IBM和Terraform:如何识别ibm_iam_authorization_policy中的密钥环？

Question

我在IBM中使用Terraform，并希望创建一个服务来使用政策提供服务授权。

一般来说，我知道如何在cloud-object-storage和kms之间创建策略。但如何将其定位到特定的密钥环上呢？我可以在IBM控制台中这样做，但是在提供者中没有看到任何东西。

resource "ibm_iam_authorization_policy" "testpolicy" {
  source_resource_instance_id = data.ibm_resource_instance.cos_resource_instance.guid
  source_service_name = "cloud-object-storage"
  
  target_resource_instance_id = data.ibm_resource_instance.kms_resource_instance.guid
  target_service_name = "kms"

  roles               = ["Reader"]
  description         = "TF-based test"
}

Answer 1

使用策略管理API和Terraform执行更多的测试，下面的测试似乎是有效的：

resource "ibm_iam_authorization_policy" "team_testpolicy" {
  provider = ibm.team_account

  
  source_service_account = data.ibm_iam_account_settings.dev_iam_account_settings.account_id
  source_resource_instance_id = data.ibm_resource_instance.cos_resource_instance.guid
  source_service_name = "cloud-object-storage"

  resource_attributes {
        name     = "accountId"
        operator = "stringEquals"
        value    = data.ibm_iam_account_settings.team_iam_account_settings.account_id
  }

  resource_attributes {
        name     = "serviceName"
        operator = "stringEquals"
        value    = "kms"
  }
  resource_attributes {
              name = "serviceInstance"
              operator = "stringEquals"
              value = ibm_resource_instance.kms_instance.guid
  }
  resource_attributes {
              name = "keyRing"
              operator = "stringEquals"
              value = ibm_kms_key_rings.key_ring.key_ring_id
  }


  roles               = ["Reader"]
  description         = "reverse policy in other account"
}

使用resource_attributes和名称属性keyRing可以创建正确的授权策略。