使用Python Pulumi获取AWS托管策略创建Glue角色报错解决

你尝试创建绑定AWS托管策略AWSGlueServiceRole的AWS Glue角色，编写的Pulumi Python代码如下：

import json
from pulumi_aws import iam
from pulumi_aws.iam import Role

def get_access_bucket_role(role_name: str, bucket_name: str, tags) -> Role:
        assume_role_policy = json.dumps(
            {
                "Version": "2012-10-17",
                "Statement": [
                    {
                        "Effect": "Allow",
                        "Principal": {"Service": ["glue.amazonaws.com"]},
                        "Action": "sts:AssumeRole",
                    }
                ],
            }
        )
        iam.get_policy
        return iam.Role(
            role_name,
            assume_role_policy=assume_role_policy,
            inline_policies=iam.get_policy(arn="arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole"),
            path="/my-path/",
            permissions_boundary="arn:aws:iam::XXX:policy/my-boundary",
            tags=tags,
        )

运行代码时触发以下错误：

AttributeError: 'NoneType' object has no attribute 'Invoke'

错误原因 #

1. 参数使用错误：inline_policies参数需要的是自定义内联策略的键值对，而AWS托管策略AWSGlueServiceRole不能直接赋值给这个参数，需通过角色策略关联资源绑定。
2. 无效代码：代码中iam.get_policy是未调用的空语句，且iam.get_policy用于查询现有策略，不能直接作为角色属性传入。

修正后的代码 #

import json
from pulumi_aws import iam
from pulumi_aws.iam import Role

def get_access_bucket_role(role_name: str, bucket_name: str, tags) -> Role:
    # 定义Glue服务的信任策略
    assume_role_policy = json.dumps(
        {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Principal": {"Service": ["glue.amazonaws.com"]},
                    "Action": "sts:AssumeRole",
                }
            ],
        }
    )

    # 创建IAM角色
    glue_role = iam.Role(
        role_name,
        assume_role_policy=assume_role_policy,
        path="/my-path/",
        permissions_boundary="arn:aws:iam::XXX:policy/my-boundary",
        tags=tags,
    )

    # 绑定AWS托管策略到角色
    iam.RolePolicyAttachment(
        f"{role_name}-glue-policy-attachment",
        role=glue_role.name,
        policy_arn="arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole",
    )

    return glue_role

关键修改说明 #

• 移除错误的inline_policies参数，改用iam.RolePolicyAttachment资源专门关联托管策略与角色
• 删除无效的iam.get_policy空语句
• 拆分角色创建与策略绑定的逻辑，符合Pulumi资源管理的规范

内容的提问来源于stack exchange，提问作者Guilherme Noronha