Terraform IAM 策略创建 - MalformedPolicyDocument：策略遗留解析失败

Question

我有假设创建 IAM 策略的Terraform代码（如下）。 但是，在terraform apply上，我收到错误：

Error: creating IAM Policy autoscale-policy: MalformedPolicyDocument: The policy failed legacy parsing

Terraform 代码：

terraform {
    required_providers {
        aws = {
            source  = "hashicorp/aws"
            version = "~> 4.52.0"
        }
    }
}

provider "aws" {
    region = "us-west-2"
}

resource "aws_iam_policy" "autoscale_policy" {
    name        = "autoscale-policy"
    description = "EBS Autoscaling Policy"
    policy = <<EOT
{
    "Version": "2012-10-17",
    "Statement": {
        "Action": [
            "ec2:AttachVolume",
            "ec2:DescribeVolumeStatus",
            "ec2:DescribeVolumes",
            "ec2:ModifyInstanceAttribute",
            "ec2:DescribeVolumeAttribute",
            "ec2:CreateVolume",
            "ec2:DeleteVolume",
            "ec2:CreateTags",
            "kms:Decrypt",
            "kms:CreateGrant",
            "kms:Encrypt",
            "kms:ReEncrypt*",
            "kms:GenerateDataKey*",
            "kms:DescribeKey"
        ],
        "Resource": "*",
        "Effect": "Allow"
    }
}
EOT
}

但是，当我使用具有完全相同策略的 AWS cli 时，该策略是在 AWS 中创建的，没有问题：

    --policy-name TestPolicy \
    --policy-document \
'{
  "Version": "2012-10-17",
  "Statement": {
    "Action": [
        "ec2:AttachVolume",
        "ec2:DescribeVolumeStatus",
        "ec2:DescribeVolumes",
        "ec2:ModifyInstanceAttribute",
        "ec2:DescribeVolumeAttribute",
        "ec2:CreateVolume",
        "ec2:DeleteVolume",
        "ec2:CreateTags",
        "kms:Decrypt",
        "kms:CreateGrant",
        "kms:Encrypt",
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*",
        "kms:DescribeKey"
    ],
    "Resource": "*",
    "Effect": "Allow"
  }
}'

有没有人看到 TF 代码和 CLI 命令之间可能存在差异的地方？ 当策略在 cli 中运行良好时，我的 TF 代码为何会返回MalformedPolicyDocument错误？

Answer 1

语句应该是一个数组。

resource "aws_iam_policy" "autoscale_policy" {
  name        = "autoscale-policy"
  description = "EBS Autoscaling Policy"
  policy      = <<EOT
{
    "Version": "2012-10-17",
    "Statement": [{
        "Action": [
            "ec2:AttachVolume",
            "ec2:DescribeVolumeStatus",
            "ec2:DescribeVolumes",
            "ec2:ModifyInstanceAttribute",
            "ec2:DescribeVolumeAttribute",
            "ec2:CreateVolume",
            "ec2:DeleteVolume",
            "ec2:CreateTags",
            "kms:Decrypt",
            "kms:CreateGrant",
            "kms:Encrypt",
            "kms:ReEncrypt*",
            "kms:GenerateDataKey*",
            "kms:DescribeKey"
        ],
        "Resource": "*",
        "Effect": "Allow"
    }]
}
EOT
}

测试它有效

或者您可以使用data资源来定义您的策略。

resource "aws_iam_policy" "autoscale_policy" {
  name        = "autoscale-policy"
  description = "EBS Autoscaling Policy"
  policy      = data.aws_iam_policy_document.example.json
}

data "aws_iam_policy_document" "example" {
  statement {
    actions = [
      "ec2:AttachVolume",
      "ec2:DescribeVolumeStatus",
      "ec2:DescribeVolumes",
      "ec2:ModifyInstanceAttribute",
      "ec2:DescribeVolumeAttribute",
      "ec2:CreateVolume",
      "ec2:DeleteVolume",
      "ec2:CreateTags",
      "kms:Decrypt",
      "kms:CreateGrant",
      "kms:Encrypt",
      "kms:ReEncrypt*",
      "kms:GenerateDataKey*",
      "kms:DescribeKey"
    ]
    resources = ["*"]
    effect    = "Allow"
  }
}