我想在iam_policy模块上迭代，创建多个模块，并将每个模块附加到它们的iam_assumable_role对应模块。这附近有工作吗？

Question

好吧，我希望有办法做到这一点。所以我有一个列表，比如说var.env。我想迭代这个var.env，以制定多个策略，并将这些策略附加到相应的假设角色中。我希望这是有意义的。

这看起来会是。

# list
variable "env" {
  type = list(strings)
  default = ['dev', 'stage', 'prod']
}

# creating the policy documents data
data "aws_iam_policy_document" "policy_document" {
  for_each = var.env

  statement {
    actions = [
      "s3:*"
    ]
    effect = "Allow"
    resources = ["arn:...:mybucket_${each.key}"]
  }
}

# attaching the policy document data to a policy
module "bucket_policy" {
  source   = "terraform-aws-modules/iam/aws//modules/iam-policy"
  version  = "4.10.0"

  for_each = var.env

  name        = "example_${each.key}_bucket_policy"
  path        = "/"
  description = "${each.key} Policy document"

  policy = data.aws_iam_policy_document.policy_document[each.key].json
}

# creating the assumable roles 
module "assumable_role" {
  source   = "terraform-aws-modules/iam/aws//modules/iam-assumable-role"
  version  = "4.10.0"

  for_each = var.env

  create_role = true

  role_name         = "example_${each.key}_bucket_role"
  role_requires_mfa = false

  trusted_role_services = [
    s3.amazonaws.com"
  ]

  # now this DOESN"T WORK but something like this... 
  custom_role_policy_arns = [
    module.bucket_policy.arn[each.key]
  ]
}

我真的很感激你的建议和一切。

事先谢谢你。

Answer 1

引用arn的正确方法如下所示。而不是

 module.bucket_policy.arn[each.key]

它应该是

 module.bucket_policy[each.key].arn