Terraform中如何实现aws_iam_role的inline_policy可选生成？

我是Terraform新手，正在为每个服务创建ecsTaskExecutionRole，已编写模块支持传入secrets_arn_list列表，希望将允许访问SecretsManager的inline_policy设置为可选。尝试在inline_policy块内添加：

count = length(var.secrets_arn_list) > 0 ? 1 : 0

但该位置无法使用count语法，相关代码如下：

data "aws_iam_policy_document" "ecs_tasks_execution_role" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "ecs_tasks_execution_role" {
  name        = "TaskExecutionRole-${var.environment}-${var.project}"

  assume_role_policy = "${data.aws_iam_policy_document.ecs_tasks_execution_role.json}"

  inline_policy {
    name = "SecretsManagerAccess-${var.project}-${var.environment}"
    policy = jsonencode({
        "Version": "2012-10-17",
        "Statement": [
          {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
              "secretsmanager:GetResourcePolicy",
              "secretsmanager:GetSecretValue",
              "secretsmanager:DescribeSecret",
              "secretsmanager:ListSecretVersionIds"
            ],
            "Resource": var.secrets_arn_list 
          }
        ]
    })
  }

  tags = var.tags
}

resource "aws_iam_role_policy_attachment" "ecs_tasks_execution_role" {
  role       = "${aws_iam_role.ecs_tasks_execution_role.name}"
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}

解决方案 #

aws_iam_role的inline_policy属于嵌套块，无法直接使用count参数控制是否创建。需要改用dynamic块来实现条件化生成，当secrets_arn_list不为空时才创建该内联策略。修改后的完整代码如下：

data "aws_iam_policy_document" "ecs_tasks_execution_role" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["ecs-tasks.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "ecs_tasks_execution_role" {
  name               = "TaskExecutionRole-${var.environment}-${var.project}"
  assume_role_policy = data.aws_iam_policy_document.ecs_tasks_execution_role.json

  # 使用dynamic块条件化创建内联策略
  dynamic "inline_policy" {
    for_each = length(var.secrets_arn_list) > 0 ? [1] : []
    content {
      name = "SecretsManagerAccess-${var.project}-${var.environment}"
      policy = jsonencode({
        "Version" : "2012-10-17",
        "Statement" : [
          {
            "Sid" : "VisualEditor0",
            "Effect" : "Allow",
            "Action" : [
              "secretsmanager:GetResourcePolicy",
              "secretsmanager:GetSecretValue",
              "secretsmanager:DescribeSecret",
              "secretsmanager:ListSecretVersionIds"
            ],
            "Resource" : var.secrets_arn_list
          }
        ]
      })
    }
  }

  tags = var.tags
}

resource "aws_iam_role_policy_attachment" "ecs_tasks_execution_role" {
  role       = aws_iam_role.ecs_tasks_execution_role.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}

关键说明 #

• dynamic "inline_policy"块通过for_each控制生成逻辑：当var.secrets_arn_list长度大于0时，for_each使用含单个元素的列表[1]，生成一个内联策略；否则使用空列表，不生成该策略。
• 简化了assume_role_policy的引用写法（移除不必要的字符串插值），保持代码简洁。

内容的提问来源于stack exchange，提问作者Math.Random