Terraform部署AWS SCP触发MalformedPolicyDocumentException报错排查

问题背景 #

尝试通过Terraform为AWS组织创建限制区域的服务控制策略（SCP），配置中使用aws_iam_policy_document生成策略内容，执行terraform apply时触发MalformedPolicyDocumentException错误，已定位问题出在not_actions相关配置。

报错原因 #

AWS SCP不允许在同一条策略语句（Statement）中同时使用actions和not_actions字段。你的配置里同时定义了actions = ["*"]和not_actions列表，违反了SCP的语法规则，导致策略文档格式校验失败。

修复方案 #

移除语句中的actions = ["*"]字段，仅保留not_actions来排除无需限制的全局服务操作。SCP会自动对不在not_actions列表内的所有操作应用Deny效果（结合区域条件）。

修正后的完整代码 #

data "aws_iam_policy_document" "restrict-regions-policy" {
  version = "2012-10-17"
  statement {
    sid    = "RegionRestriction"
    effect = "Deny"
    not_actions = [
      "a4b:*",
      "acm:*",
      "aws-marketplace-management:*",
      "aws-marketplace:*",
      "aws-portal:*",
      "budgets:*",
      "ce:*",
      "chime:*",
      "cloudfront:*",
      "config:*",
      "cur:*",
      "directconnect:*",
      "ec2:DescribeRegions",
      "ec2:DescribeTransitGateways",
      "ec2:DescribeVpnGateways",
      "fms:*",
      "globalaccelerator:*",
      "health:*",
      "iam:*",
      "importexport:*",
      "kms:*",
      "mobileanalytics:*",
      "networkmanager:*",
      "organizations:*",
      "pricing:*",
      "route53:*",
      "route53domains:*",
      "route53-recovery-cluster:*",
      "route53-recovery-control-config:*",
      "route53-recovery-readiness:*",
      "s3:GetAccountPublic*",
      "s3:ListAllMyBuckets",
      "s3:ListMultiRegionAccessPoints",
      "s3:PutAccountPublic*",
      "shield:*",
      "sts:*",
      "support:*",
      "trustedadvisor:*",
      "waf-regional:*",
      "waf:*",
      "wafv2:*",
      "wellarchitected:*"
    ]
    resources = ["*"]

    condition {
      test     = "StringNotEquals"
      variable = "aws:RequestedRegion"
      values = [
        "us-east-1",
        "eu-west-1",
      ]
    }
  }
}

resource "aws_organizations_policy" "restrict_regions" {
  name        = "restrict_regions"
  description = "Deny all regions except the ones we use"
  content     = data.aws_iam_policy_document.restrict-regions-policy.json
}

验证说明 #

修正后，策略逻辑为：当请求的AWS区域不在us-east-1或eu-west-1时，拒绝所有未被not_actions列表排除的操作，全局服务操作不受区域限制（已通过not_actions放行）。

你可以通过以下方式提前验证策略文档合法性：

• 将生成的JSON内容复制到AWS控制台的SCP编辑器中，系统会自动校验格式
• 使用AWS CLI命令测试：

  aws organizations create-policy --name test-restrict-regions --description "test" --content '{"Version":"2012-10-17","Statement":[{"Sid":"RegionRestriction","Effect":"Deny","NotActions":["a4b:*",...],"Resource":"*","Condition":{"StringNotEquals":{"aws:RequestedRegion":["us-east-1","eu-west-1"]}}]}' --type SERVICE_CONTROL_POLICY
  

内容的提问来源于stack exchange，提问作者Istvan