将列表传递到 IAM 组策略模板文件

Question

我正在根据标签创建策略。每个资源的环境值都不同，所以我必须将它们添加为多个值。无法作为列表传递。尝试加入、拆分和 for 循环。 None 其中有效。请帮助。下面的代码只是将值添加为“beta，test”，这不会按预期工作

main.tf

locals{
    workspaceValues = terraform.workspace == "dev" ? ["alpha", "dev"] : terraform.workspace == "test" ? ["beta", "test"] : ["prod", "staging"]
}

resource "aws_iam_group_policy" "inline_policy" {
  name   = "${terraform.workspace}_policy"
  group  = aws_iam_group.backend_admin.name
  policy = templatefile("policy.tpl", { env = join(",", local.workspaceValues), region = "${data.aws_region.current.name}", account_id = "${data.aws_caller_identity.current.account_id}" })
}

policy.tpl:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ec2:*",
            "Resource": "*",
            "Condition": {
                "ForAllValues:StringLikeIfExists": {
                    "aws:ResourceTag/Environment": "${env}"
                }
            }
        }
    ]
}

Answer 1

您可以使用 jsonencode 将 TF 列表正确格式化为模板中 json 中的列表：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ec2:*",
            "Resource": "*",
            "Condition": {
                "ForAllValues:StringLikeIfExists": {
                    "aws:ResourceTag/Environment": ${jsonencode(env)}
                }
            }
        }
    ]
}

为此，您可以按如下方式调用模板：

resource "aws_iam_group_policy" "inline_policy" {
  name   = "${terraform.workspace}_policy"
  group  = aws_iam_group.backend_admin.name
  policy = templatefile("policy.tpl", { 
                        env = local.workspaceValues
                       })
}

您没有在模板中使用 region 或 account_id，因此没有理由将它们传入。

将列表传递到 IAM 组策略模板文件

Passing List to IAM Group Policy Template file

amazon-web-services

amazon-iam

terraform

terraform-provider-aws