基于条件阶段变量字符串的 Terraform 资源

Question

我正在尝试在我的三个环境中的每个环境中为用户附加不同类型的策略： 开发、登台和生产。

环境信息以字符串格式存储为 terraform 变量，例如'开发'。

resource "aws_iam_policy" "s3-dev-policy" {
  count       = var.stage != "dev" ? 1 : 0
  name        = "s3-bucket-policy-${var.stage}"
  description = "Access rights for cicd-user to Bucket on Dev"

  policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [{
            "Action": [
                "s3:GetObject",
                "s3:ListBucket",
                "s3:PutObject",
                "s3:DeleteObject"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3::: dev-bucket-pushed",
                "arn:aws:s3::: dev-bucket-pushed/*"
            ]
        }
}
EOF
}

resource "aws_iam_group_policy_attachment" "attach_cicd-users_s3_dev_group_policy" {
  count      = var.stage != "dev" ? 1 : 0
  group      = aws_iam_group.cicd-users.name
  policy_arn = aws_iam_policy.s3-dev-policy[count.index]
}

Terraform apply 不会抱怨语法，但即使阶段设置为“dev”，它也不会应用此资源。条件是否仅适用于布尔作为数据类型？

Answer 1

您的条件不正确、政策存在语法错误、arn 不正确等问题。一切都应该是：

resource "aws_iam_policy" "s3-dev-policy" {
  count       = var.stage == "dev" ? 1 : 0
  name        = "s3-bucket-policy111-${var.stage}"
  description = "Access rights for cicd-user to Bucket on Dev"

  policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [{
            "Action": [
                "s3:GetObject",
                "s3:ListBucket",
                "s3:PutObject",
                "s3:DeleteObject"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::dev-bucket-pushed",
                "arn:aws:s3:::dev-bucket-pushed/*"
            ]
        }
       ] 
}
EOF
}


resource "aws_iam_group_policy_attachment" "attach_cicd-users_s3_dev_group_policy" {
  count      = var.stage == "dev" ? 1 : 0
  group      = aws_iam_group.cicd-users.name
  policy_arn = aws_iam_policy.s3-dev-policy[count.index].arn
}