amazon-iam - Terraform:将 aws_iam_role_policy 关联到 aws_iam_role

Question

我正在尝试使用 Terraform 变量将 aws_iam_role_policy 附加到 aws_iam_role:${aws_iam_role.AutoTagMasterRole.id}

我正在使用在以下位置找到的 TF 文档:iam_role_policy.html

Terraform 错误消息:

aws_iam_role_policy.AutoTagMasterPolicy: Resource 'aws_iam_role.AutoTagMasterRole' not found for variable 'aws_iam_role.AutoTagMasterRole.arn'

这是我的 Terraform 配置:

  resource "aws_iam_role_policy" "AutoTagMasterPolicy" {
    name  = "AutoTagMasterPolicy"
    role = "${aws_iam_role.AutoTagMasterRole.id}"


    policy = <<EOF
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "s3:GetBucketTagging",
          "s3:PutBucketTagging",
          "ec2:CreateTags",
          "elasticloadbalancing:AddTags",
          "autoscaling:CreateOrUpdateTags",
          "rds:AddTagsToResource",
          "elasticmapreduce:AddTags",
          "datapipeline:AddTags"
        ],
        "Resource": [
          "*"
        ]
      }
    ]
  }
  EOF
  }



  resource "aws_iam_role" "AutoTagMasterRole" {
    name = "AutoTagMasterRole"
    path = "/gorillastack/autotag/master/"

    assume_role_policy = <<EOF
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "AWS": { "${aws_iam_role.AutoTagExecutionRole.arn}" }
        },
        "Action": [
          "sts:AssumeRole"
        ]
      }
    ]
  }
  EOF
  }

谁能告诉我我做错了什么？

更新 有人告诉我这与我尝试将 cloudformation 函数移植到它在 terraform 中的等效函数有关。

这是 cloudformation 列出的内容:

   "Principal": {
            "AWS" : { "Fn::GetAtt" : [ "AutoTagExecutionRole", "Arn" ] }
          },

我正在尝试在 terraform 中找到等效项。这是我使用的，但它抛出了错误。

   "Principal": {
    "AWS": { "${aws_iam_role.AutoTagExecutionRole.arn}" }
  }

Answer 1

aws_iam_role 中Principal 的定义有误

这是给你的示例。

resource "aws_iam_role" "test_role" {
  name = "test_role"

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF
}

所以你的代码应该改成

resource "aws_iam_role" "AutoTagMasterRole" {
  name = "AutoTagMasterRole"
  path = "/gorillastack/autotag/master/"

  assume_role_policy = <<EOF
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "Service": "ec2.amazonaws.com"
        },
        "Action": [
          "sts:AssumeRole"
        ]
      }
    ]
  }
  EOF
}

引用:terraform aws_iam_role