amazon-web-services - Terraform aws 承担角色
问题描述
我对 AWS 使用 terraform 承担角色有疑问。
在 AWS 中,我在单个组织中拥有三个账户:root、staging 和 production(让我们只关注 root 和 staging 账户)。根账户有一个 IAM 用户terraform
(带有AdministratorAccess
策略),terraform 使用该用户来配置所有内容。
组织架构图
Root account ID: 111111111111
Staging account ID: 333333333333
一个 terraform 脚本如下所示:
############## backend.tf
terraform {
required_version = "0.12.19"
}
############## providers.tf
provider "aws" {
region = "eu-west-1"
profile = "default"
}
provider "aws" {
version = ">= 2.44"
region = "eu-west-1"
profile = "default"
assume_role {
role_arn = "arn:aws:iam::333333333333:role/staging-admin"
}
allowed_account_ids = ["333333333333"]
alias = "staging"
}
############## organization.tf
resource "aws_organizations_account" "staging" {
email = "staging@domain.com"
name = "Staging"
parent_id = "ZZZZZ"
}
############## data.tf
data "aws_iam_policy_document" "assume_staging_role" {
statement {
effect = "Allow"
actions = ["sts:AssumeRole"]
resources = [
aws_iam_role.staging.arn
]
}
}
data "aws_iam_policy" "administrator_access" {
arn = "arn:aws:iam::aws:policy/AdministratorAccess"
}
data "template_file" "cross_admin_trust_policy" {
template = file("templates/cross_admin_trust_policy.json")
vars = {
staging_account_number = aws_organizations_account.staging.id
}
}
############## iam.tf
resource "aws_iam_role" "staging" {
name = "staging-admin"
description = "Assumable role granting administrator permissions to the staging account"
assume_role_policy = data.template_file.cross_admin_trust_policy.rendered
max_session_duration = 20000
provider = aws.staging
}
resource "aws_iam_role_policy_attachment" "staging_admin_access" {
role = aws_iam_role.staging.name
policy_arn = data.aws_iam_policy.administrator_access.arn
provider = aws.staging_ireland
}
resource "aws_iam_role_policy_attachment" "staging_attach_assume_any_admin" {
role = aws_iam_role.staging.name
policy_arn = data.aws_iam_policy.administrator_access.arn
provider = aws.staging_ireland
}
和我的 policy.json 文件:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::${staging_account_number}:role/staging-admin"
},
"Action": "sts:AssumeRole"
}
]
}
当我执行terraform plan
我得到这个错误:
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.
data.aws_iam_policy.administrator_access: Refreshing state...
aws_organizations_account.staging: Refreshing state... [id=333333333333]
data.template_file.cross_admin_trust_policy: Refreshing state...
Error: The role "arn:aws:iam::333333333333:role/staging-admin" cannot be assumed.
There are a number of possible causes of this - the most common are:
* The credentials used in order to assume the role are invalid
* The credentials do not have appropriate permission to assume the role
* The role ARN is not valid
on providers.tf line 25, in provider "aws"
有人知道如何解决吗?
解决方案
根据https://aws.amazon.com/premiumsupport/knowledge-center/iam-assume-role-cli/
运行
aws sts get-caller-identity
命令以检查您的身份。运行
aws sts assume-role --role-arn arn:aws:iam::333333333333:role/staging-admin
命令以查看您的身份是否可以担任此角色。检查您的 IAM 角色的信任关系。您应该对其进行限制,以便 IAM 角色只能由特定 IAM 用户承担。
{
"Version": "2012-10-17",
"Statement": {
"Effect": "Allow",
"Principal": { "AWS": "arn:aws:iam:: 333333333333:root" },
"Action": "sts:AssumeRole"
}
}
推荐阅读
- python - 定义方法中“Try,Except,Finally”的问题
- c# - 如何检查列表中的 ID 唯一性?
- matlab - 如何从 Matlab 移植到 Headless Octave for Web
- r - 从 CSV 文件中的特定列解析 JSON
- c# - 使用 EWS 托管 API 更改回复发件人
- android - Admob 响应 loadFaild
- docker - 在 Ubuntu 上安装 docker 和 kubernetes
- algorithm - 在 O(n log k) 时间内查找重复超过 floor(n/k) 次的所有值的算法
- kotlin - 在 Kotlin 中赋值时 get() 做了什么?
- jsf - 共享模板表单 JSF