AWS SCP配置导致Terraform IAM密码策略更新403错误排查

问题场景 #

使用Terraform更新IAM账户密码策略时触发SCP的403拒绝错误，错误信息如下：

aws_iam_account_password_policy.strict: Creating...

Error: updating IAM Account Password Policy: operation error IAM: UpdateAccountPasswordPolicy,  
https response error StatusCode: 403, RequestID: xxx, api error  
AccessDenied: User: arn:aws:sts::XXX:assumed-role/AWSAFTExecution/aws-go-sdk-XXX  
is not authorized to perform: iam:UpdateAccountPasswordPolicy on  
resource: * with an explicit deny in a service control policy

对应的SCP配置：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "iam:UpdateAccountPasswordPolicy"
      ],
      "Resource": "*",
      "Condition": {
        "ArnNotLike": {
          "aws:PrincipalARN": [
            "arn:aws:iam::*:role/AWSAFTExecution/*",
            "arn:aws:sts::*:assumed-role/AWSAFTExecution/*",
            "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*/AWSReservedSSO_AWSOrganizationsFullAccess*",
            "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*/AWSReservedSSO_AWSAdministratorAccess*"
          ]
        }
      }
    }
  ]
}

问题原因 #

你的SCP匹配规则存在两个关键问题：

1. IAM角色规则匹配范围过窄：arn:aws:iam::*:role/AWSAFTExecution/*要求角色名必须包含斜杠（如AWSAFTExecution/SubRole），但你的实际角色是AWSAFTExecution（无斜杠），因此该规则无法匹配目标角色的IAM ARN。
2. STS扮演角色规则存在匹配边界限制：arn:aws:sts::*:assumed-role/AWSAFTExecution/*虽然理论上能匹配带会话名称的扮演角色ARN，但AWS对斜杠后的通配符处理存在严格限制，导致无法正常匹配你的STS扮演角色ARN。

解决方法 #

修改SCP中的PrincipalARN匹配规则，放宽匹配范围：

• 将IAM角色规则改为arn:aws:iam::*:role/AWSAFTExecution*，匹配所有以AWSAFTExecution开头的角色（包括主角色和子角色）。
• 将STS扮演角色规则改为arn:aws:sts::*:assumed-role/AWSAFTExecution*，匹配该角色的所有扮演实例（无论是否携带会话名称）。

修改后的SCP配置：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "iam:UpdateAccountPasswordPolicy"
      ],
      "Resource": "*",
      "Condition": {
        "ArnNotLike": {
          "aws:PrincipalARN": [
            "arn:aws:iam::*:role/AWSAFTExecution*",
            "arn:aws:sts::*:assumed-role/AWSAFTExecution*",
            "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*/AWSReservedSSO_AWSOrganizationsFullAccess*",
            "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*/AWSReservedSSO_AWSAdministratorAccess*"
          ]
        }
      }
    }
  ]
}

调整后，你的AWSAFTExecution角色的IAM ARN和STS扮演ARN都会被纳入允许列表，Terraform即可正常执行密码策略更新操作。

内容的提问来源于stack exchange，提问作者Tobias Bruckert