Terraform AWS IAM角色策略配置报错：无效JSON策略求助

DevOps 小满

2026-7-25

排查Terraform配置IAM策略时的JSON无效错误

问题场景

编写Terraform代码为AWS EMR实例角色配置ec2-connect IAM策略，赋予EC2实例连接权限时，执行terraform plan报错："policy" contains an invalid JSON policy。

错误原因分析

Resource格式不符合IAM要求：IAM策略的Resource字段需要AWS资源ARN（如arn:aws:ec2:region:account-id:instance/i-xxxxxx），但代码中直接使用jsonencode(data.aws_instances.emr_cluster_ec2s.ids)生成的是实例ID数组，并非ARN格式，不符合IAM策略规范。
JSON语法错误：策略模板中Statement数组的闭合符号错误，最后一个}应该是]，导致JSON结构无效。

修复后的代码

data "aws_instances" "emr_cluster_ec2s" {
  filter {
    name = "key-name"
    values = ["linkedin-learning-emr-key"]
  }
}

data "aws_iam_role" "emr_instance_role" {
  name = "AmazonEMR-InstanceProfile-20230407T155038"
}

# 获取当前AWS账号ID和区域
data "aws_caller_identity" "current" {}
data "aws_region" "current" {}

resource "aws_iam_role_policy" "emr_ec2_connect" {
  name = "ec2-connect"
  role = data.aws_iam_role.emr_instance_role.id

  policy = jsonencode({
    "Version": "2012-10-17",
    "Statement": [
      {
        "Action": [
          "ec2-instance-connect:SendSSHPublicKey"
        ],
        "Effect": "Allow",
        "Resource": [
          for instance_id in data.aws_instances.emr_cluster_ec2s.ids :
          "arn:aws:ec2:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:instance/${instance_id}"
        ]
      },
      {
        "Action": [
          "ec2:DescribeInstances"
        ],
        "Effect": "Allow",
        "Resource": "*"
      }
    ]
  })
}