为何Terraform未压缩该IAM策略JSON？

尝试在IAM角色中使用AWSBackupServiceRolePolicyForBackup策略，编写的Terraform配置如下：

data "aws_iam_policy" "aws_backup_service_policy" {
  arn = "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup"
}

resource "aws_iam_role_policy" "backup_service_aws_backup_role_policy" {
  policy = data.aws_iam_policy.aws_backup_service_policy.policy
  role   = aws_iam_role.backup_service_role.name
}

执行时触发错误：

Error: putting IAM role policy terraform-20240401140929162200000001: LimitExceeded: Maximum policy size of 10240 bytes exceeded for role foundry-terraform-backup-service-role-dev

尝试通过JSON编解码压缩策略：

resource "aws_iam_role_policy" "backup_service_aws_backup_role_policy" {
  policy = jsonencode(jsondecode(data.aws_iam_policy.aws_backup_service_policy.policy))
  role   = aws_iam_role.backup_service_role.name
}

验证输出时JSON已被压缩，但执行apply时仍出现相同错误，请问为何策略未在apply时被压缩？

原因 #

1. AWSBackupServiceRolePolicyForBackup作为AWS托管的服务角色策略，本身内容体积较大，即便通过jsonencode(jsondecode(...))压缩掉空格，节省的空间也有限，加上该角色可能已附加的其他内嵌策略，总大小依然超过了IAM角色内嵌策略10KB的限制。
2. 你使用的aws_iam_role_policy资源是将策略内容直接嵌入到角色中，无论是否压缩，都会占用角色内嵌策略的空间额度，这才是触发错误的核心原因，而非压缩是否生效。

正确解法 #

不要通过内嵌策略的方式复制托管策略内容，改用aws_iam_role_policy_attachment资源直接关联托管策略的ARN。这种方式不会将策略内容复制到角色中，而是通过引用ARN关联，完全不占用角色内嵌策略的空间额度。

修改后的Terraform配置：

resource "aws_iam_role_policy_attachment" "backup_service_policy_attachment" {
  role       = aws_iam_role.backup_service_role.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup"
}

内容的提问来源于stack exchange，提问作者Epithet