时间戳

首页 > 解决方案 > 如何在 Terraform for Amazon ECR 中创建 IAM 角色？

amazon-web-services - 如何在 Terraform for Amazon ECR 中创建 IAM 角色？

问题描述

在这个答案的后面，我正在尝试创建一个aws_iam_role允许访问 ECR 的。但是，当我定义以下内容时：

resource "aws_iam_role" "jenkins_ecr_role" {
  name = "JenkinsECRRole"

  assume_role_policy = <<END_OF_POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "ecr.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
END_OF_POLICY
}

我得到错误：

Error: Error creating IAM Role JenkinsECRRole:
MalformedPolicyDocument: Invalid principal in policy: "SERVICE":"*"

ecr.amazonaws.com根据 AWS 文档，它看起来像是一个有效的委托人。我究竟做错了什么？

标签： amazon-web-servicesterraformamazon-iamterraform-provider-awsamazon-ecr

解决方案

似乎这个问题还没有得到完全回答，所以我将尝试举例说明我是如何为我的 gitlab-runner ec2 实例添加 ecr 的。首先，ec2 实例需要一个iam_instance_profile您似乎已经拥有的实例。第二：您需要assume-role使实例能够承担服务的角色。 请注意，我可以访问所有资源，而不仅仅是特定资源（您可以根据需要进行调整）

角色

resource "aws_iam_role" "role" {
  name               = "${local.env}-role"
  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": ["ec2.amazonaws.com"]
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF

}

允许访问 ECR 的策略

resource "aws_iam_policy" "policy" {
  name = "${local.env}-ecr-access-policy"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "ecr:*",
        ]
        Effect   = "Allow"
        Resource = "*"
      },
    ]
  })
}

策略对角色的附加

resource "aws_iam_policy_attachment" "attach" {
  name       = "${local.env}-attach"
  roles      = ["${aws_iam_role.role.name}"]
  policy_arn = "${aws_iam_policy.policy.arn}"
}

最后是 EC2 需要的配置文件

resource "aws_iam_instance_profile" "profile" {
  name = "${local.env}-gitlab-runner-instance-profile"
  role = aws_iam_role.role.name
}

EC2 实例

resource "aws_instance" "ec2" {
  ami                         = "ami-06c94f9acb4ba21b2"
  instance_type               = "t2.small"
  associate_public_ip_address = true
  key_name                    = "<key_name>"
  subnet_id                   = <subnet>
  iam_instance_profile        = aws_iam_instance_profile.profile.name
  vpc_security_group_ids      = ["<security_group>"]

  tags = {
    Environment = "dev"
  }
}

推荐阅读