Terraform计划显示IAM策略将更新，代码无变更却疑似移除现有策略

当前IAM策略与角色已存在，未修改任何代码，但Terraform plan显示该策略将被就地更新；若执行apply操作，按计划会移除现有策略，且策略文档读取逻辑与移除操作一致。使用的AWS Provider版本为4.29。

模块中的策略代码 #

data "aws_iam_policy_document" "task_execution_role_with_cloudwatch_policy_doc" {

  count = var.container_log_driver == "awslogs" ? 1 : 0

  statement {
    actions = [
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]

    resources = [
      "${aws_cloudwatch_log_group.main[0].arn}:*"
    ]

  }

  statement {
    actions = [
      "ecr:GetAuthorizationToken",
    ]

    resources = [
      "*"
    ]
  }

  statement {
    actions = [
      "ecr:BatchCheckLayerAvailability",
      "ecr:GetDownloadUrlForLayer",
      "ecr:BatchGetImage",
    ]

    resources = var.ecr_repo_arns
  }

  statement {
    actions = [
      "ssm:Describe*",
      "ssm:Get*",
      "ssm:List*",
    ]

    resources = [
      "arn:aws:ssm:*:*:parameter/${local.ssm_name_env}/*",
      "arn:aws:ssm:*:*:parameter/xxxxx/*",
      "arn:aws:ssm:*:*:parameter/${var.env}/xxxxx/*",
      "arn:aws:ssm:*:*:parameter/xxxx/*",
      "arn:aws:ssm:*:*:parameter/xxxxxx/*",
      "arn:aws:ssm:*:*:parameter/xxxxx/*"
    ]
  }
}

Terraform计划输出 #

# aws_iam_role_policy.task_execution_role_policy[0] will be updated in-place
  ~ resource "aws_iam_role_policy" "task_execution_role_policy" {
        id     = "ecs-task-execution-role-xxxxxxx:ecs-task-execution-role-xxxxxxxxx-policy"
        name   = "ecs-task-execution-role-xxxxxxxxxxx-policy"
      ~ policy = jsonencode(
            {
              - Statement = [
                  - {
                      - Action   = [
                          - "logs:PutLogEvents",
                          - "logs:CreateLogStream",
                        ]
                      - Effect   = "Allow"
                      - Resource = "arn:aws:logs:us-east-1:123456789:log-group:/ecs/xxxxxxxxxx:*"
                      - Sid      = ""
                    },
                  - {
                      - Action   = "ecr:GetAuthorizationToken"
                      - Effect   = "Allow"
                      - Resource = "*"
                      - Sid      = ""
                    },
                  - {
                      - Action   = [
                          - "ecr:GetDownloadUrlForLayer",
                          - "ecr:BatchGetImage",
                          - "ecr:BatchCheckLayerAvailability",
                        ]
                      - Effect   = "Allow"
                      - Resource = "*"
                      - Sid      = ""
                    },
                  - {
                      - Action   = [
                          - "ssm:List*",
                          - "ssm:Get*",
                          - "ssm:Describe*",
                        ]
                      - Effect   = "Allow"
                      - Resource = [
                          - "arn:aws:ssm:*:*:parameter/dev/aurora/*",
                          - "arn:aws:ssm:*:*:parameter/test-service/*",
                          - "arn:aws:ssm:*:*:parameter/ecs/*",
                          - "arn:aws:ssm:*:*:parameter/aurora/*",
                          - "arn:aws:ssm:*:*:parameter/test-service/*",
                        ]
                      - Sid      = ""
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> (known after apply)
        # (1 unchanged attribute hidden)
    }

内容的提问来源于stack exchange，提问作者Maruthirao Konda