Question

我正在创建尝试使用aws_iam_policy_attachment附加两个AWS托管策略和一个自定义策略。但是，即使申请已完成，Terraform仍坚持要更新每个计划。

我很困惑，我们将不胜感激。

有关我的Terraform的应用，请参见下文。

data "aws_iam_policy" "test_amazon_ecs_task_execution_role_policy" {
  arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}

data "aws_iam_policy" "test_amazon_elastic_map_reduce_full_access" {
  arn = "arn:aws:iam::aws:policy/AmazonElasticMapReduceFullAccess"
}

data "template_file" "test_assume_role_policy" {
 template = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Effect": "Allow"
    }
  ]
}
POLICY
}

resource "aws_iam_role" "test_role" {
 name               = "${var.env}-test-role"
 assume_role_policy = "${data.template_file.test_assume_role_policy.rendered}"
 description        = "IAM role for granting test policies"
}

resource "aws_iam_policy" "test_policy" {
 name        = "${var.env}-test-policy"
 path        = "/"
 description = "IAM Policy for granting test permissions"
 policy = <<EOF
{
     "Version": "2012-10-17",
     "Statement": [
        {
            "Action": [
                "s3:*"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
   ]
}
EOF
}

resource "aws_iam_policy_attachment" "test_amazon_ecs_task_execution_role_policy_attachment" {
 name       = "${var.env}-test-amazon-ecs-task-execution-role-policy-attachment"
 roles      = "${aws_iam_role.test_role.name}"
 policy_arn = "${data.aws_iam_policy.test_amazon_ecs_task_execution_role_policy.arn}"
}

resource "aws_iam_policy_attachment" "test_amazon_elastic_map_reduce_full_access_attachment" {
 name       = "${var.env}-test-amazon-elastic-map-reduce-full-access-attachment"
 roles      = ["${aws_iam_role.test_role.name}"]
 policy_arn = "${data.aws_iam_policy.test_amazon_elastic_map_reduce_full_access.arn}"
}

resource "aws_iam_policy_attachment" "test_policy_attachment" {
 name       = "${var.env}-test-policy-attachment"
 roles      = ["${aws_iam_role.test_role.name}"]
 policy_arn = "${aws_iam_policy.test_policy.arn}"
}

Answer 1

如果我们省略了roles = "${aws_iam_role.test_role.name}"中的错字，您应该在该值附近使用[]，那么该代码应该可以正常工作，并且除非您为{{ 1}}。

同时，您可以利用var.env使代码更简洁：

aws_iam_policy_document

Terraform不断更新aws_iam_policy_attachment

1 个答案: