Terraform中如何拼接AWS ARN列表：合并托管策略ARN与自定义策略ARN用于IAM角色配置

我懂你卡在哪了——Terraform的变量定义是静态的，没法在变量的default里引用还没创建出来的资源属性，毕竟得先解析变量，才会去部署IAM策略资源。不过有两种简单的办法能搞定这个需求：

方法1：直接在策略附件资源中合并列表 #

把托管策略的列表保留在变量里，然后在aws_iam_role_policy_attachment资源中，用concat把变量列表和自定义策略的ARN合并成完整的策略列表，再基于这个合并后的列表创建附件：

# 先修改变量，移除AmazonS3FullAccess
variable "iam_policy_arn_list" {
  type        = list(string)
  description = "IAM Policies to be attached to role"
  default = [
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::aws:policy/AmazonSESFullAccess"
  ]
}

# 你的自定义S3桶权限策略保持不变
resource "aws_iam_policy" "specific_s3_bucket_policy" {
  name        = "my_name"
  description = "Grant access to one specific S3 bucket"
  policy = jsonencode({
    "Version" : "2012-10-17",
    "Statement" : [
      {
        "Effect" : "Allow",
        "Action" : [
          "s3:ListAllMyBuckets",
          "s3:ListBucket"
        ],
        "Resource" : "*"
      },
      {
        "Effect" : "Allow",
        "Action" : [
          "s3:PutObject",
          "s3:PutObjectAcl",
          "s3:GetObject",
          "s3:GetObjectAcl",
          "s3:DeleteObject"
        ],
        "Resource" : "arn:aws:s3:::${var.S3_BUCKET_NAME}/*"
      }
    ]
  })
}

# 修改策略附件资源，基于合并后的列表创建
resource "aws_iam_role_policy_attachment" "role-policy-attachment" {
  role       = "${var.prefix}${var.role_name}"
  # 计算合并后的总策略数量
  count      = length(concat(var.iam_policy_arn_list, [aws_iam_policy.specific_s3_bucket_policy.arn]))
  # 从合并后的列表中取对应索引的ARN
  policy_arn = concat(var.iam_policy_arn_list, [aws_iam_policy.specific_s3_bucket_policy.arn])[count.index]
  depends_on = [aws_iam_role.iam_for_lambda]
}

这里的核心是让count和policy_arn都基于合并后的动态列表来生成，Terraform会自动处理依赖关系：先创建自定义策略拿到ARN，再和变量里的托管策略合并，最后逐个创建策略附件。

方法2：用Local值统一管理所有策略ARN #

如果觉得直接在资源里写concat不够清晰，可以用locals把所有要附加的策略ARN统一组合起来，让代码更易读和维护：

variable "iam_policy_arn_list" {
  type        = list(string)
  description = "IAM Policies to be attached to role"
  default = [
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "arn:aws:iam::aws:policy/AmazonSESFullAccess"
  ]
}

resource "aws_iam_policy" "specific_s3_bucket_policy" {
  name        = "my_name"
  description = "Grant access to one specific S3 bucket"
  policy = jsonencode({
    "Version" : "2012-10-17",
    "Statement" : [
      {
        "Effect" : "Allow",
        "Action" : [
          "s3:ListAllMyBuckets",
          "s3:ListBucket"
        ],
        "Resource" : "*"
      },
      {
        "Effect" : "Allow",
        "Action" : [
          "s3:PutObject",
          "s3:PutObjectAcl",
          "s3:GetObject",
          "s3:GetObjectAcl",
          "s3:DeleteObject"
        ],
        "Resource" : "arn:aws:s3:::${var.S3_BUCKET_NAME}/*"
      }
    ]
  })
}

# 用Local值组合托管策略和自定义策略的ARN
locals {
  all_iam_policy_arns = concat(
    var.iam_policy_arn_list,
    [aws_iam_policy.specific_s3_bucket_policy.arn]
  )
}

# 基于Local值创建策略附件
resource "aws_iam_role_policy_attachment" "role-policy-attachment" {
  role       = "${var.prefix}${var.role_name}"
  count      = length(local.all_iam_policy_arns)
  policy_arn = local.all_iam_policy_arns[count.index]
  depends_on = [aws_iam_role.iam_for_lambda]
}

这种方式把合并逻辑抽离出来，后续如果要添加更多策略，直接修改local.all_iam_policy_arns即可，代码结构更清晰。

为什么原来的方法行不通？ #

Terraform的变量是在配置加载阶段就确定的，而资源的属性（比如aws_iam_policy.specific_s3_bucket_policy.arn）是在资源部署阶段才生成的，所以变量的default字段根本没法引用还不存在的资源值。而把合并逻辑放在resource或locals里，Terraform会自动处理依赖顺序，确保自定义策略创建完成后再去合并列表。

内容的提问来源于stack exchange，提问作者Magnus