格式错误的政策文件:已禁止外地资源

Question

我正在尝试使用Terraform创建一个IAM角色和IAM策略。

我得到了一个错误：

│ Error: error creating IAM Role (asg-domain-join-policy): MalformedPolicyDocument: Has prohibited field Resource
 
  status code: 400, request id: 53fa1ae0-f22f-4f2e-8aa6-1947421eae9b

  with aws_iam_role.ad_join_role,
  on iam.tf line 30, in resource "aws_iam_role" "ad_join_role":
  30: resource "aws_iam_role" "ad_join_role" {

我目前为IAM角色编写的代码如下：

resource "aws_iam_role" "ad_join_role" {
  name                 = "asg-domain-join-policy"
  assume_role_policy   = data.aws_iam_policy_document.asg_domain_join_policy.json
  permissions_boundary = "arn:aws:iam::${var.account_id}:policy/****"
}

IAM政策守则如下：

data "aws_iam_policy_document" "asg_domain_join_policy" {
  statement {
    actions = [
      "ssm:DescribeAssociation",
      "ssm:GetDocument",
      "ssm:ListAssociations",
      "ssm:UpdateAssociationStatus",
      "ssm:UpdateInstanceInformation",
      "ssm:CreateAssociation",
    ]
    effect    = "Allow"
    resources = ["ec2"]
    }
}

我不知道我为什么会犯这个错误。

Answer 1

assume_role_policy可以有一个仅指定AssumeRole操作的文档。您需要做的是拆分您的策略，创建能够承担角色的单独策略，并能够将其他权限附加到角色。

例如：

# Allow EC2 instances to assume the role
data "aws_iam_policy_document" "asg_assume_role_policy" {
  statement {
    actions = [
      "sts:AssumeRole"
    ]
    effect = "Allow"
    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }

  }
}

# Create the policy which allows other actions for the EC2 instance
data "aws_iam_policy_document" "asg_domain_join_policy" {
  statement {
    actions = [
      "ssm:DescribeAssociation",
      "ssm:GetDocument",
      "ssm:ListAssociations",
      "ssm:UpdateAssociationStatus",
      "ssm:UpdateInstanceInformation",
      "ssm:CreateAssociation"
    ]
    effect = "Allow"
    resources = ["*"]
  }
}

resource "aws_iam_role" "ad_join_role" {
  name               = "asg-domain-join-policy"
  assume_role_policy = data.aws_iam_policy_document.asg_assume_role_policy.json
 
  # Attach the policy
  inline_policy {
    policy = data.aws_iam_policy_document.asg_domain_join_policy.json
  }
}

在这个例子中需要注意的一些事情：

• 第二个策略作为一个内联策略附加。这很好，如果策略较短，否则您可能需要使用aws_iam_policy_attachment
• 第二个策略中的操作的资源类型是通配符["*"]。如果您希望在策略上的操作有更大的粒度，您可能需要查看此页，以查看哪个操作允许哪种资源类型。显然，["ec2"]不是有效的资源类型。

Answer 2

资源块使用的引用不正确。ec2不是一种资源。如果要引用实例，则需要使用aws_instance.my_ec2_instance，或者如果希望允许所有资源，则可以放置"*“。