如何将多个预先存在的 AWS 托管角色附加到策略？答案

【问题标题】：how can I attach multiple pre-existing AWS managed roles to a policy?如何将多个预先存在的 AWS 托管角色附加到策略？
【发布时间】：2019-08-19 14:52:18
【问题描述】：

我想将 AWS 中的现有策略与角色相关联，我正在使用 terraform 工具

我想关联这些策略，此代码与 aws cloudformation 工具有关：

   AWSCodeCommitFullAccess
   AWSCodeBuildAdminAccess
   AWSCodeDeployFullAccess
   AWSCodePipelineFullAccess
   AWSElasticBeanstalkFullAccess

试试附件

data "aws_iam_policy" "attach-policy" {
  arn = ["arn:aws:iam::aws:policy/AWSCodeCommitFullAccess", "arn:aws:iam::aws:policy/AWSCodeBuildAdminAccess", "arn:aws:iam::aws:policy/AWSCodeDeployFullAccess", "arn:aws:iam::aws:policy/AWSCodePipelineFullAccess"]
}

resource "aws_iam_role_policy_attachment" "tc-role-policy-attach" {
  role = "${aws_iam_role.toolchain-role.name}"

  policy_arn = "${data.aws_iam_policy.attach-policy.arn}"
}

【问题讨论】：

到目前为止你尝试过什么？您在 Terraform 或 CloudFormation 中有任何代码吗？
尝试使用附加数据 "aws_iam_policy" "attach-policy" { arn = [ "arn:aws:iam::aws:policy/AWSCodeCommitFullAccess", "arn:aws:iam::aws:策略/AWSCodeBuildAdminAccess”、“arn:aws:iam::aws:policy/AWSCodeDeployFullAccess”、“arn:aws:iam::aws:policy/AWSCodePipelineFullAccess”] } 资源“aws_iam_role_policy_attachment”“tc-role-policy-attach”{角色 = "${aws_iam_role.toolchain-role.name}" policy_arn = "${data.aws_iam_policy.attach-policy.arn}" }
您应该编辑您的问题以包含您迄今为止编写的代码。完成后，您还可以将其格式化为代码块，以使其更易于阅读。
这会导致错误：│错误：属性值类型不正确属性“arn”的值不合适：需要字符串。当我通过数据 "aws_iam_policy" "attach_policy" 中的 arns 列表时。有什么想法，我该如何解决？

标签： amazon-cloudformation terraform

【解决方案1】：

您使用 terraform 资源 aws_iam_role_policy_attachment 朝着正确的方向前进，但需要进行一些调整。

AWS 托管策略的ARN 存在于系统中。例如，如果您需要将第一个托管策略附加到 IAM 角色，

resource "aws_iam_role_policy_attachment" "test-policy-AWSCodeCommitFullAccess" {
  policy_arn = "arn:aws:iam::aws:policy/AWSCodeCommitFullAccess"
  role       = "${aws_iam_role.toolchain-role.name}"
}

您可以一一添加其他托管策略。

如果你想一起做，你可以试试下面的代码

variable "managed_policies" {
  default = ["arn:aws:iam::aws:policy/AWSCodeCommitFullAccess",
    "arn:aws:iam::aws:policy/AWSCodeBuildAdminAccess",
    "arn:aws:iam::aws:policy/AWSCodeDeployFullAccess",
    "arn:aws:iam::aws:policy/AWSCodePipelineFullAccess",
  ]
}

resource "aws_iam_role_policy_attachment" "tc-role-policy-attach" {
  count      = "${length(var.managed_policies)}"
  policy_arn = "${element(var.managed_policies, count.index)}"
  role       = "${aws_iam_role.toolchain-role.name}"
}

【讨论】：

list[index] 语法比使用element() 更可取，只要您不需要循环返回具有高于列表长度的索引的列表。