Terraform中为Lambda添加SES权限遇阻，寻求解决方案

你混淆了aws_ses_identity_policy和IAM策略的用途：

• aws_ses_identity_policy是用来授权外部实体访问你的SES身份（域名/邮箱），比如允许其他AWS账户使用你的SES域名发信，不是给IAM角色赋予操作SES的权限。
• 要让Lambda能调用SES发送邮件，应该创建IAM策略并关联到Lambda的执行角色，和配置DynamoDB权限的逻辑一致。

修正后的代码实现 #

1. 定义SES权限的IAM策略

# SES权限的IAM策略文档
data "aws_iam_policy_document" "ses_lambda_policy" {
  statement {
    actions = ["SES:SendEmail", "SES:SendRawEmail"]
    # 限制仅能使用指定的SES域名发信，也可以用"*"允许所有（不推荐）
    resources = [aws_ses_domain_identity.ses_domain.arn]
    
    effect = "Allow"
  }
}

# 创建SES权限的IAM策略
resource "aws_iam_policy" "ses_lambda_access_policy" {
  name        = "SESLambdaAccessPolicy"
  description = "Allow Lambda to send emails via SES"
  policy      = data.aws_iam_policy_document.ses_lambda_policy.json
}

2. 关联策略到Lambda执行角色

# 关联SES策略到Lambda角色
resource "aws_iam_policy_attachment" "ses_lambda_policy_attachment" {
  name       = "SESLambdaPolicyAttachment"
  roles      = [aws_iam_role.domain_role.name]
  policy_arn = aws_iam_policy.ses_lambda_access_policy.arn
}

# 保留你的DynamoDB权限关联
resource "aws_iam_policy_attachment" "dynamodb_crud_policy_attachment" {
  name       = "DynamoDBCrudPolicyAttachment"
  roles      = [aws_iam_role.domain_role.name]
  policy_arn = aws_iam_policy.dynamodb_crud_policy.arn
}

3. 保留SES域名身份资源

resource "aws_ses_domain_identity" "ses_domain" {
  domain = "example.com"
}

关键说明 #

• 如果你不需要授权外部实体访问你的SES域名，完全不需要aws_ses_identity_policy资源。
• 确保Lambda执行角色的信任策略正确配置，允许Lambda服务扮演该角色：

resource "aws_iam_role" "domain_role" {
  name = "DomainRole"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "lambda.amazonaws.com"
        }
      }
    ]
  })
}

内容的提问来源于stack exchange，提问作者timhc22