Terraform创建IAM角色报错：MalformedPolicyDocument含禁用字段Resource

错误原因 #

你把权限策略（定义角色允许执行的操作）写到了assume_role_policy字段里，但这个字段对应的是信任策略——仅用于定义哪些实体（比如EC2服务、IAM用户）可以扮演该角色。信任策略的Statement中不允许出现Resource字段，这就是报错的核心原因。

正确配置格式 #

需要将信任策略和权限策略分开定义：

1. 定义IAM角色与信任策略

信任策略只声明允许哪些主体扮演该角色（这里以EC2实例为例）：

resource "aws_iam_role" "role" {
  name = "test_role"
  path = "/"

  # 信任策略：允许EC2服务扮演此角色
  assume_role_policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "ec2.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}
EOF
}

2. 附加权限策略

将你需要的权限（包括AmazonElasticFileSystemsUtils相关权限）通过托管策略或自定义内联策略附加到角色上：

方式一：附加官方托管策略+自定义权限

# 附加AmazonElasticFileSystemsUtils官方托管策略
resource "aws_iam_role_policy_attachment" "efs_utils_attachment" {
  role       = aws_iam_role.role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonElasticFileSystemsUtils"
}

# 附加自定义的SSM、日志等权限
resource "aws_iam_role_policy" "custom_permissions" {
  name   = "test_role_custom_perms"
  role   = aws_iam_role.role.id
  policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ssm:DescribeAssociation",
                "ssm:GetDeployablePatchSnapshotForInstance",
                "ssm:GetDocument",
                "ssm:DescribeDocument",
                "ssm:GetManifest",
                "ssm:GetParameter",
                "ssm:GetParameters",
                "ssm:ListAssociations",
                "ssm:ListInstanceAssociations",
                "ssm:PutInventory",
                "ssm:PutComplianceItems",
                "ssm:PutConfigurePackageResult",
                "ssm:UpdateAssociationStatus",
                "ssm:UpdateInstanceAssociationStatus",
                "ssm:UpdateInstanceInformation"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ssmmessages:CreateControlChannel",
                "ssmmessages:CreateDataChannel",
                "ssmmessages:OpenControlChannel",
                "ssmmessages:OpenDataChannel"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2messages:AcknowledgeMessage",
                "ec2messages:DeleteMessage",
                "ec2messages:FailMessage",
                "ec2messages:GetEndpoint",
                "ec2messages:GetMessages",
                "ec2messages:SendReply"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeAvailabilityZones"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:PutLogEvents",
                "logs:DescribeLogStreams",
                "logs:DescribeLogGroups",
                "logs:CreateLogStream",
                "logs:CreateLogGroup",
                "logs:PutRetentionPolicy"
            ],
            "Resource": "*"
        }
    ]
}
EOF
}

说明 #

• assume_role_policy仅负责声明角色的可信实体，不能包含任何权限相关的Resource或操作列表。
• 权限策略（允许角色执行的操作）必须通过aws_iam_role_policy（内联策略）或aws_iam_role_policy_attachment（托管/自定义策略）单独配置。

内容的提问来源于stack exchange，提问作者Legion_of_boom__