Terraform调用AWS接口报403无权限，但AWS CLI执行正常求助

我是Terraform新手，执行简单的子网查询操作时遇到无权限错误，但运行等效的AWS CLI命令能得到预期结果。操作前已通过aws sso login完成认证，也确认过所有工具都是最新版本，考虑过降级Terraform、hashicorp/aws provider或AWS CLI排查bug，但不清楚合法兼容版本，暂时假设当前版本兼容。

AWS CLI执行结果 #

% aws ec2 describe-subnets --subnet-ids subnet-XXXX --region "us-west-2"
{
    "Subnets": [
        {
            "AvailabilityZone": "us-west-2a",
            "AvailabilityZoneId": "XXX",
            "AvailableIpAddressCount": XXX,
            "CidrBlock": "XXX.XXX.XXX.XXX/XX",
            "DefaultForAz": false,
            "MapPublicIpOnLaunch": false,
            "MapCustomerOwnedIpOnLaunch": false,
            "State": "available",
            "SubnetId": "subnet-XXXX",
            "VpcId": "vpc-XXXX",
            "OwnerId": "XXXX",
            "AssignIpv6AddressOnCreation": false,
            "Ipv6CidrBlockAssociationSet": [],
            "Tags": [
                {
                    "Key": "Name",
                    "Value": "XXXXX"
                }
            ],
            "SubnetArn": "arn:aws:ec2:us-west-2:XXXXX:subnet/subnet-XXXXX",
            "EnableDns64": false,
            "Ipv6Native": false,
            "PrivateDnsNameOptionsOnLaunch": {
                "HostnameType": "ip-name",
                "EnableResourceNameDnsARecord": false,
                "EnableResourceNameDnsAAAARecord": false
            }
        }
    ]
}

Terraform执行结果 #

% terraform plan
data.aws_subnet.private1: Reading...

Planning failed. Terraform encountered an error while generating this plan.

╷
│ Error: reading EC2 Subnet: operation error EC2: DescribeSubnets, https response error StatusCode: 403, RequestID: XXX-XX-XX-XX-XXXXXXX, api error UnauthorizedOperation: You are not authorized to perform this operation. User: arn:aws:iam::XXXXXX:user/XX@XXX is not authorized to perform: ec2:DescribeSubnets with an explicit deny in an identity-based policy
│ 
│   with data.aws_subnet.private1,
│   on temp.tf line 21, in data "aws_subnet" "private1":
│   21: data "aws_subnet" "private1" {

版本信息 #

% terraform version
Terraform v1.9.3
on darwin_amd64
+ provider registry.terraform.io/hashicorp/aws v5.61.0
% aws --version 
aws-cli/2.17.26 Python/3.11.9 Darwin/23.5.0 exe/x86_64

Terraform配置文件（temp.tf） #

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.61"
    }
  }
  required_version = "~> 1.9.3"
}

provider "aws" {
  region = var.aws_region
  profile = "default"
}

variable "aws_region" {
  type = string
  default = "us-west-2"
}

data "aws_subnet" "private1" {
  id = "subnet-XXXX"
}

AWS配置文件（~/.aws/config） #

[default]
aws_access_key_id = XXXXX
aws_secret_access_key = XXXXX
region = us-west-2
sso_session = default
sso_account_id = XXXXX
sso_role_name = XXX

[sso-session default]
sso_start_url = https://XXXX.awsapps.com/start
sso_region = us-west-2
sso_registration_scopes = sso:account:access

排查与解决思路 #

1. 清理AWS配置文件中的冲突凭证 #

你的~/.aws/config的[default]段同时配置了长期密钥（aws_access_key_id/aws_secret_access_key）和SSO参数，Terraform会优先使用硬编码的长期密钥，而不是SSO生成的临时凭证（AWS CLI会自动优先选择SSO会话）。

解决方法：删除[default]段中的aws_access_key_id和aws_secret_access_key两行，保留SSO相关配置：

[default]
region = us-west-2
sso_session = default
sso_account_id = XXXXX
sso_role_name = XXX

[sso-session default]
sso_start_url = https://XXXX.awsapps.com/start
sso_region = us-west-2
sso_registration_scopes = sso:account:access

2. 验证Terraform使用的身份 #

执行以下命令确认当前default profile对应的AWS身份：

aws sts get-caller-identity --profile default

对比输出的ARN和Terraform错误信息中的ARN（arn:aws:iam::XXXXXX:user/XX@XXX），如果不一致，说明Terraform未使用SSO角色身份，按第一步修改配置即可。

3. 刷新SSO凭证 #

执行命令重新获取SSO临时凭证，再测试Terraform：

aws sso login --profile default
terraform plan

4. 版本兼容性确认 #

当前使用的Terraform v1.9.3和AWS Provider v5.61.0完全支持SSO认证，无需降级，只要配置正确即可正常使用。

内容的提问来源于stack exchange，提问作者Jimbotini