Amazon SNS(Terraform)策略报错：操作超出服务范围排查

错误根源 #

你遇到的InvalidParameter: Invalid parameter: Policy statement action out of service scope错误，核心原因是把sts:AssumeRole操作错误放到了SNS主题的资源策略中。

AWS资源策略（此处为SNS主题策略）仅允许包含对应服务（SNS）的API操作，sts:AssumeRole属于IAM服务范畴，不属于SNS的权限管控范围，因此会被AWS直接拒绝。你的allow_error_integration语句块违背了这个权限模型——sts:AssumeRole应该定义在IAM角色的可信关系策略里，而非资源（SNS主题）的权限策略中。

修正方案 #

1. 创建Snowflake错误集成专用IAM角色 #

单独创建IAM角色，将Snowflake通知集成生成的IAM用户ARN设为可信主体，并在可信策略中添加sts:AssumeRole和ExternalId验证逻辑：

resource "aws_iam_role" "snowflake_error_integration_role" {
  name = "snowflake-error-integration-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          AWS = snowflake_notification_integration.error_integration.aws_sns_iam_user_arn
        }
        Condition = {
          StringEquals = {
            "sts:ExternalId" = snowflake_notification_integration.error_integration.aws_sns_external_id
          }
        }
      }
    ]
  })
}

2. 给IAM角色授予SNS主题访问权限 #

创建IAM策略，允许该角色访问目标SNS主题（权限范围可根据Snowflake实际需求调整），并关联到上面的角色：

resource "aws_iam_policy" "snowflake_sns_access" {
  name        = "snowflake-sns-access-policy"
  description = "授权Snowflake访问错误通知SNS主题"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "SNS:Subscribe",
          "SNS:Publish"
        ]
        Effect   = "Allow"
        Resource = aws_sns_topic.my_sns_topic.arn
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "snowflake_sns_attach" {
  role       = aws_iam_role.snowflake_error_integration_role.name
  policy_arn = aws_iam_policy.snowflake_sns_access.arn
}

3. 清理SNS主题策略中的错误语句块 #

删除data "aws_iam_policy_document" "snowflake_notification_error"里的allow_error_integration语句块，修正后的SNS策略文档仅保留SNS相关权限声明：

data "aws_iam_policy_document" "snowflake_notification_error" {
  version = "2008-10-17"
  statement {
    sid = "__default_statement_ID"
    actions = [
      "SNS:GetTopicAttributes",
      "SNS:SetTopicAttributes",
      "SNS:AddPermission",
      "SNS:RemovePermission",
      "SNS:DeleteTopic",
      "SNS:Subscribe",
      "SNS:ListSubscriptionsByTopic",
      "SNS:Publish",
      "SNS:Receive",
    ]
    principals {
      type        = "AWS"
      identifiers = ["*"]
    }
    resources = [aws_sns_topic.my_sns_topic.arn]
    condition {
      test     = "StringEquals"
      variable = "AWS:SourceOwner"
      values   = [data.aws_caller_identity.current.account_id]
    }
  }
  statement {
    sid = "allow_s3_notification"
    principals {
      type        = "Service"
      identifiers = ["s3.amazonaws.com"]
    }

    actions   = ["SNS:Publish"]
    resources = [aws_sns_topic.my_sns_topic.arn]
    condition {
      test     = "ArnLike"
      variable = "aws:SourceArn"
      values   = [data.aws_s3_bucket.bucket.arn]
    }
  }
  statement {
    sid = "allow_snowflake_subscription"
    principals {
      type        = "AWS"
      identifiers = [snowflake_storage_integration.integration.storage_aws_iam_user_arn]
    }

    actions   = ["SNS:Subscribe"]
    resources = [aws_sns_topic.my_sns_topic.arn]
  }
}

4. 配置Snowflake通知集成 #

在Snowflake中指定你创建的IAM角色ARN，完成集成配置：

CREATE NOTIFICATION INTEGRATION error_integration
  TYPE = QUEUE
  NOTIFICATION_PROVIDER = AWS_SNS
  ENABLED = TRUE
  AWS_SNS_TOPIC_ARN = '${aws_sns_topic.my_sns_topic.arn}'
  AWS_IAM_ROLE_ARN = '${aws_iam_role.snowflake_error_integration_role.arn}';

核心逻辑梳理 #

• IAM角色可信策略：管控谁能扮演该角色（此处为Snowflake的IAM用户），通过sts:AssumeRole+ExternalId完成身份验证。
• IAM角色权限策略：管控该角色能对哪些资源执行哪些操作（此处为SNS主题的订阅/发布等）。
• SNS主题策略：管控哪些主体能直接访问SNS主题，仅允许包含SNS服务的API操作。

内容的提问来源于stack exchange，提问作者user6308605