如何通过Terraform启用CloudWatch跨账户跨区域账户切换功能？

目前Terraform官方AWS Provider没有直接对应控制台中“Enable account switching”的专属资源——这个控制台功能本质是依赖跨账户IAM权限配置和CloudWatch跨账户资源共享设置实现的，以下是具体落地步骤：

1. 配置目标账户的跨账户访问策略 #

在需要切换到的目标账户中，创建IAM策略允许源账户的IAM实体访问CloudWatch资源：

resource "aws_iam_policy" "cloudwatch_cross_account_access" {
  name        = "CloudWatchCrossAccountAccess"
  description = "授权跨账户访问CloudWatch资源"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect    = "Allow"
        Principal = { AWS = "arn:aws:iam::SOURCE_ACCOUNT_ID:root" } # 替换为源账户ID或具体IAM实体ARN
        Action = [
          "cloudwatch:Describe*",
          "cloudwatch:Get*",
          "cloudwatch:List*",
          "cloudwatch:ViewDashboard"
        ]
        Resource = "*"
      }
    ]
  })
}

2. 在源账户配置切换用IAM角色 #

如果通过角色切换跨账户，在源账户创建信任目标账户的IAM角色，并附加CloudWatch访问权限：

resource "aws_iam_role" "cloudwatch_cross_account_switch_role" {
  name = "CloudWatchCrossAccountSwitchRole"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect    = "Allow"
        Principal = { AWS = "arn:aws:iam::TARGET_ACCOUNT_ID:root" } # 替换为目标账户ID
        Action    = "sts:AssumeRole"
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "cloudwatch_readonly_access" {
  role       = aws_iam_role.cloudwatch_cross_account_switch_role.name
  policy_arn = "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess"
}

3. 跨账户仪表盘共享配置（可选） #

如果需要跨账户查看自定义仪表盘，可通过null_resource调用AWS CLI配置跨账户权限（Terraform暂不支持直接配置该属性）：

resource "aws_cloudwatch_dashboard" "shared_cross_account_dashboard" {
  dashboard_name = "CrossAccountSharedDashboard"
  dashboard_body = jsonencode({
    widgets = [
      # 按需定义你的仪表盘组件
    ]
  })
}

resource "null_resource" "set_dashboard_cross_account_perms" {
  provisioner "local-exec" {
    command = <<EOT
aws cloudwatch put-dashboard-cross-account-permissions \
  --dashboard-name ${aws_cloudwatch_dashboard.shared_cross_account_dashboard.dashboard_name} \
  --grant-permissions '[{"Principal": "arn:aws:iam::TARGET_ACCOUNT_ID:root", "Actions": ["cloudwatch:ViewDashboard"]}]'
EOT
  }

  triggers = {
    dashboard_name = aws_cloudwatch_dashboard.shared_cross_account_dashboard.dashboard_name
  }
}

核心说明 #

控制台的“Enable account switching”是AWS基于已配置的跨账户IAM信任关系提供的UI快捷切换能力，没有独立的API或Terraform资源对应。只要完成上述跨账户权限配置，控制台的账户切换功能会自动生效。如果使用AWS Organizations，可启用CloudWatch组织集成来批量简化跨账户权限管理。

内容的提问来源于stack exchange，提问作者magnetik