Terraform中为Lambda的CreateUser函数添加专属IAM权限

方案1：创建独立IAM角色（适合权限差异较大的场景） #

这种方式给CreateUser单独创建包含通用权限+专属权限的IAM角色，其他函数继续使用原通用角色。

• 添加专属角色与策略
  拆分通用权限和专属权限，创建新的IAM角色并附加对应策略：

  # 保留原有通用Lambda执行角色
  resource "aws_iam_role" "lambda_exec_role" {
    # 原有通用角色配置（比如信任策略）...
  }
  
  # CreateUser专属IAM角色
  resource "aws_iam_role" "create_user_lambda_role" {
    name = "CreateUserLambdaRole"
  
    assume_role_policy = jsonencode({
      Version = "2012-10-17"
      Statement = [
        {
          Action = "sts:AssumeRole"
          Effect = "Allow"
          Principal = {
            Service = "lambda.amazonaws.com"
          }
        }
      ]
    })
  }
  
  # 通用Lambda权限策略（所有函数共用的基础权限，如日志写入）
  resource "aws_iam_policy" "lambda_common_policy" {
    name        = "LambdaCommonPolicy"
    description = "Common permissions for Lambda functions"
  
    policy = jsonencode({
      Version = "2012-10-17"
      Statement = [
        {
          Effect = "Allow"
          Action = [
            "logs:CreateLogGroup",
            "logs:CreateLogStream",
            "logs:PutLogEvents"
          ]
          Resource = "arn:aws:logs:*:*:*"
        }
        # 其他通用权限，如数据库读取等...
      ]
    })
  }
  
  # CreateUser专属权限策略（仅该函数需要的权限，如数据写入）
  resource "aws_iam_policy" "create_user_lambda_policy" {
    name        = "CreateUserLambdaPolicy"
    description = "Exclusive permissions for CreateUser Lambda"
  
    policy = jsonencode({
      Version = "2012-10-17"
      Statement = [
        {
          Effect = "Allow"
          Action = [
            "dynamodb:PutItem"
            # 补充其他专属权限
          ]
          Resource = "arn:aws:dynamodb:*:*:table/Users"
        }
      ]
    })
  }
  
  # 为通用角色附加通用策略
  resource "aws_iam_role_policy_attachment" "lambda_common_attach" {
    role       = aws_iam_role.lambda_exec_role.name
    policy_arn = aws_iam_policy.lambda_common_policy.arn
  }
  
  # 为CreateUser角色同时附加通用+专属策略
  resource "aws_iam_role_policy_attachment" "create_user_common_attach" {
    role       = aws_iam_role.create_user_lambda_role.name
    policy_arn = aws_iam_policy.lambda_common_policy.arn
  }
  
  resource "aws_iam_role_policy_attachment" "create_user_exclusive_attach" {
    role       = aws_iam_role.create_user_lambda_role.name
    policy_arn = aws_iam_policy.create_user_lambda_policy.arn
  }
  

• 修改Lambda配置，为CreateUser指定专属角色
  更新lambda_functions局部变量，给每个函数单独配置角色ARN：

  locals {
    common_env_vars = {
      DATABASE_NAME     = var.database_name
    }
  
    lambda_config = {
      filename         = "empty.zip"
      source_code_hash = ""
      handler          = "index.handler"
      runtime          = "nodejs20.x"
      timeout          = var.default_timeout / 1000
      environment = {
        variables = local.common_env_vars
      }
    }
  
    lambda_functions = {
      "GetUser" = { 
        function_name = "GetUser"
        role          = aws_iam_role.lambda_exec_role.arn
      }
      "CreateUser" = { 
        function_name = "CreateUser"
        role          = aws_iam_role.create_user_lambda_role.arn
      }
    }
  }
  

• 更新Lambda资源定义
  修改aws_lambda_function.functions，从each.value中读取对应角色：

  resource "aws_lambda_function" "functions" {
    for_each = local.lambda_functions
  
    function_name    = each.value.function_name
    filename         = local.lambda_config.filename
    source_code_hash = local.lambda_config.source_code_hash
    handler          = local.lambda_config.handler
    runtime          = local.lambda_config.runtime
    timeout          = local.lambda_config.timeout
    role             = each.value.role # 读取每个函数的专属角色
  
    environment {
      variables = merge(
        local.lambda_config.environment.variables,
        lookup(local.lambda_specific_env_vars, each.key, {})
      )
    }
  }
  

方案2：在通用角色中添加条件策略（适合权限差异较小的场景） #

如果不想创建新角色，可以给通用角色的专属权限添加条件限制，仅允许CreateUser函数使用：

• 修改通用权限策略，添加条件限制

  resource "aws_iam_policy" "lambda_common_policy" {
    name        = "LambdaCommonPolicy"
    description = "Common permissions for Lambda functions"
  
    policy = jsonencode({
      Version = "2012-10-17"
      Statement = [
        # 所有Lambda共用的基础权限
        {
          Effect = "Allow"
          Action = [
            "logs:CreateLogGroup",
            "logs:CreateLogStream",
            "logs:PutLogEvents"
          ]
          Resource = "arn:aws:logs:*:*:*"
        },
        # CreateUser专属权限，通过条件限制仅该函数可用
        {
          Effect = "Allow"
          Action = [
            "dynamodb:PutItem"
            # 补充其他专属权限
          ]
          Resource = "arn:aws:dynamodb:*:*:table/Users"
          Condition = {
            StringEquals = {
              "aws:ResourceTag/aws:lambda:function-name" = "CreateUser"
            }
          }
        }
      ]
    })
  }
  

  这种方式无需修改Lambda的角色配置，所有函数仍使用通用角色，但只有CreateUser能执行专属权限的操作，配置更简洁。

内容的提问来源于stack exchange，提问作者BratZdenko