Terraform跨区域部署报错：如何跳过已存在的SSM IAM角色直接关联？

问题根源 #

IAM角色、实例配置文件属于AWS全局资源，不区分区域。同一AWS账户下，同名的IAM角色只能存在一个，跨区域部署时在多个区域的模块中重复定义该资源，就会触发already exists错误。

解决方案 #

方案1：将IAM资源抽离为独立全局模块（推荐） #

把IAM角色、实例配置文件、关联策略单独放在一个独立的Terraform配置中，仅部署一次。其他区域的EC2模块通过模块引用或远程状态读取的方式复用这些全局资源，从根源避免重复创建冲突。

示例：

1. 全局IAM模块（modules/iam-ssm/main.tf）：

resource "aws_iam_role" "ssm_role" {
  name = "dev-ssm-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "ec2.amazonaws.com"
        }
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "ssm_policy" {
  role       = aws_iam_role.ssm_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
}

resource "aws_iam_instance_profile" "ssm_instance_profile" {
  name = "dev-ssm-instance-profile"
  role = aws_iam_role.ssm_role.name
}

output "instance_profile_name" {
  value = aws_iam_instance_profile.ssm_instance_profile.name
}

2. 区域EC2模块中引用：

module "iam_ssm" {
  source = "../modules/iam-ssm"
}

resource "aws_instance" "example" {
  ami           = "ami-xxxxxx"
  instance_type = "t2.micro"
  iam_instance_profile = module.iam_ssm.instance_profile_name
  # 其他EC2配置...
}

方案2：在当前模块中动态判断并复用已存在资源 #

通过Terraform数据源查询已存在的IAM资源，结合count控制资源创建逻辑，仅当资源不存在时才执行创建操作：

1. 定义数据源查询已存在的角色和实例配置文件：

data "aws_iam_role" "existing_ssm_role" {
  name = "dev-ssm-role"
}

data "aws_iam_instance_profile" "existing_ssm_ip" {
  name = "dev-ssm-instance-profile"
}

2. 条件式创建资源：

# 仅当查询不到角色时创建
resource "aws_iam_role" "ssm_role" {
  count = try(data.aws_iam_role.existing_ssm_role.name, null) == null ? 1 : 0
  name = "dev-ssm-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "ec2.amazonaws.com"
        }
      }
    ]
  })
}

# 仅当角色为当前模块创建时关联策略
resource "aws_iam_role_policy_attachment" "ssm_policy" {
  count = length(aws_iam_role.ssm_role) > 0 ? 1 : 0
  role       = aws_iam_role.ssm_role[0].name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
}

# 仅当查询不到实例配置文件时创建
resource "aws_iam_instance_profile" "ssm_ip" {
  count = try(data.aws_iam_instance_profile.existing_ssm_ip.name, null) == null ? 1 : 0
  name = "dev-ssm-instance-profile"
  role = length(aws_iam_role.ssm_role) > 0 ? aws_iam_role.ssm_role[0].name : data.aws_iam_role.existing_ssm_role.name
}

3. EC2实例动态引用实例配置文件：

resource "aws_instance" "example" {
  ami           = "ami-xxxxxx"
  instance_type = "t2.micro"
  iam_instance_profile = try(data.aws_iam_instance_profile.existing_ssm_ip.name, null) != null ? data.aws_iam_instance_profile.existing_ssm_ip.name : aws_iam_instance_profile.ssm_ip[0].name
  # 其他EC2配置...
}

方案3：手动导入已存在资源到Terraform状态 #

如果资源已经存在，可通过terraform import将其导入当前Terraform状态，后续部署时Terraform会识别资源已存在，直接跳过创建步骤：

# 导入已存在的SSM角色
terraform import aws_iam_role.ssm_role dev-ssm-role
# 导入已存在的实例配置文件
terraform import aws_iam_instance_profile.ssm_ip dev-ssm-instance-profile

执行导入后，再次运行terraform plan或terraform apply，Terraform会直接将实例配置文件关联到EC2实例并执行剩余代码。

内容的提问来源于stack exchange，提问作者charan tej