Terraform配置AWS Organizations备份策略遇格式错误异常排查

核心遗漏配置要点排查 #

1. 必须指定正确的策略类型 #

AWS Organizations的aws_organizations_policy资源默认类型为SERVICE_CONTROL_POLICY，而备份策略需要明确指定type = "BACKUP_POLICY"，这是触发该错误最常见的原因。
示例配置：

resource "aws_organizations_policy" "backup_policy" {
  name        = "org-backup-policy"
  description = "Organization-wide backup policy"
  type        = "BACKUP_POLICY" # 此配置不可省略
  content     = file("backup-policy.json")
}

2. 备份策略文档需遵循专属JSON结构 #

备份策略不是IAM策略，不能使用IAM策略的Version、Statement等字段，必须采用AWS备份策略的专属结构，核心包含plans、rules、selections等块。正确示例结构：

{
  "plans": {
    "MyOrgBackupPlan": {
      "regions": ["us-east-1", "us-west-2"],
      "rules": {
        "DailyBackup": {
          "schedule_expression": "cron(0 12 * * ? *)",
          "target_vault_name": "org-backup-vault",
          "lifecycle": {
            "delete_after_days": 30
          }
        }
      },
      "selections": {
        "MyBackupSelection": {
          "iam_role_arn": "arn:aws:iam::123456789012:role/BackupRole",
          "resources": ["arn:aws:ec2:*:*:volume/*"]
        }
      }
    }
  }
}

3. 变量渲染需保证JSON格式合法 #

使用templatefile时，要确保渲染后的JSON无语法错误：

• 变量替换后不能出现未闭合引号、多余逗号
• 传入的ARN、Vault名称等参数格式需正确（如Vault ARN格式为arn:aws:backup:region:account-id:vault/vault-name）
  示例模板文件（backup-policy.tpl.json）：

{
  "plans": {
    "MyOrgBackupPlan": {
      "regions": ${jsonencode(regions)},
      "rules": {
        "DailyBackup": {
          "schedule_expression": "cron(0 12 * * ? *)",
          "target_vault_name": "${vault_name}",
          "lifecycle": {
            "delete_after_days": ${retention_days}
          }
        }
      },
      "selections": {
        "MyBackupSelection": {
          "iam_role_arn": "${iam_role_arn}",
          "resources": ["arn:aws:ec2:*:*:volume/*"]
        }
      }
    }
  }
}

Terraform调用示例：

resource "aws_organizations_policy" "backup_policy" {
  name        = "org-backup-policy"
  description = "Organization-wide backup policy"
  type        = "BACKUP_POLICY"
  content     = templatefile("backup-policy.tpl.json", {
    regions        = ["us-east-1", "us-west-2"]
    vault_name     = "org-backup-vault"
    retention_days = 30
    iam_role_arn   = "arn:aws:iam::123456789012:role/BackupRole"
  })
}

4. 提前验证策略文档合法性 #

可通过AWS CLI命令提前验证策略内容，获取更详细的错误提示：

aws organizations validate-policy --policy-type BACKUP_POLICY --content file://backup-policy.json

内容的提问来源于stack exchange，提问作者Mornor