Terraform 格式错误的策略

Question

我正在将 kms 导入 terraform，我已经导入了这些资源，但是当我尝试运行 terraform 计划时，它会重新排列 arn，因此最后一个 arn 有一个逗号。因此我的 terraform 应用失败了。

无论如何我可以避免这种重新排列吗？我认为在这种情况下，我应该使用数据块而不是直接添加策略。但我不确定如何传递数据块..

看起来我不能使用数据块，有什么办法可以避免在 Principal 块中重新排列 arn？

我正在使用 terraform 0.12.20

policy.json.tpl

{
    "Version": "2012-10-17",
    "Id": "key-policy-1",
    "Statement": [{
            "Sid": "Enable IAM User Permissions",
            "Effect": "Allow",
            "Principal": {
                "AWS": ${allowed_resources}
            },
            "Action": "kms:*",
            "Resource": "*"
        },
        {
            "Sid": "Allow use of the key",
            "Effect": "Allow",
            "Principal": {
                "AWS": ${allowed_resources}
            },
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:DescribeKey"
            ],
            "Resource": "*"
        }
    ]
}

main.tf

resource "aws_kms_key" "key" {
  description = ""
  tags        = local.common_tags
  policy      = templatefile("${path.module}/policy.json.tpl", {
    allowed_resources = var.allowed_resources
  })
}

变量.tf

variable "allowed_resources" {
  description = "list of all principal resources"
  type        = list(string)
  default = [
    "arn:aws:iam::xxxxxxxxxxxx:user/a",
    "arn:aws:iam::xxxxxxxxxxxxx:user/b",
    "arn:aws:iam::xxxxxxxxxx:user/c",
    "arn:aws:iam::xxxxxxxxxx:role/abc
  ]
}

错误

10:53:19 Error: MalformedPolicyDocumentException: Policy contains a statement with one or more invalid principals.
10:53:19 
10:53:19   on main.tf line 8, in resource "kms_key" "key":
10:53:19    8: resource "aws_kms_key" "key" {

地形规划： Terraform 将执行以下操作：

  # aws_kms_key.amp_key will be updated in-place
  ~ resource "aws_kms_key" "amp_key" {
        arn                      = "arn:aws:kms:us-east-1:xxxx:key/xxx-xxx-xxx-xx-xxxxxxxx"
        customer_master_key_spec = "SYMMETRIC_DEFAULT"
        enable_key_rotation      = false
        id                       = "xxx-xxx-xxx-xx-xxxxxxxx"
        is_enabled               = true
        key_id                   = "xxx-xxx-xxx-xx-xxxxxxxx"
        key_usage                = "ENCRYPT_DECRYPT"
      ~ policy                   = jsonencode(
          ~ {
                Id        = "key-policy-1"
              ~ Statement = [
                    {
                        Action    = "kms:*"
                        Effect    = "Allow"
                        Principal = {
                            AWS = "arn:aws:iam::xxxxxxxx:root"
                        }
                        Resource  = "*"
                        Sid       = "Enable IAM User Permissions"
                    },
                  ~ {
                        Action    = [
                            "kms:Encrypt",
                            "kms:Decrypt",
                            "kms:ReEncrypt*",
                            "kms:GenerateDataKey*",
                            "kms:DescribeKey",
                        ]
                        Effect    = "Allow"
                      ~ Principal = {
                          ~ AWS = [
                              + "arn:aws:iam::xxxxxx:user/c",
                              + "arn:aws:iam::xxxxxx:user/a",
                              - "arn:aws:iam::xxxxxx:role/abc",
                              - "arn:aws:iam::xxxxxx:user/a",
                              - "arn:aws:iam::xxxxxx:user/c",
                                "arn:aws:iam::xxxxxx:user/b",
                              + "arn:aws:iam::xxxxxx:role/abc",
                         ]
                       }
                     ]
                Version   = "2012-10-17"
                     }
                 )

当我尝试使用数据块时

data "template_file" "temp_file" {
  template = "${file("${path.module}/amp_key_policy.json.tpl")}"
  vars = {
    allowed_resources = "${var.allowed_resources}" //tried without quotes
  }
}
resource "aws_kms_key" "amp_key" {
  description = ""
  tags        = local.common_tags
  policy      = data.template_file.temp_file.rendered
}

错误：属性值类型不正确

  on main.tf line 10, in data "template_file" "temp_file":
  10:   vars = {
  11:     allowed_resources = "${var.allowed_resources}"
  12:   }

属性“vars”的值不合适：元素“allowed_resources”：字符串 必填。

更新：

我尝试使用 aws_iam_policy_document。

data "aws_iam_policy_document" "amp_key_doc" {
  for_each = toset(var.allowed_resources)
  statement {
    sid    = "Enable IAM User Permissions"
    effect = "Allow"
    principals {
      identifiers = ["arn:aws:iam::xxxxx:root"]
      type        = "AWS"
    }
    actions   = ["kms:*"]
    resources = ["*"]
  }

  statement {
    sid    = "Allow access for Key Administrators"
    effect = "Allow"
    principals {
      identifiers = ["arn:aws:iam::xxxx:user/a"]
      type        = "AWS"
    }
    actions = [
      "kms:Create*",
      "kms:Describe*",
      "kms:Enable*",
      "kms:List*",
      "kms:Put*",
      "kms:Update*",
      "kms:Revoke*",
      "kms:Disable*",
      "kms:Get*",
      "kms:Delete*",
      "kms:TagResource",
      "kms:UntagResource",
      "kms:ScheduleKeyDeletion",
    "kms:CancelKeyDeletion"]
    resources = ["*"]
  }

  statement {
    sid    = "Allow use of the key"
    effect = "Allow"
    principals {
      identifiers = [var.allowed_resources]
      type        = "AWS"
    }
    actions = [
      "kms:Encrypt",
      "kms:Decrypt",
      "kms:ReEncrypt*",
      "kms:GenerateDataKey*",
      "kms:DescribeKey"
    ]
    resources = ["*"]
  }

  statement {
    sid    = "Allow attachment of persistent resources"
    effect = "Allow"
    principals {
      identifiers = [var.allowed_resources]
      type        = "AWS"
    }
    actions = [
      "kms:CreateGrant",
      "kms:ListGrants",
      "kms:RevokeGrant"
    ]
    resources = ["*"]
    condition {
      test     = "Bool"
      values   = ["true"]
      variable = "kms:GrantIsForAWSResource"
    }
  }
}


resource "aws_kms_key" "key" {
  description = ""
  tags        = local.common_tags
  policy      = data.aws_iam_policy_document.key_doc.json

遇到错误，我们如何传递整个 allowed_resources 块？

Error: Incorrect attribute value type

  on data.tf line 43, in data "aws_iam_policy_document" "key_doc":
  43:       identifiers = [var.allowed_resources]

Inappropriate value for attribute "identifiers": element 0: string required.

错误：属性值类型不正确

在 data.tf 第 60 行，在数据“aws_iam_policy_document”“key_doc”中： 60：标识符 = [var.allowed_resources]

属性“标识符”的值不合适：元素 0：需要字符串。

Answer 1

错误归结为vars 的值仅支持primitive types，如documentation 中所述

模板内插值的变量。请注意，变量必须都是原语。直接引用列表或地图会导致验证错误。

如果您将策略创建为 iam_policy_document，则可以使用资源的 json 属性传递到您的 aws_kms_key 资源中。