如何在Terraform中创建带访问密钥的用户并附加IAM策略以通过SES SMTP发邮件

你已经定义了aws_iam_policy_document数据资源，接下来只需要补充几个Terraform资源，就能完成策略附加并生成用户的访问密钥：

完整配置代码 #

# 你已定义的策略文档
data "aws_iam_policy_document" "policy_companyweb_job" {
  statement {
    actions = [
      "ses:SendEmail",
      "ses:SendRawEmail",
      "ses:ReadEmail",
      "ses:ReadRawEmail",
      "iam:CreateAccessKey",
      "iam:DeleteAccessKey",
      "iam:GetAccessKeyLastUsed",
      "iam:ListAccessKeys",
      "iam:UpdateAccessKey"
    ]
    resources = ["*"]
  }
}

# 1. 基于策略文档创建可附加的IAM策略
resource "aws_iam_policy" "companyweb_job" {
  name        = "companyweb-job-policy"
  description = "Permissions for SES email operations and IAM access key management"
  policy      = data.aws_iam_policy_document.policy_companyweb_job.json
}

# 2. 创建目标IAM用户
resource "aws_iam_user" "companyweb_job_user" {
  name = "companyweb-job-user" # 可替换为你需要的用户名
}

# 3. 为该用户生成访问密钥
resource "aws_iam_access_key" "companyweb_job_user" {
  user = aws_iam_user.companyweb_job_user.name
}

# 4. 将IAM策略附加到用户
resource "aws_iam_user_policy_attachment" "companyweb_job_attach" {
  user       = aws_iam_user.companyweb_job_user.name
  policy_arn = aws_iam_policy.companyweb_job.arn
}

关键说明 #

• aws_iam_policy：把你定义的策略文档转换成AWS中可被用户/角色引用的正式IAM策略
• aws_iam_user：创建要分配权限的IAM用户
• aws_iam_access_key：自动为用户生成访问密钥（密钥明文会在Terraform输出中显示，建议后续用terraform output -json安全导出）
• aws_iam_user_policy_attachment：将创建好的策略ARN关联到目标用户上

内容的提问来源于stack exchange，提问作者Hard Worker