如何使用授予對創建的SQS的訪問權限的策略創建iam角色

我使用 main.tf 中的代碼創建了 2 個 SQS 和 DeadLetterQueue，呼叫 SQS/main.tf 模塊。我想銷毀并再次創建它們，但這一次，我也想呼叫 IAM/iam_role.tf 來創建一個 IAM 角色和策略檔案。我不知道如何在我的 main.tf 中指定它，以便資料策略檔案的資源部分同時創建了 CloudTrail_SQS，意思是“CloudTrail_SQS_Data_Event”和“cloudTrail_SQS_Management_Event”以及資源 arn S3 的角色可以訪問用于 SQS 的 2 個不同的存盤桶，即“cloudtrail-management-event-logs”和“aws-cloudtrail143-sqs-logs”

SQS/main.tf

resource "aws_sqs_queue" "CloudTrail_SQS"{
    name                       = var.sqs_queue_name
    redrive_policy = jsonencode({
        deadLetterTargetArn    = aws_sqs_queue.CloudTrail_SQS_DLQ.arn
        maxReceiveCount        = 4
    })
}
resource "aws_sqs_queue" "CloudTrail_SQS_DLQ"{
    name                       = var.dead_queue_name

IAM/iam_role.tf

resource "aws_iam_role" "access_role" {
  name               = var.role_name
  description        = var.description
  assume_role_policy = data.aws_iam_policy_document.trust_relationship.json
}

trust policy

data "aws_iam_policy_document" "trust_relationship" {
  statement {
    sid     = "AllowAssumeRole"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = [var.account_id]
    }

    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"

      values = [var.external_id]
    }
  }
}

data "aws_iam_policy_document" "policy_document"{
  statement{
    actions = [
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
      "sqs:SendMessage"
    ]
    effect = "Allow"
    resources = aws_sqs_queue.CloudTrail_SQS.arn
  }
  statement {
    actions = ["sqs:ListQueues"]
    effect  = "Allow"
    resources = ["*"]
  }
  statement {
    actions = ["s3:GetObject", "s3:GetBucketLocation"]
    resources = [
      "arn:aws:s3:::${var.cloudtrail_event_log_bucket_name}/*"
    ]
    effect = "Allow"
  }
  statement {
    actions = ["s3:ListBucket"]
    resources = [
      "arn:aws:s3:::${var.cloudtrail_event_log_bucket_name}"
    ]
    effect = "Allow"
  }
  statement {
    actions = ["kms:Decrypt", "kms:GenerateDataKey","kms:DescribeKey" ]
    effect = "Allow"
    resources = [var.kms_key_arn]
  }
}

main.tf

module "data_events"{
  source = "../SQS"

  cloudtrail_event_log_bucket_name = "aws-cloudtrail143-sqs-logs"
  sqs_queue_name                   = "CloudTrail_SQS_Data_Event"
  dead_queue_name                  = "CloudTrail_DLQ_Data_Event"
}


module "management_events"{
  source = "../SQS"

  cloudtrail_event_log_bucket_name = "cloudtrail-management-event-logs"
  sqs_queue_name                   = "cloudTrail_SQS_Management_Event"
  dead_queue_name                  = "cloudTrail_DLQ_Management_Event"

}

uj5u.com熱心網友回復：

您可以使用terraform的資料源。

這時候，你應該為SQS檔案夾寫輸出，將它們作為資料寫入IAM檔案夾并使用它

uj5u.com熱心網友回復：

角色將按如下所示創建。但是你的問題有很多錯誤和缺失的資訊，不可能提供完整的、有效的代碼。因此，應將以下代碼視為模板，您需要對其進行調整以供使用。

resource "aws_iam_role" "access_role" {
  name               = var.role_name
  description        = var.description
  
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Sid    = ""
        Principal = {
          Service = "ec2.amazonaws.com"
        }
      },
    ]
  })
  
  inline_policy {
    name   = "allow-access-to-s3-sqs"
    policy = data.aws_iam_policy_document.policy_document.json
  }  
  
}


data "aws_iam_policy_document" "policy_document"{
  statement{
    actions = [
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
      "sqs:SendMessage"
    ]
    effect = "Allow"
    resources = [
           module.data_events.sqs.arn,
           module.management_events.sqs.arn,
           ]
  }
  statement {
    actions = ["sqs:ListQueues"]
    effect  = "Allow"
    resources = ["*"]
  }
  statement {
    actions = ["s3:GetObject", "s3:GetBucketLocation"]
    resources = [
      "arn:aws:s3:::aws-cloudtrail143-sqs-logs/*"
      "arn:aws:s3:::cloudtrail-management-event-logs/*"
    ]
    effect = "Allow"
  }
  statement {
    actions = ["s3:ListBucket"]
    resources = [
      "arn:aws:s3:::aws-cloudtrail143-sqs-logs",
      "arn:aws:s3:::cloudtrail-management-event-logs"      
    ]
    effect = "Allow"
  }
  statement {
    actions = ["kms:Decrypt", "kms:GenerateDataKey","kms:DescribeKey" ]
    effect = "Allow"
    resources = [var.kms_key_arn]
  }
}

標籤：亚马逊网络服务 地形

上一篇：未通過SSH連接時無法訪問AWSEC2實體URL

下一篇：使用承擔角色從lambda訪問S3