从 terraform 调用 SSM 文档答案

【问题标题】：Call an SSM document from terraform从 terraform 调用 SSM 文档
【发布时间】：2021-05-22 17:10:14
【问题描述】：

我想知道是否有人可以帮助解决这个问题？我正在尝试使用 terraform 调用 SSM 文档来停止 ec2 实例。但是，它似乎不起作用。我一直有错误：

Automation Step Execution fails when it is changing the state of each instance. Get Exception from StopInstances API of ec2 Service. Exception Message from StopInstances API: [You are not authorized to perform this operation.

这里有什么建议吗？

如您所见，有合适的角色。我在参数中传递它。

provider "aws" {
  profile = "profile"
  region  = "eu-west-1"
}


data "aws_ssm_document" "stop_ec2_doc" {
  name            = "AWS-StopEC2Instance"
  document_format = "JSON"
}


data "aws_iam_policy_document" "assume_role" {
  version = "2012-10-17"

  statement {
    sid     = "EC2AssumeRole"
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      identifiers = ["ec2.amazonaws.com"]
      type        = "Service"
    }

    principals {
      identifiers = ["ssm.amazonaws.com"]
      type        = "Service"
    }
  }
}

data "aws_ami" "latest_amazon_2" {
  most_recent = true
  owners      = ["amazon"]
  name_regex = "^amzn2-ami-hvm-.*x86_64-gp2"
}


#
resource "aws_iam_role" "iam_assume_role" {
  name                 = "iam_assume_role"
  assume_role_policy   = data.aws_iam_policy_document.assume_role.json
}

# 
resource "aws_iam_role_policy_attachment" "role_1" {
  role       = aws_iam_role.iam_assume_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
}

# the instance profile
resource "aws_iam_instance_profile" "iam_instance_profile" {
  name = "iam_instance_profile"
  role = aws_iam_role.iam_assume_role.name
}

# amazon ec2 instances
resource "aws_instance" "ec2_instances" {
  count                = 2
  ami                  = data.aws_ami.latest_amazon_2.id
  instance_type        = "t2.micro"
  subnet_id            = "subnet-12345678901"
  iam_instance_profile = aws_iam_instance_profile.iam_instance_profile.name

  root_block_device {
    volume_size = 8
    volume_type = "gp2"

    delete_on_termination = true
  }
}


resource "aws_ssm_association" "example" {
  name = data.aws_ssm_document.stop_ec2_doc.name
  
  parameters = {
    AutomationAssumeRole = "arn:aws:iam::12345678901:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM"
    InstanceId = aws_instance.ec2_instances[0].id
  }
}

欢迎提出任何建议。我试图创建一个简单的 Terraform 代码来说明我正在尝试做的事情。对我来说，这应该是直截了当的。我创建角色。我创建实例配置文件。我创建了传递正确角色和实例 ID 的关联。

【问题讨论】：

标签： amazon-web-services terraform aws-ssm

【解决方案1】：

AWSServiceRoleForAmazonSSM 角色没有停止实例的权限。相反，您应该为具有此类权限的 SSM 创建新角色。最简单的方法如下：

resource "aws_iam_role" "ssm_role" {
  name = "ssm_role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Sid    = ""
        Principal = {
          Service = "ssm.amazonaws.com"
        }
      },
    ]
  })

}

resource "aws_iam_role_policy_attachment" "ec2-attach" {
  role       = aws_iam_role.ssm_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonEC2FullAccess"
}

resource "aws_ssm_association" "example" {
  name = data.aws_ssm_document.stop_ec2_doc.name
  
  parameters = {
    AutomationAssumeRole = aws_iam_role.ssm_role.arn
    InstanceId = aws_instance.ec2_instances[0].id
  }
}

AmazonEC2FullAccess 仅允许停止实例，但我将其用作工作示例。

【讨论】：

谢谢。我会试试的。