Terraform多项目共用同名IAM策略遇EntityAlreadyExists错误求助

问题原因 #

AWS IAM客户管理策略的名称在整个AWS账户内是全局唯一的，所以当你在多个项目中尝试创建同名策略（比如AWSLambdaBasicExecutionRole）时，就会触发EntityAlreadyExists报错（409状态码）。

解决方案 #

根据你的需求，有三种可行方案：

1. 复用已存在的策略（推荐） #

如果多个项目需要使用完全相同的策略，不要重复创建，而是用data "aws_iam_policy"导入已存在的策略，直接引用其ARN：

# 导入已存在的AWSLambdaBasicExecutionRole策略
data "aws_iam_policy" "lambda_basic_execution" {
  arn = "arn:aws:iam::${var.account_id}:policy/AWSLambdaBasicExecutionRole"
}

# 导入已存在的AWSLambdaCloudFormationExecutionRole策略
data "aws_iam_policy" "cfn_execution" {
  arn = "arn:aws:iam::${var.account_id}:policy/AWSLambdaCloudFormationExecutionRole"
}

resource "aws_iam_role" "attach_iam_policy_to_iam_role" {
  name               = "policy-iam" # 原代码缺少引号，需补上
  assume_role_policy = data.aws_iam_policy_document.AWSLambda.json
  managed_policy_arns = [
    data.aws_iam_policy.lambda_basic_execution.arn,
    data.aws_iam_policy.cfn_execution.arn
  ]
}

# 保留原有的策略文档数据块
data "aws_iam_policy_document" "AWSLambda" {
  statement {
    actions    = ["sts:AssumeRole"]
    effect     = "Allow"
    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

2. 给策略名称添加项目唯一标识 #

如果每个项目需要独立的策略（即使内容相同），可以在策略名称中加入项目前缀/后缀，确保全局唯一：

variable "project_name" {
  type = string
  description = "项目唯一标识，比如verifieASG"
}

resource "aws_iam_policy" "policy_one" {
  name = "AWSLambdaBasicExecutionRole-${var.project_name}" # 添加项目标识

  policy = jsonencode({
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "logs:CreateLogGroup",
            "Resource": "arn:aws:logs:eu-west-1::*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": [
                "arn:aws:logs:eu-west-1::log-group:/aws/lambda/${var.project_name}:*"
            ]
        }
    ]
})
}

resource "aws_iam_policy" "policy_two" {
  name = "AWSLambdaCloudFormationExecutionRole-${var.project_name}" # 添加项目标识

  policy = jsonencode({
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "cloudformation:DescribeStacks"
            ],
            "Resource": "*"
        }
    ]
})
}

# 角色部分引用修改后的策略ARN
resource "aws_iam_role" "attach_iam_policy_to_iam_role" {
  name               = "policy-iam-${var.project_name}" # 角色名称也建议加项目标识避免冲突
  assume_role_policy = data.aws_iam_policy_document.AWSLambda.json
  managed_policy_arns = [
    aws_iam_policy.policy_one.arn,
    aws_iam_policy.policy_two.arn
  ]
}

3. 使用AWS托管策略（针对通用场景） #

对于AWSLambdaBasicExecutionRole这种通用策略，AWS已经提供了官方托管策略，直接引用其ARN即可，无需自己创建：

resource "aws_iam_role" "attach_iam_policy_to_iam_role" {
  name               = "policy-iam"
  assume_role_policy = data.aws_iam_policy_document.AWSLambda.json
  managed_policy_arns = [
    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole", # AWS托管策略ARN
    aws_iam_policy.policy_two.arn # 自定义策略保留
  ]
}

额外注意点 #

• 原代码中aws_iam_role的name = policy-iam缺少引号，会导致语法错误，需要修正为name = "policy-iam"。
• 如果使用Terraform工作区（Workspace）管理多项目，也可以结合工作区名称生成唯一策略名称，比如"AWSLambdaBasicExecutionRole-${terraform.workspace}"。

内容的提问来源于stack exchange，提问作者TukTuk