Terraform -策略中的每个语句都应该有一个资源。

Question

我有一个试图附加到多个队列的aws_iam_policy_document。政策文件如下所示：

data "aws_iam_policy_document" "my_policy" {
  statement {
    principals {
      type        = "*"
      identifiers = ["*"]
    }

    actions = [
      "sqs:SendMessage"
    ]

    resources = [
      "${aws_sqs_queue.q1.arn}",
      "${aws_sqs_queue.q2.arn}",
      "...",
      "${aws_sqs_queue.q8.arn}"
    ]

    condition {
      test = "ArnEquals"
      variable = "aws:SourceArn"
      values = [
        "${aws_sns_topic.sns_topic_name.arn}"
      ]
    }
  }
}

当我运行地形计划时，它不会显示任何错误。不管如何运行terraform应用程序，我得到：Policy is invalid. Reason: Each statement in the policy should have exactly one resource。是否有一种方法可以为资源名添加一个变量，该变量在附加到所述队列时会被队列的名称所替代？

以下是我的队列和队列策略的样子：

resource "aws_sqs_queue" "queue_name" {
    name                       = "queue_name_${var.environment}"
    visibility_timeout_seconds = 30
    message_retention_seconds  = 345600
    max_message_size           = 262144
    delay_seconds              = 0
    receive_wait_time_seconds  = 0
}


resource "aws_sqs_queue_policy" "queue_name_policy" {
  queue_url = "${aws_sqs_queue.queue_name.id}"
  policy    = "${data.aws_iam_policy_document.my_policy.json}"
}

Answer 1

是否有一种方法可以为资源名添加一个变量，该变量在附加到所述队列时会被队列的名称所替代？

Terraform有一个使用 meta-parameter的循环迭代机制。

我没有这么多地使用过，而且我目前无法实际测试下面的代码，因此，对于一个小的免责声明，我认为我可能是错误的，我认为这应该是可行的：

variable "number_of_queues" {
  default = 3
}

resource "aws_sqs_queue" "queue_name" {
  count = "${var.number_of_queues}"
  name  = "queue_name_${count.index}"
  // Other properties omitted
}

data "aws_iam_policy_document" "my_policy" {
  count = "${var.number_of_queues}"
  statement {
    resources = [
      "${aws_sqs_queue.queue_name[count.index].arn}",
    ]

    // Other properties omitted
  }
}

resource "aws_sqs_queue_policy" "queue_name_policy" {
  count = "${var.number_of_queues}"
  queue_url = "${aws_sqs_queue.queue_name[count.index].id}"
  policy    = "${data.aws_iam_policy_document.my_policy[count.index].json}"
}

您可能不得不使用 function而不是方括号--不确定。