对多个IAM角色应用相同的IAM策略

Question

我对不同的lambda有两个IAM角色，我希望它们都具有相同的IAM权限。

我如何才能在不复制IAM策略描述的情况下做到这一点，这是很容易出错的。

我在下面的代码中有2个IAM角色资源和2个策略资源。我知道我不能拥有他们可以使用的单一策略，但也许我至少可以将策略的JSON主体放在某个可重用的变量中？

resource "aws_iam_role" "lambda1" {
    name = "L1-LambdaRole"

    assume_role_policy = <<EOF
    {
    "Version": "2012-10-17",
    "Statement": [
        {
        "Action": "sts:AssumeRole",
        "Principal": {
            "Service": "lambda.amazonaws.com"
        },
        "Effect": "Allow",
        "Sid": ""
        }
    ]
    }
    EOF
    }


resource "aws_iam_role" "lambda2" {
    name = "L2-LambdaRole"

    assume_role_policy = <<EOF
    {
    "Version": "2012-10-17",
    "Statement": [
        {
        "Action": "sts:AssumeRole",
        "Principal": {
            "Service": "lambda.amazonaws.com"
        },
        "Effect": "Allow",
        "Sid": ""
        }
    ]
    }
    EOF
    }




resource "aws_iam_role_policy" "l1_dynamodb_policy" {
    name = "Allow_DynamoDb"
    role = "${aws_iam_role.lambda1.id}"

    policy = <<EOF
    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Action": [
                    "dynamodb:DescribeTable",
                    "dynamodb:BatchWriteItem"

                ],
                "Resource": [
                    "${aws_dynamodb_table.audtiTable.arn}"
                ]
            }
        ]
    }
    EOF
    }

resource "aws_iam_role_policy" "l2_dynamodb_policy" {
    name = "Allow_DynamoDb"
    role = "${aws_iam_role.lambda2.id}"

    policy = <<EOF
    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Action": [
                    "dynamodb:DescribeTable",
                    "dynamodb:BatchWriteItem"

                ],
                "Resource": [
                    "${aws_dynamodb_table.audtiTable.arn}"
                ]
            }
        ]
    }
    EOF
    }

Answer 1

您可以将策略定义为customer managed policy，这意味着它有自己的ARN，然后您可以使用该ARN将其附加到角色。

我对Terraform不是很熟悉，但看起来很像：https://www.terraform.io/docs/providers/aws/r/iam_policy_attachment.html