Terraform中AWS IAM角色force_detach_policies参数配置错误排查

你完全搞错了force_detach_policies参数的用途——这个参数只是个布尔值，作用是删除IAM角色时，是否强制分离关联的托管策略，根本不是用来定义权限策略的。你把内联策略内容塞到这里，Terraform肯定会报错。

正确的做法是：用aws_iam_role_policy资源单独定义内联权限策略，再绑定到你的IAM角色上。下面是修正后的完整代码：

# IAM角色核心定义（仅包含信任关系与基础属性）
resource "aws_iam_role" "get_applicant_group_file_iam_role_lambda_execution" {
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect    = "Allow"
        Principal = {
          Service = ["lambda.amazonaws.com"]
        }
        Action = ["sts:AssumeRole"]
      }
    ]
  })
  # 此处设置布尔值：true表示删除角色时强制分离关联的托管策略（若存在）
  force_detach_policies = true
  path                  = "/"
  name                  = join("-", ["backend", "dev", "getApplicantGroupFile", data.aws_region.current.name, "lambdaRole"])
  managed_policy_arns   = []
}

# 绑定到角色的内联权限策略（原错误塞在force_detach_policies里的内容）
resource "aws_iam_role_policy" "lambda_execution_permissions" {
  name   = join("-", ["backend", "dev", "lambda"])
  role   = aws_iam_role.get_applicant_group_file_iam_role_lambda_execution.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      # 日志组权限
      {
        Effect   = "Allow"
        Action   = [
          "logs:CreateLogStream",
          "logs:CreateLogGroup",
          "logs:PutLogEvents"
        ]
        Resource = [
          "arn:${data.aws_partition.current.partition}:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:log-group:/aws/lambda/backend-dev-getApplicantGroupFile:*:*"
        ]
      },
      # DynamoDB表权限
      {
        Effect   = "Allow"
        Action   = [
          "dynamodb:DescribeTable",
          "dynamodb:Query",
          "dynamodb:GetItem",
          "dynamodb:PutItem",
          "dynamodb:UpdateItem"
        ]
        Resource = [
          "arn:aws:dynamodb:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:table/job-app-backend-dev",
          "arn:aws:dynamodb:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:table/job-app-backend-dev/index/GSI1"
        ]
      },
      # S3资源权限
      {
        Effect   = "Allow"
        Action   = ["s3:GetObject"]
        Resource = "arn:aws:s3:::jobapp.pk-dev-us-east-1-media/*"
      }
    ]
  })
}

关键说明 #

• aws_iam_role只负责定义角色的信任关系（谁能扮演这个角色）和基础属性，权限策略必须单独通过aws_iam_role_policy（内联策略）或者aws_iam_policy+aws_iam_role_policy_attachment（托管策略）来绑定。
• force_detach_policies = true是可选配置，但如果后续给角色关联了托管策略，这个参数能避免删除角色时因策略绑定导致的失败。

内容的提问来源于stack exchange，提问作者Furqan Shah