如何将多个预先存在的 AWS 托管角色附加到策略？

Posted 2023-03-04

【中文标题】如何将多个预先存在的 AWS 托管角色附加到策略？

【英文标题】：how can I attach multiple pre-existing AWS managed roles to a policy?

【发布时间】：2019-08-19 14:52:18

【问题描述】：

我想将 AWS 中的现有策略与角色相关联，我正在使用 terraform 工具

我想关联这些策略，此代码与 aws cloudformation 工具有关：

   AWSCodeCommitFullAccess
   AWSCodeBuildAdminAccess
   AWSCodeDeployFullAccess
   AWSCodePipelineFullAccess
   AWSElasticBeanstalkFullAccess

试试附件

data "aws_iam_policy" "attach-policy" 
  arn = ["arn:aws:iam::aws:policy/AWSCodeCommitFullAccess", "arn:aws:iam::aws:policy/AWSCodeBuildAdminAccess", "arn:aws:iam::aws:policy/AWSCodeDeployFullAccess", "arn:aws:iam::aws:policy/AWSCodePipelineFullAccess"]


resource "aws_iam_role_policy_attachment" "tc-role-policy-attach" 
  role = "$aws_iam_role.toolchain-role.name"

  policy_arn = "$data.aws_iam_policy.attach-policy.arn"

【问题讨论】：

到目前为止你尝试过什么？您在 Terraform 或 CloudFormation 中有任何代码吗？

尝试使用附加数据 "aws_iam_policy" "attach-policy" arn = [ "arn:aws:iam::aws:policy/AWSCodeCommitFullAccess", "arn:aws:iam::aws:策略/AWSCodeBuildAdminAccess”、“arn:aws:iam::aws:policy/AWSCodeDeployFullAccess”、“arn:aws:iam::aws:policy/AWSCodePipelineFullAccess”] 资源“aws_iam_role_policy_attachment”“tc-role-policy-attach”角色 = "$aws_iam_role.toolchain-role.name" policy_arn = "$data.aws_iam_policy.attach-policy.arn"

您应该编辑您的问题以包含您迄今为止编写的代码。完成后，您还可以将其格式化为代码块，以使其更易于阅读。

这会导致错误：│错误：属性值类型不正确 属性“arn”的值不合适：需要字符串。当我通过数据 "aws_iam_policy" "attach_policy" 中的 arns 列表时。有什么想法，我该如何解决？

【参考方案1】：

您使用 terraform 资源 aws_iam_role_policy_attachment 朝着正确的方向前进，但需要进行一些调整。

AWS 托管策略的ARN 存在于系统中。例如，如果您需要将第一个托管策略附加到 IAM 角色，

resource "aws_iam_role_policy_attachment" "test-policy-AWSCodeCommitFullAccess" 
  policy_arn = "arn:aws:iam::aws:policy/AWSCodeCommitFullAccess"
  role       = "$aws_iam_role.toolchain-role.name"

您可以一一添加其他托管策略。

如果你想一起做，你可以试试下面的代码

variable "managed_policies" 
  default = ["arn:aws:iam::aws:policy/AWSCodeCommitFullAccess",
    "arn:aws:iam::aws:policy/AWSCodeBuildAdminAccess",
    "arn:aws:iam::aws:policy/AWSCodeDeployFullAccess",
    "arn:aws:iam::aws:policy/AWSCodePipelineFullAccess",
  ]


resource "aws_iam_role_policy_attachment" "tc-role-policy-attach" 
  count      = "$length(var.managed_policies)"
  policy_arn = "$element(var.managed_policies, count.index)"
  role       = "$aws_iam_role.toolchain-role.name"

【讨论】：

list[index] 语法比使用element() 更可取，只要您不需要循环返回具有高于列表长度的索引的列表。