynamodb:UpdateItem"
      ],
      "Effect": "Allow",
      "Resource": "${aws_dynamodb_table.rigs_stopgap.arn}"
    }
  ]
}
EOF
}

# Attach the ec2 policy 
resource "aws_iam_role_policy_attachment" "attach_ec2_instance_policy" {
  role       = aws_iam_role.rigs_stopgap_ec2.name
  policy_arn = aws_iam_policy.rigs_stopgap_ec2_policy.arn
}

resource "aws_iam_role" "rigs_stopgap_ec2" {
  name               = "RigsStopgapRole"
  assume_role_policy = data.aws_iam_policy_document.trust_relationships_ec2_policy.json
  tags               = var.common_tags
}

我的 Lambda 代码：

import boto3

ec2 = boto3.resource('ec2')
lt = {
    'LaunchTemplateName': 'rig_stopgap',
    'Version': '$Latest'
}


def handler(event, context):

    instances = ec2.create_instances(
        LaunchTemplate=lt,
        MinCount=1,
        MaxCount=1
    )

我错过了什么？

更新：当我在 AWS 控制台中打开启动模板并导航到实例配置文件部分时，它显然找不到它：

Answer 1

我对 Terraform 不熟悉，但看起来您只是在想要一个名称时提供了一个 ARN：

  iam_instance_profile {
    name = aws_iam_instance_profile.rig_stopgap.arn
  }

尝试仅提供角色名称，而不是提供 ARN。

Answer 2

在您的aws_launch_template中， iam_instance_profile应该有arn而不是name ：

 iam_instance_profile {
    arn = aws_iam_instance_profile.rig_stopgap.arn
  }