Terraform 畸形政策

Question

我正在努力将 kms 导入到 terraform 中，我已经导入了这些资源，但是当我尝试运行 terraform 计划时，它会重新排列 arn，因此最后一个 arn 有一个逗号。因此我的地形应用失败了。

有什么方法可以避免这种重新排列？我认为在这种情况下我应该使用数据块而不是直接添加策略。但是我不确定如何传递数据块..

看来我不能使用数据块，有什么方法可以避免在 Principal 块中重新排列 arn 吗？

我正在使用 terraform 0.12.20

policy.json.tpl

{
    "Version": "2012-10-17",
    "Id": "key-policy-1",
    "Statement": [{
            "Sid": "Enable IAM User Permissions",
            "Effect": "Allow",
            "Principal": {
                "AWS": ${allowed_resources}
            },
            "Action": "kms:*",
            "Resource": "*"
        },
        {
            "Sid": "Allow use of the key",
            "Effect": "Allow",
            "Principal": {
                "AWS": ${allowed_resources}
            },
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:DescribeKey"
            ],
            "Resource": "*"
        }
    ]
}

main.tf

resource "aws_kms_key" "key" {
  description = ""
  tags        = local.common_tags
  policy      = templatefile("${path.module}/policy.json.tpl", {
    allowed_resources = var.allowed_resources
  })
}

variables.tf

variable "allowed_resources" {
  description = "list of all principal resources"
  type        = list(string)
  default = [
    "arn:aws:iam::xxxxxxxxxxxx:user/a",
    "arn:aws:iam::xxxxxxxxxxxxx:user/b",
    "arn:aws:iam::xxxxxxxxxx:user/c",
    "arn:aws:iam::xxxxxxxxxx:role/abc
  ]
}

错误

10:53:19 Error: MalformedPolicyDocumentException: Policy contains a statement with one or more invalid principals.
10:53:19 
10:53:19   on main.tf line 8, in resource "kms_key" "key":
10:53:19    8: resource "aws_kms_key" "key" {

Terraform 计划： Terraform 将执行以下操作：

  # aws_kms_key.amp_key will be updated in-place
  ~ resource "aws_kms_key" "amp_key" {
        arn                      = "arn:aws:kms:us-east-1:xxxx:key/xxx-xxx-xxx-xx-xxxxxxxx"
        customer_master_key_spec = "SYMMETRIC_DEFAULT"
        enable_key_rotation      = false
        id                       = "xxx-xxx-xxx-xx-xxxxxxxx"
        is_enabled               = true
        key_id                   = "xxx-xxx-xxx-xx-xxxxxxxx"
        key_usage                = "ENCRYPT_DECRYPT"
      ~ policy                   = jsonencode(
          ~ {
                Id        = "key-policy-1"
              ~ Statement = [
                    {
                        Action    = "kms:*"
                        Effect    = "Allow"
                        Principal = {
                            AWS = "arn:aws:iam::xxxxxxxx:root"
                        }
                        Resource  = "*"
                        Sid       = "Enable IAM User Permissions"
                    },
                  ~ {
                        Action    = [
                            "kms:Encrypt",
                            "kms:Decrypt",
                            "kms:ReEncrypt*",
                            "kms:GenerateDataKey*",
                            "kms:DescribeKey",
                        ]
                        Effect    = "Allow"
                      ~ Principal = {
                          ~ AWS = [
                              + "arn:aws:iam::xxxxxx:user/c",
                              + "arn:aws:iam::xxxxxx:user/a",
                              - "arn:aws:iam::xxxxxx:role/abc",
                              - "arn:aws:iam::xxxxxx:user/a",
                              - "arn:aws:iam::xxxxxx:user/c",
                                "arn:aws:iam::xxxxxx:user/b",
                              + "arn:aws:iam::xxxxxx:role/abc",
                         ]
                       }
                     ]
                Version   = "2012-10-17"
                     }
                 )

当我尝试使用数据块时

data "template_file" "temp_file" {
  template = "${file("${path.module}/amp_key_policy.json.tpl")}"
  vars = {
    allowed_resources = "${var.allowed_resources}" //tried without quotes
  }
}
resource "aws_kms_key" "amp_key" {
  description = ""
  tags        = local.common_tags
  policy      = data.template_file.temp_file.rendered
}

错误：属性值类型不正确

  on main.tf line 10, in data "template_file" "temp_file":
  10:   vars = {
  11:     allowed_resources = "${var.allowed_resources}"
  12:   }

属性“vars”的值不合适：元素“allowed_resources”：字符串必填。

已更新：

我尝试使用 aws_iam_policy_document。

data "aws_iam_policy_document" "amp_key_doc" {
  for_each = toset(var.allowed_resources)
  statement {
    sid    = "Enable IAM User Permissions"
    effect = "Allow"
    principals {
      identifiers = ["arn:aws:iam::xxxxx:root"]
      type        = "AWS"
    }
    actions   = ["kms:*"]
    resources = ["*"]
  }

  statement {
    sid    = "Allow access for Key Administrators"
    effect = "Allow"
    principals {
      identifiers = ["arn:aws:iam::xxxx:user/a"]
      type        = "AWS"
    }
    actions = [
      "kms:Create*",
      "kms:Describe*",
      "kms:Enable*",
      "kms:List*",
      "kms:Put*",
      "kms:Update*",
      "kms:Revoke*",
      "kms:Disable*",
      "kms:Get*",
      "kms:Delete*",
      "kms:TagResource",
      "kms:UntagResource",
      "kms:ScheduleKeyDeletion",
    "kms:CancelKeyDeletion"]
    resources = ["*"]
  }

  statement {
    sid    = "Allow use of the key"
    effect = "Allow"
    principals {
      identifiers = [var.allowed_resources]
      type        = "AWS"
    }
    actions = [
      "kms:Encrypt",
      "kms:Decrypt",
      "kms:ReEncrypt*",
      "kms:GenerateDataKey*",
      "kms:DescribeKey"
    ]
    resources = ["*"]
  }

  statement {
    sid    = "Allow attachment of persistent resources"
    effect = "Allow"
    principals {
      identifiers = [var.allowed_resources]
      type        = "AWS"
    }
    actions = [
      "kms:CreateGrant",
      "kms:ListGrants",
      "kms:RevokeGrant"
    ]
    resources = ["*"]
    condition {
      test     = "Bool"
      values   = ["true"]
      variable = "kms:GrantIsForAWSResource"
    }
  }
}


resource "aws_kms_key" "key" {
  description = ""
  tags        = local.common_tags
  policy      = data.aws_iam_policy_document.key_doc.json

出现错误，我们如何传递 allowed_resources 的整个块？

Error: Incorrect attribute value type

  on data.tf line 43, in data "aws_iam_policy_document" "key_doc":
  43:       identifiers = [var.allowed_resources]

Inappropriate value for attribute "identifiers": element 0: string required.

错误：属性值类型不正确

在 data.tf 第 60 行，数据“aws_iam_policy_document”“key_doc”中： 60: 标识符 = [var.allowed_resources]

属性“标识符”的值不合适：元素 0：需要字符串。

Answer 1

错误归结为 vars 的值仅支持 primitive types as stated in the documentation

Variables for interpolation within the template. Note that variables must all be primitives. Direct references to lists or maps will cause a validation error.

如果将策略创建为 iam_policy_document，则可以使用资源的 json 属性传递到 aws_kms_key 资源。

Terraform 畸形政策

Terraform malformed policy

amazon-web-services

terraform

aws-kms

terraform-provider-aws