Terraform创建IAM角色报错：MalformedPolicyDocument含禁止字段Resource

你遇到的MalformedPolicyDocument: Has prohibited field Resource错误，核心原因是把权限策略当成了信任策略传给了IAM角色模块。

IAM角色有两种核心策略，规则完全不同：

• 信任策略：仅负责定义谁能扮演这个角色，只能包含Principal、sts:AssumeRole动作，绝对不允许出现Resource字段。
• 权限策略：负责定义角色拥有的操作权限，才需要Resource、Actions这类字段来限定操作范围。

从你的plan输出能看到，LambdaModifyLightsailSnapshotsRole的assume_role_policy里直接塞入了包含Resource的权限策略，这违反了IAM信任策略的规则。

拆分策略，分别创建信任策略和权限策略，再正确关联到角色上：

1. 创建信任策略（允许Lambda服务扮演角色） #

data "aws_iam_policy_document" "lambda_trust_policy" {
  statement {
    sid       = "AllowLambdaAssumeRole"
    effect    = "Allow"
    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
    actions = ["sts:AssumeRole"]
  }
}

2. 保留并明确权限策略（定义角色的操作权限） #

data "aws_iam_policy_document" "lambda_permission_policy" {
  statement {
    sid       = "LightsailFullAccess"
    effect    = "Allow"
    resources = ["arn:aws:lightsail:::*"]
    not_actions = [
      "lightsail:GetInstanceAccessDetails",
      "lightsail:GetRelationalDatabaseMasterUserPassword"
    ]
  }

  statement {
    sid       = "LogsFullAccess"
    effect    = "Allow"
    resources = ["arn:aws:logs:::*"]
    actions   = ["logs:*"]
  }
}

3. 将权限策略转为IAM实体策略 #

resource "aws_iam_policy" "lambda_lightsail_policy" {
  name        = "LambdaModifyLightsailSnapshotsPolicy"
  description = "Policy to Create / Delete Lightsail Snapshots"
  policy      = data.aws_iam_policy_document.lambda_permission_policy.json
}

4. 修正模块配置，关联正确的策略 #

module "iam_assumable_role_custom_trust_policy" {
  source  = "terraform-aws-modules/iam/aws//modules/iam-assumable-role"
  version = "5.33.0"

  create_role                     = true
  role_name                       = "LambdaModifyLightsailSnapshotsRole"
  role_description                = "Role for Lambda to manage Lightsail snapshots"
  create_custom_role_trust_policy = true
  custom_role_trust_policy        = data.aws_iam_policy_document.lambda_trust_policy.json

  # 附加权限策略到角色
  managed_policy_arns = [aws_iam_policy.lambda_lightsail_policy.arn]
}

调整后，信任策略仅负责授权Lambda服务扮演角色，权限策略负责定义角色能执行的操作，完全符合IAM规则，即可解决报错问题。

内容的提问来源于stack exchange，提问作者Dino