amazon-web-services - 如何使用授予对创建的 SQS 的访问权限的策略创建 iam 角色

Question

我使用 main.tf 中调用 SQS/main.tf 模块的代码创建了 2 个 SQS 和 DeadLetterQueue。我想再次销毁并创建它们，但这次，我也想调用 IAM/iam_role.tf 来创建一个 IAM 角色连同策略文档。我不知道如何在我的 main.tf 中指定它，以便数据策略文档的资源部分同时创建 CloudTrail_SQS，意思是“CloudTrail_SQS_Data_Event”和“cloudTrail_SQS_Management_Event”以及资源 arn的 S3 授予角色访问用于 SQS 的 2 个不同存储桶的权限，即“cloudtrail-management-event-logs”和“aws-cloudtrail143-sqs-logs”

SQS/main.tf

resource "aws_sqs_queue" "CloudTrail_SQS"{
    name                       = var.sqs_queue_name
    redrive_policy = jsonencode({
        deadLetterTargetArn    = aws_sqs_queue.CloudTrail_SQS_DLQ.arn
        maxReceiveCount        = 4
    })
}
resource "aws_sqs_queue" "CloudTrail_SQS_DLQ"{
    name                       = var.dead_queue_name

IAM/iam_role.tf

resource "aws_iam_role" "access_role" {
  name               = var.role_name
  description        = var.description
  assume_role_policy = data.aws_iam_policy_document.trust_relationship.json
}

trust policy

data "aws_iam_policy_document" "trust_relationship" {
  statement {
    sid     = "AllowAssumeRole"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = [var.account_id]
    }

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"

      values = [var.external_id]
    }
  }
}

data "aws_iam_policy_document" "policy_document"{
  statement{
    actions = [
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
      "sqs:SendMessage"
    ]
    effect = "Allow"
    resources = aws_sqs_queue.CloudTrail_SQS.arn
  }
  statement {
    actions = ["sqs:ListQueues"]
    effect  = "Allow"
    resources = ["*"]
  }
  statement {
    actions = ["s3:GetObject", "s3:GetBucketLocation"]
    resources = [
      "arn:aws:s3:::${var.cloudtrail_event_log_bucket_name}/*"
    ]
    effect = "Allow"
  }
  statement {
    actions = ["s3:ListBucket"]
    resources = [
      "arn:aws:s3:::${var.cloudtrail_event_log_bucket_name}"
    ]
    effect = "Allow"
  }
  statement {
    actions = ["kms:Decrypt", "kms:GenerateDataKey","kms:DescribeKey" ]
    effect = "Allow"
    resources = [var.kms_key_arn]
  }
}

main.tf

module "data_events"{
  source = "../SQS"

  cloudtrail_event_log_bucket_name = "aws-cloudtrail143-sqs-logs"
  sqs_queue_name                   = "CloudTrail_SQS_Data_Event"
  dead_queue_name                  = "CloudTrail_DLQ_Data_Event"
}


module "management_events"{
  source = "../SQS"

  cloudtrail_event_log_bucket_name = "cloudtrail-management-event-logs"
  sqs_queue_name                   = "cloudTrail_SQS_Management_Event"
  dead_queue_name                  = "cloudTrail_DLQ_Management_Event"

}

标签： amazon-web-servicesterraform

Answer 1

将创建角色，如下所示。但是您的问题有很多错误和缺失的信息，因此不可能提供完整的工作代码。因此，下面的代码应该被视为一个模板，您需要对其进行调整以供使用。

resource "aws_iam_role" "access_role" {
  name               = var.role_name
  description        = var.description
  
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Sid    = ""
        Principal = {
          Service = "ec2.amazonaws.com"
        }
      },
    ]
  })
  
  inline_policy {
    name   = "allow-access-to-s3-sqs"
    policy = data.aws_iam_policy_document.policy_document.json
  }  
  
}


data "aws_iam_policy_document" "policy_document"{
  statement{
    actions = [
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
      "sqs:SendMessage"
    ]
    effect = "Allow"
    resources = [
           module.data_events.sqs.arn,
           module.management_events.sqs.arn,
           ]
  }
  statement {
    actions = ["sqs:ListQueues"]
    effect  = "Allow"
    resources = ["*"]
  }
  statement {
    actions = ["s3:GetObject", "s3:GetBucketLocation"]
    resources = [
      "arn:aws:s3:::aws-cloudtrail143-sqs-logs/*"
      "arn:aws:s3:::cloudtrail-management-event-logs/*"
    ]
    effect = "Allow"
  }
  statement {
    actions = ["s3:ListBucket"]
    resources = [
      "arn:aws:s3:::aws-cloudtrail143-sqs-logs",
      "arn:aws:s3:::cloudtrail-management-event-logs"      
    ]
    effect = "Allow"
  }
  statement {
    actions = ["kms:Decrypt", "kms:GenerateDataKey","kms:DescribeKey" ]
    effect = "Allow"
    resources = [var.kms_key_arn]
  }
}