Terraform 验证 json 策略失败答案

【问题标题】：Terraform validate failing on json policyTerraform 验证 json 策略失败
【发布时间】：2020-05-24 16:23:19
【问题描述】：

我正在尝试使用具有自定义 json 策略的 terraform 文件创建 S3 存储桶。我找不到 JSON 格式的问题。 Terraform validate 出错

“错误：“策略”包含无效的 JSON：无效字符 's' 正在寻找值的开头” 上线

    {
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "Explicit deny",
        "Effect": "Deny",
        "Principal": "*",
        "Action": "s3:*",
        "Resource": [
            "arn:xxx-xx-xxx:s3:::s999999999999-9999-99999",
            "arn:xxx-xx-xxx:s3:::s999999999999-9999-99999/*"
        ],
        "Condition": {
            "StringNotLike": {
                "aws:userId": [
                    "XXXX9999XXXXXXXXXXXXX:*",
                    "XXXX9999XXXXXXXXXXXXX:*",
                    "XXXX9999XXXXXXXXXXXXX:*",
                    "XXXX9999XXXXXXXXXXXXX:*",
                    "XXXX9999XXXXXXXXXXXXX:*",
                    "XXXX9999XXXXXXXXXXXXX:*",
                    "999999999999"
                ]
            }
        }
    },
    {
        "Sid": "Policy Modification",
        "Effect": "Deny",
        "Principal": "*",
        "Action": [
            "s3:cUSTOMpoLICY",
            "s3:cUSTOMpoLICY"
        ],
        "Resource": [
            "arn:xxx-xx-xxx:s3:::s999999999999-9999-99999",
            "arn:xxx-xx-xxx:s3:::s999999999999-9999-99999/*"
        ],
        "Condition": {
            "StringNotLike": {
                "aws:userId": [
                    "XXXXXXXXXXXXXXXXXXXXX:*",
                    "999999999999"
                ]
            }
        }
    }
]

}

我能够通过 JSONLINT.com 进行验证，发现这不是 JSON 格式的问题，而是与处理 JSON 的 terraform 有关

【问题讨论】：

标签： json validation terraform

【解决方案1】：

这不是一个实际的解决方案，但是当我通过在

下指定将 JSON 策略内容移动到 terraform 文件时，我能够使策略生效

    policy = <<POLICY
     {
 {
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "Explicit deny",
        "Effect": "Deny",
        "Principal": "*",
        "Action": "s3:*",
        "Resource": [
            "arn:xxx-xx-xxx:s3:::s999999999999-9999-99999",
            "arn:xxx-xx-xxx:s3:::s999999999999-9999-99999/*"
        ],
        "Condition": {
            "StringNotLike": {
                "aws:userId": [
                    "XXXX9999XXXXXXXXXXXXX:*",
                    "XXXX9999XXXXXXXXXXXXX:*",
                    "XXXX9999XXXXXXXXXXXXX:*",
                    "XXXX9999XXXXXXXXXXXXX:*",
                    "XXXX9999XXXXXXXXXXXXX:*",
                    "XXXX9999XXXXXXXXXXXXX:*",
                    "999999999999"
                ]
            }
        }
    },
    {
        "Sid": "Policy Modification",
        "Effect": "Deny",
        "Principal": "*",
        "Action": [
            "s3:cUSTOMpoLICY",
            "s3:cUSTOMpoLICY"
        ],
        "Resource": [
            "arn:xxx-xx-xxx:s3:::s999999999999-9999-99999",
            "arn:xxx-xx-xxx:s3:::s999999999999-9999-99999/*"
        ],
        "Condition": {
            "StringNotLike": {
                "aws:userId": [
                    "XXXXXXXXXXXXXXXXXXXXX:*",
                    "999999999999"
                ]
            }
        }
    }
]

} 政策

我用过 Terraform v0.12.9，+ provider.aws v2.63.0 我会尝试在 Terraform github 中将其作为 bug 提交

【讨论】：