Question

我正在尝试使用AWS和Terraform与Secretsmanager一起工作。我有一个文件，其中包含有关角色以及我要管理的角色的所有信息

data "aws_iam_policy_document" "ecs_task_execution_role" {
version = "2012-10-17"
statement{
  sid = ""
  effect = "Allow"
  actions = ["sts:AssumeRole"]

  principals {
    type        = "Service"
    identifiers = ["ecs-tasks.amazonaws.com",
                "secretsmanager.amazonaws.com"]
  }
 }
}

resource "aws_iam_role" "ecs_task_execution_role" {
  name               = var.ecs_task_execution_role_name
  assume_role_policy = 
  data.aws_iam_policy_document.ecs_task_execution_role.json
}

resource "aws_iam_role_policy_attachment" "ecs_task_execution_role" {
  role       = aws_iam_role.ecs_task_execution_role.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
 }

当我编写它时，它不起作用，我想使用secretsmanager：GetSecretValue，它显示一个错误，提示：

 Fetching secret data from AWS Secrets Manager in region xxxxx: secret arn:aws:secretsmanager:xxxxx:xxxxxxx:secret:name_value-AdGDbr: AccessDeniedException: User: arn:aws:sts::xxxxxxxxxxx:assumed-role/myEcsTaskExecutionRole/d340cba6-979f-4da1-b4be-d750fc8bd1e9 is not authorized to perform: secretsmanager:GetSecretValue on resource: arn:aws:secretsmanager:xxxxx:xxxxxx:secret:name_value-AdGDbr status code: 400, request id: 2670987f-11a1-48d0-b20f-ce6077bd3bea

同样，当我尝试执行操作[“ sts：AssumeRole”，“ secretsmanager：GetSecretValue”]时，它也无法正常工作，并且我也出现了此错误：

Error: Error creating IAM Role myEcsTaskExecutionRole: MalformedPolicyDocument: AssumeRole policy may only specify STS AssumeRole actions.
status code: 400, request id: 4fc091d4-d524-11e9-b4ab-b56d84ddb1ca

我如何附加此权限才能使用Secretsmanager？非常感谢

Answer 1

最后，这太简单了，只需要添加一个具有新名称和不同policy_arn的新资源即可。

resource "aws_iam_role_policy_attachment" "ecs_task_execution_role_2" {
    role       = aws_iam_role.ecs_task_execution_role.name
    policy_arn = "arn:aws:iam::aws:policy/SecretsManagerReadWrite"
}

这是您拥有的

在AWS中为角色附加新权限

1 个答案: