将新权限附加到 AWS 中的角色答案

【问题标题】：Attaching new Permissions to role in AWS将新权限附加到 AWS 中的角色
【发布时间】：2020-01-14 15:19:29
【问题描述】：

我正在尝试通过 aws 和 terraform 与 secretsmanager 合作。我有一个文件，其中包含有关角色的所有信息，以及有关我要管理的角色的所有信息

data "aws_iam_policy_document" "ecs_task_execution_role" {
version = "2012-10-17"
statement{
  sid = ""
  effect = "Allow"
  actions = ["sts:AssumeRole"]

  principals {
    type        = "Service"
    identifiers = ["ecs-tasks.amazonaws.com",
                "secretsmanager.amazonaws.com"]
  }
 }
}

resource "aws_iam_role" "ecs_task_execution_role" {
  name               = var.ecs_task_execution_role_name
  assume_role_policy = 
  data.aws_iam_policy_document.ecs_task_execution_role.json
}

resource "aws_iam_role_policy_attachment" "ecs_task_execution_role" {
  role       = aws_iam_role.ecs_task_execution_role.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
 }

当我写它时，它不起作用，我想使用 secretsmanager:GetSecretValue，它显示一个错误，上面写着：

 Fetching secret data from AWS Secrets Manager in region xxxxx: secret arn:aws:secretsmanager:xxxxx:xxxxxxx:secret:name_value-AdGDbr: AccessDeniedException: User: arn:aws:sts::xxxxxxxxxxx:assumed-role/myEcsTaskExecutionRole/d340cba6-979f-4da1-b4be-d750fc8bd1e9 is not authorized to perform: secretsmanager:GetSecretValue on resource: arn:aws:secretsmanager:xxxxx:xxxxxx:secret:name_value-AdGDbr status code: 400, request id: 2670987f-11a1-48d0-b20f-ce6077bd3bea

当我尝试执行操作 ["sts:AssumeRole","secretsmanager:GetSecretValue"] 时，它也不起作用，我也有这个错误：

Error: Error creating IAM Role myEcsTaskExecutionRole: MalformedPolicyDocument: AssumeRole policy may only specify STS AssumeRole actions.
status code: 400, request id: 4fc091d4-d524-11e9-b4ab-b56d84ddb1ca

如何附加此权限以使用 secretsmanager？非常感谢

【问题讨论】：

标签： terraform amazon-iam aws-secrets-manager

【解决方案1】：

最后太简单了，我只需要添加一个新名称和不同policy_arn的新资源：

resource "aws_iam_role_policy_attachment" "ecs_task_execution_role_2" {
    role       = aws_iam_role.ecs_task_execution_role.name
    policy_arn = "arn:aws:iam::aws:policy/SecretsManagerReadWrite"
}

你有这个

【讨论】：