Terraform中aws_iam_role同时配置AWS与自定义托管策略的正确方式

你当前的写法导致自定义策略被移除的核心原因是：managed_policy_arns是独占式属性——Terraform会严格按照列表内的ARN维护角色关联策略，任何不在列表中的策略都会被自动移除；同时如果自定义策略与角色的创建时序依赖处理不当，也可能引发策略被误删的问题。

下面是两种正确的实现方式：

方式一：规范使用managed_policy_arns（适合固定策略集合场景） #

如果要继续用managed_policy_arns，需保证两点：

• 列表包含所有需要关联的策略ARN（自定义+AWS托管）
• 显式声明角色对自定义策略的依赖，确保策略创建完成后再绑定角色

修改后的代码：

resource "aws_iam_policy" "eks-fargate-logging-policy" {
  name        = "eks-fargate-logging-policy"
  description = "Policy for fargate logs to cloudwatch"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "logs:CreateLogStream",
          "logs:CreateLogGroup",
          "logs:DescribeLogStreams",
          "logs:PutLogEvents"
        ]
        Effect   = "Allow"
        Resource = "*"
      },
    ]
  })
}

resource "aws_iam_role" "fargate_pod_execution_role" {
  name                  = "${var.eks_cluster_name}-eks-fargate-pod-execution-role"
  assume_role_policy    = data.aws_iam_policy_document.fargate_assume_role.json
  managed_policy_arns   = [
    aws_iam_policy.eks-fargate-logging-policy.arn,
    "arn:aws:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy"
  ]
  force_detach_policies = true
  # 显式依赖自定义策略，避免时序问题
  depends_on            = [aws_iam_policy.eks-fargate-logging-policy]
}

方式二：使用aws_iam_role_policy_attachment资源（官方推荐，更灵活） #

这种方式将每个策略的关联拆分为独立资源，彻底避免managed_policy_arns的独占式覆盖问题，适合需要动态调整策略的场景。

实现代码：

resource "aws_iam_policy" "eks-fargate-logging-policy" {
  name        = "eks-fargate-logging-policy"
  description = "Policy for fargate logs to cloudwatch"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "logs:CreateLogStream",
          "logs:CreateLogGroup",
          "logs:DescribeLogStreams",
          "logs:PutLogEvents"
        ]
        Effect   = "Allow"
        Resource = "*"
      },
    ]
  })
}

resource "aws_iam_role" "fargate_pod_execution_role" {
  name               = "${var.eks_cluster_name}-eks-fargate-pod-execution-role"
  assume_role_policy = data.aws_iam_policy_document.fargate_assume_role.json
  # 移除managed_policy_arns属性，改用独立的attachment资源
}

# 绑定自定义策略到角色
resource "aws_iam_role_policy_attachment" "fargate_logging_attach" {
  role       = aws_iam_role.fargate_pod_execution_role.name
  policy_arn = aws_iam_policy.eks-fargate-logging-policy.arn
}

# 绑定AWS托管策略到角色
resource "aws_iam_role_policy_attachment" "fargate_pod_execution_attach" {
  role       = aws_iam_role.fargate_pod_execution_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy"
}

方式二的优势 #

• 每个策略绑定都是独立资源，单个策略的变更不会影响其他策略的关联状态
• 策略与角色的绑定关系更清晰，便于后续维护和扩展
• 彻底避免managed_policy_arns可能带来的意外覆盖风险

内容的提问来源于stack exchange，提问作者Anurag