创建 IAM 角色并将策略附加到它时出错 [重复]答案

【问题标题】：Error in creating IAM role and attach policies to it [duplicate]创建 IAM 角色并将策略附加到它时出错 [重复]
【发布时间】：2019-11-07 22:19:18
【问题描述】：

我正在尝试创建一个 lambda 角色并向其附加策略，以便它可以启动和停止 ec2 实例。我将使用 cloudwatch 触发 lambda。

我收到此错误： “错误：创建 IAM 角色 lambdaRole 时出错：MalformedPolicyDocument：JSON 字符串不能有前导空格状态码：400，请求ID：d6a86c41-6601-43af-9040-81f6e6a76ec8

在 iam.tf 第 11 行，资源“aws_iam_role”“lambdaRole”中： 11：资源“aws_iam_role”“lambdaRole”{“

 terraform {
    backend  "s3" {
    region         = "us-west-2"
    bucket         = "gitlegionbucket"
    key            = "ec2/terraform.tfstate"
    dynamodb_table = "tf-state-lock"
    }
}

resource "aws_iam_role" "lambdaRole" {
  name = "lambdaRole"

  assume_role_policy = <<EOF
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Action": "sts:AssumeRole",
          "Principal": {
          "Service": "ec2.amazonaws.com"
          },
          "Effect": "Allow",
          "Sid": ""
        }
      ]
    }
EOF
}

resource "aws_iam_policy" "policy" {
  name        = "test-policy"
  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:*:*:*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:Start*",
        "ec2:Stop*"
      ],
      "Resource": "*"
    }
  ]
}
EOF
}

resource "aws_iam_role_policy_attachment" "attach-policies" {
  role       = "${aws_iam_role.lambdaRole.name}"
  policy_arn = "${aws_iam_policy.policy.arn}"
}

【问题讨论】：

github.com/hashicorp/terraform/issues/2686....kindly检查EOF后是否有空格

标签： terraform terraform-provider-aws

【解决方案1】：

我也面临同样的错误。我直接从问题中复制了代码。

它的工作方式对我来说是启动{，即在EOF 行之后立即开始策略，没有任何空格。

resource "aws_iam_role" "lambdaRole" {
  name = "lambdaRole"

  assume_role_policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
    {
        "Action": "sts:AssumeRole",
        "Principal": {
        "Service": "ec2.amazonaws.com"
        },
        "Effect": "Allow",
        "Sid": ""
    }
    ]
}
EOF
}

resource "aws_iam_policy" "policy" {
  name        = "test-policy"
  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:*:*:*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:Start*",
        "ec2:Stop*"
      ],
      "Resource": "*"
    }
  ]
}
EOF
}

resource "aws_iam_role_policy_attachment" "attach-policies" {
  role       = "${aws_iam_role.lambdaRole.name}"
  policy_arn = "${aws_iam_policy.policy.arn}"
}

地形输出：

aws_iam_role.lambdaRole: Creating...
aws_iam_role.lambdaRole: Creation complete after 2s [id=lambdaRole]
aws_iam_role_policy_attachment.attach-policies: Creating...
aws_iam_role_policy_attachment.attach-policies: Creation complete after 1s [id=lambdaRole-20191107141649610400000001]

Apply complete! Resources: 2 added, 0 changed, 0 destroyed.

【讨论】：

【解决方案2】：

好的，我找到了解决这个问题的方法。我将 json 移动到不同的文件中，而我只是引用了这些文件。

像这样，policy = "${file("lambda-policy.json")}"

我在“lambda-policy.json”中有这个： { “版本”：“2012-10-17”， “陈述”： [ { "Sid": "可视化编辑器0", “效果”：“允许”， “行动”： [ "ec2:DescribeInstances", "ec2:StartInstances", “日志：”， “ec2：停止实例” ], “资源”：“” } ] }

【讨论】：