我正在嘗試使用跨賬戶策略創建存盤庫。對于每個帳戶只需要一個角色的存盤庫，它可以與以下代碼一起正常作業：
#X-Account Policy for the repositories
data "aws_iam_policy_document" "components_policy" {
statement {
sid = "AllowPushPull"
effect = "Allow"
actions = [
"ecr:BatchCheckLayerAvailability",
"ecr:BatchGetImage",
"ecr:CompleteLayerUpload",
"ecr:GetDownloadUrlForLayer",
"ecr:InitiateLayerUpload",
"ecr:PutImage",
"ecr:UploadLayerPart"
]
principals {
type = "AWS"
identifiers = [
for account_id in var.whitelisting :
"arn:aws:iam::${account_id}:role/eks-node-role"
]
}
}
}
當我嘗試將 3 個角色的帳戶列入白名單時，就會出現問題。我嘗試了以下方法，但它不起作用：
#X-Account Policy for the repositories
data "aws_iam_policy_document" "components_policy" {
statement {
sid = "AllowPushPull"
effect = "Allow"
actions = [
"ecr:BatchCheckLayerAvailability",
"ecr:BatchGetImage",
"ecr:CompleteLayerUpload",
"ecr:GetDownloadUrlForLayer",
"ecr:InitiateLayerUpload",
"ecr:PutImage",
"ecr:UploadLayerPart"
]
principals {
type = "AWS"
identifiers = [
for account_id in var.whitelisting :
<<EOF
"arn:aws:iam::${account_id}:role/eks-node-role-1",
"arn:aws:iam::${account_id}:role/eks-node-role-2",
"arn:aws:iam::${account_id}:role/eks-node-role-3"
EOF
]
}
}
}
嵌套 for 回圈是不可能的，所以我目前正在查看動態塊，但到目前為止我無法掌握是否可以通過它們來做到這一點。任何幫助將不勝感激，謝謝。
uj5u.com熱心網友回復：
您正在使用的 here-document 功能（<<EOFto EOF）將生成一個大字串，而不是陣列元素的串列。這最終會導致您的值格式不正確。
我沒有對此進行測驗，但請嘗試以下操作：
identifiers = flatten([
for account_id in var.whitelisting :
["arn:aws:iam::${account_id}:role/eks-node-role-1",
"arn:aws:iam::${account_id}:role/eks-node-role-2",
"arn:aws:iam::${account_id}:role/eks-node-role-3"]
])
上面將創建一個串列串列，然后使用 Terraform flatten函式將其轉換為適合 IAMidentifiers屬性的單個值串列。
轉載請註明出處，本文鏈接：https://www.uj5u.com/yidong/495467.html