如何解决Terraform中IAM角色相关的循环依赖错误？

我创建了一个aws_scheduler_schedule，配置为每分钟向Lambda Function发送消息，代码如下：

resource "aws_scheduler_schedule" "event_scheduler" {
  name       = "${var.environment}-${var.account_name}-${var.service_name}-scheduler"

  flexible_time_window {
    mode = "OFF"
  }

  schedule_expression = "rate(1 minute)"

  target {
    arn      = var.lambda_arn
    role_arn = aws_iam_role.iam_for_eventbridge.arn

    input = jsonencode({
      MessageBody = "check_expired"
    })
  }
}

我希望限制该调度器对应的IAM角色，仅允许上述调度器执行sts:AssumeRole操作，编写的IAM角色代码如下：

resource "aws_iam_role" "iam_for_eventbridge" {
  name                = "${var.environment}-${var.account_name}-${var.service_name}-eventbridge-role"
  assume_role_policy  = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "scheduler.amazonaws.com"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
              "ArnEquals": {
                "aws:SourceArn": "${aws_scheduler_schedule.event_scheduler.arn}"
            }
        }
    ]
}
EOF
}

执行Terraform时出现循环依赖错误：

Error: Cycle: aws_scheduler_schedule.event_scheduler, aws_iam_role.iam_for_eventbridge

我理解这是因为角色依赖调度器的ARN，而调度器又依赖角色的ARN导致的循环问题，请问如何实现该权限限制？

要打破这个循环依赖，核心是避免IAM角色直接引用aws_scheduler_schedule资源的ARN，而是通过固定格式构造ARN的方式实现权限限制：

1. 添加数据资源获取当前AWS账号ID：

data "aws_caller_identity" "current" {}

2. 修改IAM角色的信任策略，用变量、区域和账号ID构造调度器的ARN（AWS Scheduler的ARN格式为arn:aws:scheduler:<区域>:<账号ID>:schedule/<调度器名称>）：

resource "aws_iam_role" "iam_for_eventbridge" {
  name                = "${var.environment}-${var.account_name}-${var.service_name}-eventbridge-role"
  assume_role_policy  = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "scheduler.amazonaws.com"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
              "ArnEquals": {
                "aws:SourceArn": "arn:aws:scheduler:${var.region}:${data.aws_caller_identity.current.account_id}:schedule/${var.environment}-${var.account_name}-${var.service_name}-scheduler"
            }
        }
    ]
}
EOF
}

3. 原有的aws_scheduler_schedule代码保持不变即可。

这种方式下，IAM角色不再依赖调度器资源，而调度器依然可以正常引用角色的ARN，既解决了循环依赖问题，也实现了仅允许指定调度器Assume该角色的权限限制。

内容的提问来源于stack exchange，提问作者gofoxa6160