如何配置IAM角色以通过Terraform访问AWS OpenSearch Service域

开发者阿泽

2026-7-7

解决Terraform管理AWS OpenSearch的401权限问题

1. 修正Terraform Provider配置

将sign_aws_requests设为true——通过IAM身份访问OpenSearch必须开启AWS请求签名，否则OpenSearch无法识别IAM权限：

provider "opensearch" {
  aws_region = "<region>"
  aws_profile = "<profile>"
  healthcheck = true
  url = "<domain_url>"
  sign_aws_requests = true  # 关键修正：启用AWS请求签名
  aws_assume_role_arn = "<role_arn>"
}

2. 调整IAM角色的信任策略

信任策略的Principal需指向执行Terraform的本地身份（比如你AWS配置文件对应的IAM用户/角色ARN），而非es.amazonaws.com——因为是Terraform进程需要Assume该角色，不是OpenSearch服务。示例策略：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::<account_no>:user/your-terraform-exec-user"  # 替换为实际执行Terraform的身份ARN
            },
            "Action": "sts:AssumeRole",
            "Condition": {}
        }
    ]
}

3. 给IAM角色配置OpenSearch管理权限

确保目标角色拥有足够的OpenSearch管理权限，可直接附加AmazonOpenSearchServiceFullAccess托管策略，或自定义精细权限：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "es:*"
            ],
            "Resource": "arn:aws:es:<region>:<account_no>:domain/<your-domain-name>/*"
        }
    ]
}

4. 确保本地身份具备AssumeRole权限

执行Terraform的本地AWS身份（即aws_profile对应的用户/角色）需要拥有sts:AssumeRole权限，允许它获取目标角色的临时凭证：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "<your-target-role-arn>"
        }
    ]
}