我正在创建一个 Terraform 脚本,它创建一个 IAM 角色,由 EC2 实例通过启动模板承担。我有一个简单的 lambda 函数 (boto3/python),它使用启动模板创建/启动 EC2 实例。但是,当我运行 lambda 函数时出现此错误:
"errorMessage": "An error occurred (InvalidParameterValue) when calling the RunInstances operation:
Value (arn:aws:iam::xxx:instance-profile/RigstopgapInstanceProfile) for parameter iamInstanceProfile.name is invalid. Invalid IAM Instance Profile name",
"errorType": "ClientError",
我的地形代码是这个:
resource "aws_launch_template" "rig_stopgap" {
name = "rig_stopgap"
image_id = var.ami_image
instance_type = var.instance_type
iam_instance_profile {
name = aws_iam_instance_profile.rig_stopgap.arn
}
...
}
resource "aws_iam_instance_profile" "rig_stopgap" {
name = "RigstopgapInstanceProfile"
role = aws_iam_role.rigs_stopgap_ec2.name
}
# EC2 "Trust relationships" policy (necessary to allow the instance to assume a role)
data "aws_iam_policy_document" "trust_relationships_ec2_policy" {
statement {
actions = ["sts:AssumeRole"]
principals {
type = "Service"
identifiers = ["ec2.amazonaws.com"]
}
}
}
# EC2 main policy
resource "aws_iam_policy" "rigs_stopgap_ec2_policy" {
name = "RigsStopgapPolicy"
description = "Rigs Stopgap Policy allowing access to all of the necessary resources"
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"dynamodb:UpdateItem"
],
"Effect": "Allow",
"Resource": "${aws_dynamodb_table.rigs_stopgap.arn}"
}
]
}
EOF
}
# Attach the ec2 policy
resource "aws_iam_role_policy_attachment" "attach_ec2_instance_policy" {
role = aws_iam_role.rigs_stopgap_ec2.name
policy_arn = aws_iam_policy.rigs_stopgap_ec2_policy.arn
}
resource "aws_iam_role" "rigs_stopgap_ec2" {
name = "RigsStopgapRole"
assume_role_policy = data.aws_iam_policy_document.trust_relationships_ec2_policy.json
tags = var.common_tags
}
我的 Lambda 代码:
import boto3
ec2 = boto3.resource('ec2')
lt = {
'LaunchTemplateName': 'rig_stopgap',
'Version': '$Latest'
}
def handler(event, context):
instances = ec2.create_instances(
LaunchTemplate=lt,
MinCount=1,
MaxCount=1
)
我错过了什么?
最佳答案
我不熟悉 Terraform,但看起来您提供的只是一个 ARN,而它只是想要一个名称:
iam_instance_profile {
name = aws_iam_instance_profile.rig_stopgap.arn
}
尝试只提供角色的名称,而不是提供 ARN。
关于amazon-web-services - IAM 实例配置文件名称无效,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/65213153/