如何将多个预先存在的 AWS 托管角色附加到一个策略？

Question

我想将 AWS 中的现有策略与角色相关联，我正在使用 terraform 工具

我想将这些策略关联起来，此代码与 aws cloudformation 工具：

   AWSCodeCommitFullAccess
   AWSCodeBuildAdminAccess
   AWSCodeDeployFullAccess
   AWSCodePipelineFullAccess
   AWSElasticBeanstalkFullAccess

尝试附加

data "aws_iam_policy" "attach-policy" {
  arn = ["arn:aws:iam::aws:policy/AWSCodeCommitFullAccess", "arn:aws:iam::aws:policy/AWSCodeBuildAdminAccess", "arn:aws:iam::aws:policy/AWSCodeDeployFullAccess", "arn:aws:iam::aws:policy/AWSCodePipelineFullAccess"]
}

resource "aws_iam_role_policy_attachment" "tc-role-policy-attach" {
  role = "${aws_iam_role.toolchain-role.name}"

  policy_arn = "${data.aws_iam_policy.attach-policy.arn}"
}

Answer 1

您使用 terraform 资源aws_iam_role_policy_attachment 朝着正确的方向前进，但需要进行一些调整。

AWS 托管策略的ARN存在于系统中。例如，如果您需要将第一个托管策略附加到 IAM 角色，

resource "aws_iam_role_policy_attachment" "test-policy-AWSCodeCommitFullAccess" {
  policy_arn = "arn:aws:iam::aws:policy/AWSCodeCommitFullAccess"
  role       = "${aws_iam_role.toolchain-role.name}"
}

您可以一一添加其他托管策略。

如果你想一起做，你可以试试下面的代码

variable "managed_policies" {
  default = ["arn:aws:iam::aws:policy/AWSCodeCommitFullAccess",
    "arn:aws:iam::aws:policy/AWSCodeBuildAdminAccess",
    "arn:aws:iam::aws:policy/AWSCodeDeployFullAccess",
    "arn:aws:iam::aws:policy/AWSCodePipelineFullAccess",
  ]
}

resource "aws_iam_role_policy_attachment" "tc-role-policy-attach" {
  count      = "${length(var.managed_policies)}"
  policy_arn = "${element(var.managed_policies, count.index)}"
  role       = "${aws_iam_role.toolchain-role.name}"
}