如何使用 Terraform 附加多个 AWS SQS 策略

Question

我确实有 SQS 的默认策略，如下所示。参考了文档 - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue_policy

如果需要 sns 订阅，我想将该策略附加到默认策略之上。

默认策略如下

  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sqs:SendMessage*"
      ],
      "Resource": [
        "${aws_sqs_queue.queue.arn}"
      ]
    }
  ]
}

附加政策如下

{
      "Sid": "topic-subscription-arn-test",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "SQS:SendMessage",
      "Resource": ["${aws_sqs_queue.queue.arn}"],
      "Condition": {
        "ArnLike": {
          "aws:SourceArn": "arn-test"
        }
      }
    }

我刚刚尝试过，但政策被覆盖了。有什么想法可以使用 Terraform 附加策略吗？提前致谢。正在寻找这种方法的某种想法吗？可能有超过 2 个策略，因此我正在尝试附加这些策略。

Answer 1

我强烈建议使用aws_iam_policy_document数据源 [1] 在 Terraform 中而不是 JSON 中构建策略。由于SQS队列有一个参数policy[2]，所以资源aws_sqs_queue_policy不一定要使用，但也可以与上面提到的数据源结合起来。所以有两个选择：

1. 使用数据源创建策略并使用policy参数附加它
2. 使用数据源创建策略并将其附加到aws_sqs_queue_policy

如果您决定使用第一个选项，则代码应如下所示：

data "aws_iam_policy_document" "sqs_policy" {

  statement {
    sid = "FirstSQSPolicy"
    effect  = "Allow"
    actions = [
      "sqs:SendMessage*"
    ]
    resources = [
      aws_sqs_queue.queue.arn
    ]
  }

  statement {
    sid     = "topic-subscription-arn-test"
    effect  = "Allow"
    actions = [
      "sqs:SendMessage"
    ]
    resources = [
      aws_sqs_queue.queue.arn
    ]
    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values = [
        "arn-test"
      ]
    }
  }
}

resource "aws_sqs_queue" "terraform_queue" {
  ...
  policy = data.aws_iam_policy_document.sqs_policy.json
}

对于第二个选项，您可以使用相同的数据源并将 JSON 附加到资源aws_sqs_queue_policy：

data "aws_iam_policy_document" "sqs_policy" {

  statement {
    sid = "FirstSQSPolicy"
    effect  = "Allow"
    actions = [
      "sqs:SendMessage*"
    ]
    resources = [
      aws_sqs_queue.queue.arn
    ]
  }

  statement {
    sid     = "topic-subscription-arn-test"
    effect  = "Allow"
    actions = [
      "sqs:SendMessage"
    ]
    resources = [
      aws_sqs_queue.queue.arn
    ]
    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values = [
        "arn-test"
      ]
    }
  }
}

resource "aws_sqs_queue_policy" "sqs_queue_policy" {
  queue_url = aws_sqs_queue.queue.id

  policy = data.aws_iam_policy_document.sqs_policy.json
}

使用 IAM 策略的数据源，您可以根据需要添加语句。

[1] https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document

[2] https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue#policy