在AWS IAM Policy Document中用Dynamic块条件创建策略报错

我希望基于布尔值s3_logging_enabled和elb_logging_enabled创建AWS IAM策略，预期可生成0、1或2条策略语句，但执行代码时报错，错误信息如下：

Error: Unsupported block type...
in data "aws_iam_policy_document" "s3_logging_service":

13: dynamic "s3_logging_policy" {
Blocks of type "s3_logging_policy" are not expected here.

当前使用的代码：

data "aws_iam_policy_document" "s3_logging_service" {

  statement {
    actions = [
      "s3:PutObject"
    ]
    effect = "Allow"

    dynamic "s3_logging_policy" {
      for_each = var.s3_logging_enabled == true ? [1] : []

      content {
        sid = "AllowAwsS3LoggingService"
        resources = [
          local.bucket_arn,
        ]
        principals {
          type        = "Service"
          identifiers = ["logging.s3.amazonaws.com"]
        }
      }
    }

    dynamic "elb_logging_policy" {
      for_each = var.elb_logging_enabled ? [1] : []

      sid = "EnableELBLogging"
      resources = [
        local.bucket_arn,
      ]
      principals {
        type        = "AWS"
        identifiers = ["arn:aws:iam::${local.elb_account_id}:root"]
      }
    }
  }
}

报错核心是你在statement块内定义了自定义动态块类型s3_logging_policy和elb_logging_policy，但Terraform的aws_iam_policy_document数据源不支持这类自定义块。

正确做法是用动态块直接生成statement块本身，因为你需要根据布尔值控制独立策略语句的生成数量。修复后的代码如下：

data "aws_iam_policy_document" "s3_logging_service" {
  # 生成S3日志服务授权语句
  dynamic "statement" {
    for_each = var.s3_logging_enabled ? [1] : []
    
    content {
      sid       = "AllowAwsS3LoggingService"
      effect    = "Allow"
      actions   = ["s3:PutObject"]
      resources = [local.bucket_arn]
      
      principals {
        type        = "Service"
        identifiers = ["logging.s3.amazonaws.com"]
      }
    }
  }

  # 生成ELB日志授权语句
  dynamic "statement" {
    for_each = var.elb_logging_enabled ? [1] : []
    
    content {
      sid       = "EnableELBLogging"
      effect    = "Allow"
      actions   = ["s3:PutObject"]
      resources = [local.bucket_arn]
      
      principals {
        type        = "AWS"
        identifiers = ["arn:aws:iam::${local.elb_account_id}:root"]
      }
    }
  }
}

关键说明 #

• 每个dynamic "statement"块独立控制一条策略语句的生成：对应布尔值为true时生成语句，为false则跳过。
• 每条语句包含完整的权限配置，逻辑独立清晰，完全符合aws_iam_policy_document的语法规范。

内容的提问来源于stack exchange，提问作者Krzysztof Pagacz