使用 2 个单独的策略时出现格式错误的策略错误答案

【问题标题】：Malformed Policy Error Occurs When Using 2 Separate Policies使用 2 个单独的策略时出现格式错误的策略错误
【发布时间】：2020-11-03 20:19:07
【问题描述】：

我有以下 json 文件，我使用 Terraform 来执行以下操作：

允许部署我的 Lambda 函数
在我的 lambda 函数调用时允许创建日志组。
允许创建根据 lambda 函数时的日期命名的日志跟踪调用。

我们的想法是自动创建这些日志组/跟踪，这样我就不必每天进入 CloudWatch 并创建一个新的日志组/跟踪，这将是徒劳的。

main.tf:

provider "aws" {
  access_key = "foo"
  secret_key = "foo"
  region = "us-east-1"
}

resource "aws_lambda_function" "greet_lambda" {
  filename = "greet_lambda.py.zip"
  function_name = "greet_lambda"
  role = aws_iam_role.iam_for_lambda.arn
  handler = "greet_lambda.lambda_handler"
  depends_on = [aws_iam_role_policy_attachment.lambda_logs]
  runtime = "python3.7"
  environment {
    variables = {greeting = "Hi"}
  }
}

resource "aws_cloudwatch_log_group" "greet_lambda" {
  name = "/aws/lambda/greet_lambda"
}

resource "aws_iam_role" "iam_for_lambda" {
  name = "iam_for_lambda"
  assume_role_policy = file("iam_for_lambda.json")
}

resource "aws_iam_policy" "lambda_logging" {
  name = "lambda_logging"
  path = "/"
  description = "IAM policy for logging from a lambda"
  policy = file("lambda_policy.json")
}

resource "aws_iam_role_policy_attachment" "lambda_logs" {
  role = aws_iam_role.iam_for_lambda.name
  policy_arn = aws_iam_policy.lambda_logging.arn
  depends_on = [aws_iam_role.iam_for_lambda, aws_iam_policy.lambda_logging]
}

lambda_policy.json

{
    "Version": "2012-10-17",
    "Statement": [{
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:us-east-1:003618259171:log-group:/aws/lambda/greet_lambda:*",
      "Effect": "Allow"
      }
    ]
  }

iam_for_lambda：

{
    "Version": "2012-10-17",
    "Statement": [{
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
    "Effect": "Allow",
    "Sid": "" 
  }
  ]
}

问题：一切似乎都已正确部署，但是当调用 lambda 函数时，不会在日志组中自动创建日志流。

【问题讨论】：

我刚刚在您已删除的问题中向您解释了与stackoverflow.com/a/51279889/2291321 重复的问题。 assume_role_policy 是代入角色的权限，只能包含代入角色策略，而不是您希望 IAM 角色执行的操作。请您阅读该链接问题中的答案，然后修改您的问题以清楚地解释您对此不了解的地方吗？
我看不出这篇上一篇文章是如何适用的，因为它不涉及将 2 个单独的策略应用于 lambda 函数。我的问题在文件结构上有所不同，我解释的目标在您链接的帖子中不存在。根据 Stack Overflow 的建议，该问题已被删除。
我也看到你因缺乏努力而被否决，但我已对我的文件进行了更改以减少错误。
这不是您的 Terraform 代码正在做的事情。您正在创建两个单独的 IAM 角色，然后将它们的两个代入角色策略设置为格式错误的策略，其中包括您希望角色能够使用的 IAM 操作。可能值得花一些时间阅读 IAM 角色以及它们在 AWS 中的使用方式。
我将搜索有关 IAM 角色的更多信息并报告我的发现

标签： json amazon-web-services terraform amazon-iam terraform-provider-aws

【解决方案1】：

这是我最终制作的有效代码：

main.tf:

provider "aws" {
  access_key = ""
  secret_key = ""
  region = ""
}

resource "aws_lambda_function" "greet_lambda" {
  filename      = "greet_lambda.py.zip"
  function_name = "greet_lambda"
  role          = "${aws_iam_role.iam_for_lambda.arn}"
  handler       = "greet_lambda.lambda_handler"
  depends_on = ["aws_iam_role_policy_attachment.lambda_logs", "aws_cloudwatch_log_group.example"]
  source_code_hash = "${filebase64sha256("greet_lambda.py.zip")}"
  runtime = "python3.7"
  environment {
    variables = {greeting = "Hi"}
  }
}

resource "aws_iam_role" "iam_for_lambda" {
  name = "iam_for_lambda"

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF
}


resource "aws_cloudwatch_log_group" "example" {
  name              = "/aws/lambda/greet_lambda"
  retention_in_days = 14
}


resource "aws_iam_policy" "lambda_logging" {
  name        = "lambda_logging"
  path        = "/"
  description = "IAM policy for logging from a lambda"

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:*:*:*",
      "Effect": "Allow"
    }
  ]
}
EOF
}

resource "aws_iam_role_policy_attachment" "lambda_logs" {
  role       = "${aws_iam_role.iam_for_lambda.name}"
  policy_arn = "${aws_iam_policy.lambda_logging.arn}"
}

【讨论】：