使用 terraform 动态块构建 S3 存储桶策略

Question

我正在尝试创建一个 S3 存储桶策略以提供对许多其他帐户的访问权限。我不知道如何使用 Terraform 使用 for 循环或动态块。

locals {
  account_ids = [
    987654321098,
    765432109876,
    432109876543
  ]
}

resource "aws_s3_bucket_policy" "bucket" {
  bucket = aws_s3_bucket.bucket.id

  policy = jsonencode({
    Statement = [
      for account in local.account_ids : {
          Effect    = "Allow"
          Action    = [ ... ]
          Principal = { AWS = [ "arn:aws:iam::${account}:root" ] }
          Resource  = "${aws_s3_bucket.bucket.arn}/states/${account}/*"
        }
      ]
    }
  })
}

这失败了：错误：缺少参数分隔符/需要逗号来分隔每个函数参数。

如果我尝试使用动态块，则会出现类似问题。

最终我希望Statement 块包含 3 个块的列表，每个帐户一个。

有什么想法吗？

Answer 1

你的右括号太多了。应该是：

resource "aws_s3_bucket_policy" "bucket" {
  bucket = aws_s3_bucket.bucket.id

  policy = jsonencode({
    Statement = [
      for account in local.account_ids : {
          Effect    = "Allow"
          Action    = [ ... ]
          Principal = { AWS = [ "arn:aws:iam::${account}:root" ] }
          Resource  = "${aws_s3_bucket.bucket.arn}/states/${account}/*"
        }
      ]
    })
}