使用Terraform在AWS创建组织级S3策略时遇AccessDeniedException

尝试用Terraform为AWS组织创建并附加S3安全传输策略时，遇到AccessDeniedException，无法创建组织策略。

Terraform配置代码 #

data "aws_iam_policy_document" "block_s3_insecure_http_access" {
    # dome9 requirement - disallow all insecure access
    statement {
      principals {
        type        = "AWS"
        identifiers = ["*"]
      }
      resources = [
        "arn:aws:s3:::*"
      ]
      effect = "Deny"
      actions = [
        "s3:*"
      ]
      condition {
        test = "Bool"
        variable = "aws:SecureTransport"
        values = [
          "false"
        ]
      }
    }
}

resource "aws_organizations_policy" "block_s3_insecure_http_access" {
  name    = "block s3 insecure http access"
  content = data.aws_iam_policy_document.block_s3_insecure_http_access.json
}

resource "aws_organizations_policy_attachment" "block_s3_insecure_http_access" {
  policy_id = aws_organizations_policy.block_s3_insecure_http_access.id
  target_id = data.aws_caller_identity.current.account_id
}

报错信息 #

aws_organizations_policy.block_s3_insecure_http_access: Creating...
╷
│ Error: error creating Organizations Policy (block s3 insecure http access): AccessDeniedException: You don't have permissions to access this resource.
│ 
│   with aws_organizations_policy.block_s3_insecure_http_access,
│   on organization.tf line 26, in resource "aws_organizations_policy" "block_s3_insecure_http_access":
│   26: resource "aws_organizations_policy" "block_s3_insecure_http_access" {
│ 
╵
Releasing state lock. This may take a few moments...

Exited with code exit status 1

• 检查IAM身份权限：创建组织策略需要organizations:CreatePolicy权限，附加策略需要organizations:AttachPolicy权限。确保执行Terraform的角色/用户已被授予这些权限，且如果是管理账号操作，身份拥有组织管理的完整权限。
• 确认操作账号身份：AWS组织策略只能由组织的管理账号创建，成员账号无法直接创建组织级策略。如果当前用的是成员账号身份，切换到管理账号再执行。
• 验证组织服务状态：确保AWS Organizations服务已在管理账号中启用，且账号状态正常（管理账号默认启用，但需确认无异常限制）。
• 测试CLI命令排查：用相同IAM身份执行以下CLI命令，验证是否能创建策略：

  aws organizations create-policy --name "test-block-s3-insecure" --content '{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::*","Condition":{"Bool":{"aws:SecureTransport":"false"}}}],"Version":"2012-10-17"}' --type SERVICE_CONTROL_POLICY
  

  如果CLI也报权限错误，说明是IAM权限问题；如果CLI成功，检查Terraform的AWS Provider配置是否使用了正确的账号/角色。
• 核对策略格式：组织策略支持的IAM语法有细微限制，确保策略中没有使用不支持的元素（aws:SecureTransport是合法条件键，此处无需修改）。

内容的提问来源于stack exchange，提问作者Farhad-Taran