格式错误的政策文件：已禁止字段资源

Question

我正在尝试使用 Terraform 创建 IAM 角色和 IAM 策略。

\n

我收到此错误：

\n

\xe2\x94\x82 Error: error creating IAM Role (asg-domain-join-policy): MalformedPolicyDocument: Has prohibited field Resource\n \n  status code: 400, request id: 53fa1ae0-f22f-4f2e-8aa6-1947421eae9b\n\n  with aws_iam_role.ad_join_role,\n  on iam.tf line 30, in resource "aws_iam_role" "ad_join_role":\n  30: resource "aws_iam_role" "ad_join_role" {\n

\n

我当前的 IAM 角色代码如下：

\n

resource "aws_iam_role" "ad_join_role" {\n  name                 = "asg-domain-join-policy"\n  assume_role_policy   = data.aws_iam_policy_document.asg_domain_join_policy.json\n  permissions_boundary = "arn:aws:iam::${var.account_id}:policy/****"\n}\n

\n

IAM 策略的代码如下：

\n

data "aws_iam_policy_document" "asg_domain_join_policy" {\n  statement {\n    actions = [\n      "ssm:DescribeAssociation",\n      "ssm:GetDocument",\n      "ssm:ListAssociations",\n      "ssm:UpdateAssociationStatus",\n      "ssm:UpdateInstanceInformation",\n      "ssm:CreateAssociation",\n    ]\n    effect    = "Allow"\n    resources = ["ec2"]\n    }\n}\n

\n

我不确定为什么会收到该错误。

\n

Answer 1

可以assume_role_policy有一个仅指定操作的文档AssumeRole。您所要做的就是拆分您的策略以创建单独的策略，以便能够承担角色，并能够将其他权限附加到该角色。

例如：

# Allow EC2 instances to assume the role
data "aws_iam_policy_document" "asg_assume_role_policy" {
  statement {
    actions = [
      "sts:AssumeRole"
    ]
    effect = "Allow"
    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }

  }
}

# Create the policy which allows other actions for the EC2 instance
data "aws_iam_policy_document" "asg_domain_join_policy" {
  statement {
    actions = [
      "ssm:DescribeAssociation",
      "ssm:GetDocument",
      "ssm:ListAssociations",
      "ssm:UpdateAssociationStatus",
      "ssm:UpdateInstanceInformation",
      "ssm:CreateAssociation"
    ]
    effect = "Allow"
    resources = ["*"]
  }
}

resource "aws_iam_role" "ad_join_role" {
  name               = "asg-domain-join-policy"
  assume_role_policy = data.aws_iam_policy_document.asg_assume_role_policy.json
 
  # Attach the policy
  inline_policy {
    policy = data.aws_iam_policy_document.asg_domain_join_policy.json
  }
}

此示例中需要注意的一些事项：

• 第二个策略作为内联策略附加。如果保单较短，这很好，否则您可能需要使用aws_iam_policy_attachment
• 第二个策略中操作的资源类型是通配符["*"]。如果您希望对策略执行更详细的操作，您可能需要查看此页面以了解哪个操作允许哪种资源类型。显然，["ec2"]这不是有效的资源类型。