如何通过Terraform为AWS权限集添加多个内联策略？

我创建了2条IAM策略，尝试将其作为内联策略附加到AWS SSO权限集，但仅能生效其中一条。请问如何让两条策略都作为内联策略应用到该权限集？

用户提供的Terraform代码（已添加中文注释）：

# 创建拒绝非美国区域访问的IAM托管策略
resource "aws_iam_policy" "DenyAccess_nonUSRegions" {
  name        = "DenyAccess_nonUSRegions"
  description = "拒绝访问非美国区域"
  policy      = data.aws_iam_policy_document.DenyAccess_nonUSRegions.json
}

# 创建拒绝特定IAM操作的IAM托管策略
resource "aws_iam_policy" "role" {
  name        = "Deny_Specific_IAM_Actions"
  description = "拒绝特定IAM操作"
  policy      = data.aws_iam_policy_document.Deny_Specific_IAM_Actions.json
}

# 尝试附加拒绝特定IAM操作的内联策略到权限集
resource "aws_ssoadmin_permission_set_inline_policy" "role" {
  inline_policy      = data.aws_iam_policy_document.Deny_Specific_IAM_Actions.json
  instance_arn       = aws_ssoadmin_permission_set.permission.instance_arn
  permission_set_arn = aws_ssoadmin_permission_set.permission.arn
}

# 尝试附加拒绝非美国区域的内联策略到权限集
resource "aws_ssoadmin_permission_set_inline_policy" "DenyAccess_nonUSRegions" {
  inline_policy      = data.aws_iam_policy_document.DenyAccess_nonUSRegions.json
  instance_arn       = aws_ssoadmin_permission_set.permission.instance_arn
  permission_set_arn = aws_ssoadmin_permission_set.permission.arn
}

问题根源 #

AWS SSO权限集仅支持关联一个内联策略。当你为同一个权限集创建多个aws_ssoadmin_permission_set_inline_policy资源时，后创建的资源会覆盖先创建的，最终只有最后一条内联策略生效。

解决方案 #

方案1：合并两个策略为单个内联策略 #

将两条策略的规则合并到同一个IAM策略文档中，作为单个内联策略附加到权限集。

示例代码：

# 合并两条拒绝规则的策略文档
data "aws_iam_policy_document" "combined_deny_policies" {
  # 拒绝特定IAM操作的规则
  statement {
    effect    = "Deny"
    actions   = ["iam:CreateUser", "iam:DeleteUser"] # 替换为你需要拒绝的IAM动作
    resources = ["*"]
  }

  # 拒绝非美国区域访问的规则
  statement {
    effect    = "Deny"
    actions   = ["*"]
    resources = ["*"]
    condition {
      test     = "StringNotEquals"
      variable = "aws:RequestedRegion"
      values   = ["us-east-1", "us-west-2"] # 替换为你允许的区域
    }
  }
}

# 将合并后的策略作为内联策略附加到权限集
resource "aws_ssoadmin_permission_set_inline_policy" "combined_policy" {
  inline_policy      = data.aws_iam_policy_document.combined_deny_policies.json
  instance_arn       = aws_ssoadmin_permission_set.permission.instance_arn
  permission_set_arn = aws_ssoadmin_permission_set.permission.arn
}

方案2：将其中一条策略转为托管策略关联 #

保留一条内联策略，将另一条策略创建为IAM托管策略，再关联到权限集。

示例代码：

# 创建拒绝非美国区域访问的托管策略
resource "aws_iam_policy" "DenyAccess_nonUSRegions" {
  name        = "DenyAccess_nonUSRegions"
  description = "拒绝访问非美国区域"
  policy      = data.aws_iam_policy_document.DenyAccess_nonUSRegions.json
}

# 拒绝特定IAM操作的策略文档
data "aws_iam_policy_document" "Deny_Specific_IAM_Actions" {
  statement {
    effect    = "Deny"
    actions   = ["iam:CreateUser", "iam:DeleteUser"] # 替换为你需要拒绝的IAM动作
    resources = ["*"]
  }
}

# 附加拒绝特定IAM操作的内联策略到权限集
resource "aws_ssoadmin_permission_set_inline_policy" "Deny_Specific_IAM_Actions" {
  inline_policy      = data.aws_iam_policy_document.Deny_Specific_IAM_Actions.json
  instance_arn       = aws_ssoadmin_permission_set.permission.instance_arn
  permission_set_arn = aws_ssoadmin_permission_set.permission.arn
}

# 将托管策略关联到权限集
resource "aws_ssoadmin_permission_set_managed_policy_attachment" "non_us_regions_deny" {
  instance_arn       = aws_ssoadmin_permission_set.permission.instance_arn
  permission_set_arn = aws_ssoadmin_permission_set.permission.arn
  managed_policy_arn = aws_iam_policy.DenyAccess_nonUSRegions.arn
}

注意事项 #

• 内联策略适合仅针对当前权限集的专属规则，托管策略适合需要在多个权限集或IAM角色间复用的规则。
• 合并策略时需遵循IAM策略评估逻辑：拒绝规则优先级高于允许规则，确保合并后的策略逻辑符合你的访问控制需求。

内容的提问来源于stack exchange，提问作者sean1989