如何动态实现Terraform批量导入AWS IAM自定义托管策略？

1. 重构资源配置以支持多实例 #

把原单实例的aws_iam_policy改成for_each遍历结构，先定义变量存储所有待导入策略的名称与ARN：

variable "customer_managed_policies" {
  type = map(object({
    arn = string
  }))
  description = "待导入的IAM自定义托管策略，键为策略名称，值包含对应ARN"
  example = {
    "ec2-readonly" = {
      arn = "arn:aws:iam::123456789012:policy/ec2-readonly"
    },
    "s3-fullaccess" = {
      arn = "arn:aws:iam::123456789012:policy/s3-fullaccess"
    }
  }
}

resource "aws_iam_policy" "customer_managed_policy" {
  for_each = var.customer_managed_policies
  name     = each.key
  policy   = "{}" # 导入后Terraform会自动同步远程实际策略JSON
}

2. 批量执行导入命令 #

每个策略实例需单独执行terraform import，可通过Shell循环批量处理：

Bash脚本实现 #

#!/bin/bash
# 定义待导入的策略集合
declare -A customer_managed_policies=(
  ["ec2-readonly"]="arn:aws:iam::123456789012:policy/ec2-readonly"
  ["s3-fullaccess"]="arn:aws:iam::123456789012:policy/s3-fullaccess"
)

# 循环执行导入
for policy_name in "${!customer_managed_policies[@]}"; do
  policy_arn="${customer_managed_policies[$policy_name]}"
  terraform import aws_iam_policy.customer_managed_policy["$policy_name"] "$policy_arn"
done

直接命令行执行 #

如果已在环境中定义好关联数组，也可直接跑单行循环：

for k in "${!customer_managed_policies[@]}"; do terraform import aws_iam_policy.customer_managed_policy["$k"] "${customer_managed_policies[$k]}"; done

3. 导入后验证与同步 #

导入完成后执行terraform plan，Terraform会检测到本地空策略与远程实际策略的差异，可选择：

• 直接运行terraform apply，让Terraform自动将远程策略JSON同步到本地状态文件
• 手动更新配置中policy字段为实际策略内容，再执行terraform apply确保本地配置与远程一致

注意事项 #

• 变量中的策略名称、ARN必须与AWS控制台中实际资源完全匹配
• 导入前保持policy字段为空字符串，避免导入时出现冲突
• Windows环境可改用PowerShell编写类似循环脚本实现批量导入

内容的提问来源于stack exchange，提问作者NarmadaM