如何使用 terraform 在 aws 中配置 IAM 角色？

Question

由于我是 terraform 的新手，所以一旦我卡住了将近一天，我想请你帮忙。

当尝试应用 IAC 将 Nginx 服务部署到 AWS 上的 ECS（EC2 启动类型）时，我遇到了以下问题：

Error: Error creating IAM Role nginx-iam_role: MalformedPolicyDocument: Has prohibited field Resource status code: 400, request id: 0f1696f4-d86b-4ad1-ba3b-9453f3beff2b

我已经检查了文档并且语法很好。还有什么问题？

按照 sn-p 代码创建 IAM 基础设施：

provider "aws" {
    region = "us-east-2"
}


data "aws_iam_policy_document" "nginx-doc-policy" {
  statement {
    sid = "1"

    actions = [
      "ec2:*"
    ]
    resources = ["*"]
  }
}

resource "aws_iam_role" "nginx-iam_role" {
  name               = "nginx-iam_role"
  path               = "/"
  assume_role_policy = "${data.aws_iam_policy_document.nginx-doc-policy.json}"
}

resource "aws_iam_group_policy" "nginx-group-policy" {
  name  = "my_developer_policy"
  group = "${aws_iam_group.nginx-iam-group.name}"
  policy = "${data.aws_iam_policy_document.nginx-doc-policy.json}"
}

resource "aws_iam_group" "nginx-iam-group" {
  name = "nginx-iam-group"
  path = "/"
}


resource "aws_iam_user" "nginx-user" {
  name = "nginx-user"
  path = "/"
}

resource "aws_iam_user_group_membership" "nginx-membership" {
  user = "${aws_iam_user.nginx-user.name}"

  groups = ["${aws_iam_group.nginx-iam-group.name}"]
}

如果你们需要剩余代码：https://github.com/atilasantos/iac-terraform-nginx.git

Answer 1

您正在尝试将aws_iam_policy_document.nginx-doc-policy 策略用作assume_role_policy，它不能用作代入角色策略需要定义您信任的委托人并希望授予访问权以代入您正在创建的角色。

假设角色策略可能如下所示，您希望通过实例配置文件向 EC2 实例授予对该角色的访问权限。最后，您可以通过新资源将您的初始角色作为内联策略附加到角色：

data "aws_iam_policy_document" "instance-assume-role-policy" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "nginx-iam_role" {
  name               = "nginx-iam_role"
  path               = "/"
  assume_role_policy = data.aws_iam_policy_document.instance-assume-role-policy.json
}

resource "aws_iam_role_policy" "role_policy" {
  name   = "role policy"
  role   = aws_iam_role.nginx-iam_role.id
  policy = data.aws_iam_policy_document.nginx-doc-policy.json
}

除了将策略附加为内联策略之外，您还可以创建 IAM 策略并将其附加到各种 iam 资源。 （例如：aws_iam_policy 和 aws_iam_role_policy_attachment 用于角色。）

我们创建了一堆开源的IAM modules（和others）来简化IAM 处理：Find them here on github。但是您可以尝试更多模块。