如何用Terraform templatefile函数结合local.principals替换role.json值

实现步骤： #

1. 将静态JSON转为模板文件
   把原role.json重命名为role.tmpl，将需要动态替换的固定值替换为模板变量：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "${lambda_service}"
            },
            "Action": "sts:AssumeRole"
        },
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "${scheduler_service}"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "${principals[environment]}"
                }
            }
        }
    ]
}

2. 完善Terraform配置
   更新本地变量，传递必要参数给templatefile函数：

locals {
  # 不同环境对应的AWS账号ID
  principals = {
    ad-cloud-sandbox-env = "11051234"
    dev                  = "123456788"
    prod                 = "78900001"
  }
  # 可配置的服务账号变量
  lambda_service     = "lambda.amazonaws.com"
  scheduler_service  = "scheduler.amazonaws.com"
  # 指定当前部署环境
  current_environment = "dev" # 可根据实际场景改为外部变量传入
}

output "generated_role_config" {
  value = templatefile("${path.module}/role.tmpl", {
    principals          = local.principals
    environment         = local.current_environment
    lambda_service      = local.lambda_service
    scheduler_service   = local.scheduler_service
  })
}

3. 批量生成多环境配置（可选）
   如果需要为每个环境单独生成配置，用for_each遍历principals map：

output "all_environment_role_configs" {
  value = {
    for env, _ in local.principals : env => templatefile("${path.module}/role.tmpl", {
      principals          = local.principals
      environment         = env
      lambda_service      = local.lambda_service
      scheduler_service   = local.scheduler_service
    })
  }
}

说明： #

• 通过principals[environment]从map中动态获取对应环境的AWS账号ID，替换aws:SourceAccount的固定值。
• 将原固定的服务账号（lambda.amazonaws.com、scheduler.amazonaws.com）提取为变量，方便后续统一维护修改。
• 模板文件和Terraform配置需放在同一模块目录下，或通过path.module指定正确路径。

内容的提问来源于stack exchange，提问作者Latha