如何为TerraformAdmin配置权限以自动化AWS多账户管理？

一、管理账户中TerraformAdmin的核心IAM权限策略 #

给TerraformAdmin用户附加以下权限策略，覆盖组织管理、跨账户角色切换的核心需求：

{
    "Version": "2012-10-17",
    "Statement": [
        // 组织架构与账户创建权限
        {
            "Effect": "Allow",
            "Action": [
                "organizations:CreateOrganizationalUnit",
                "organizations:CreateAccount",
                "organizations:DescribeAccount",
                "organizations:ListAccounts",
                "organizations:ListOrganizationalUnitsForParent",
                "organizations:MoveAccount"
            ],
            "Resource": "*"
        },
        // 允许切换到子账户的目标角色（可根据需求限定角色范围）
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::*:role/OrganizationAccountAccessRole"
        }
    ]
}

二、自动化修改子账户角色信任策略 #

默认的OrganizationAccountAccessRole仅信任父组织根账户，需通过Terraform自动修改其信任策略，添加TerraformAdmin用户作为可信主体。以下是Terraform配置片段：

// 创建子账户
resource "aws_organizations_account" "app_dev" {
  name  = "app-dev"
  email = "app-dev@example.com"
}

// 配置子账户的AWS提供者，通过默认角色切换访问
provider "aws" {
  alias  = "app_dev"
  assume_role {
    role_arn = "arn:aws:iam::${aws_organizations_account.app_dev.id}:role/OrganizationAccountAccessRole"
  }
}

// 修改子账户默认角色的信任策略，允许TerraformAdmin访问
resource "aws_iam_role" "app_dev_access_role" {
  provider = aws.app_dev
  name     = "OrganizationAccountAccessRole"
  assume_role_policy = jsonencode({
    "Version" : "2012-10-17",
    "Statement" : [
      // 保留原有父组织根账户的信任权限
      {
        "Effect" : "Allow",
        "Principal" : {
          "AWS" : "arn:aws:iam::[父组织根账户ID]:root"
        },
        "Action" : "sts:AssumeRole"
      },
      // 添加TerraformAdmin用户作为可信主体
      {
        "Effect" : "Allow",
        "Principal" : {
          "AWS" : "arn:aws:iam::[管理账户ID]:user/TerraformAdmin"
        },
        "Action" : "sts:AssumeRole"
      }
    ]
  })
}

三、最小权限优化方案（推荐） #

若不想修改默认角色，可在子账户中创建专用的Terraform部署角色，严格控制权限范围：

// 在子账户创建Terraform专用角色
resource "aws_iam_role" "tf_deploy_role" {
  provider = aws.app_dev
  name     = "TerraformDeployRole"
  assume_role_policy = jsonencode({
    "Version" : "2012-10-17",
    "Statement" : [
      {
        "Effect" : "Allow",
        "Principal" : {
          "AWS" : "arn:aws:iam::[管理账户ID]:user/TerraformAdmin"
        },
        "Action" : "sts:AssumeRole"
      }
    ]
  })
}

// 给专用角色附加必要权限（示例为管理员权限，可根据实际需求缩小范围）
resource "aws_iam_role_policy_attachment" "tf_deploy_perms" {
  provider = aws.app_dev
  role       = aws_iam_role.tf_deploy_role.name
  policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
}

同时更新管理账户中TerraformAdmin的sts:AssumeRole权限，将Resource改为新角色的ARN：

{
    "Effect": "Allow",
    "Action": "sts:AssumeRole",
    "Resource": "arn:aws:iam::*:role/TerraformDeployRole"
}

四、关键注意事项 #

• 子账户创建后需等待1-2分钟才能正常通过AssumeRole访问，可在Terraform中添加time_sleep资源避免报错；
• 严格遵循最小权限原则，避免给角色赋予过宽的权限，比如针对VPC、LB等资源配置精细化权限；
• 若使用GitLab/GitHub CI，确保TerraformAdmin的密钥已正确存入CI密钥库，且流水线环境已配置AWS CLI或Terraform的AWS提供者。

内容的提问来源于stack exchange，提问作者Richard Howell-Peak