如何通过Terraform跨目录引用AWS IAM策略并关联角色

一、目录结构规划 #

先明确最终的文件布局，确保策略与角色的职责划分清晰：

.
├── shared/
│   └── iam/
│       └── developer.tf  # 存放可复用的通用IAM策略
└── iam-platform-security/
    └── main.tf  # 存放平台安全团队专属IAM角色及关联逻辑

二、配置共享IAM策略（shared/iam/developer.tf） #

在该文件中定义通用策略文档并创建策略资源，同时输出策略ARN供其他目录引用：

# 定义通用开发者权限的策略文档
data "aws_iam_policy_document" "developer_common" {
  statement {
    actions = [
      "ec2:DescribeInstances",
      "s3:ListBucket",
      "cloudwatch:GetMetricStatistics"
    ]
    resources = ["*"]
    effect    = "Allow"
  }
}

# 创建共享IAM策略资源
resource "aws_iam_policy" "developer_common" {
  name        = "developer-common-policy"
  description = "跨团队复用的通用开发者权限策略"
  policy      = data.aws_iam_policy_document.developer_common.json
}

# 输出策略ARN，供其他模块调用
output "developer_common_policy_arn" {
  value       = aws_iam_policy.developer_common.arn
  description = "通用开发者策略的ARN标识"
}

三、在团队目录引用共享策略并创建角色（iam-platform-security/main.tf） #

通过模块引用的方式获取共享策略的ARN，再将其关联到团队专属角色：

# 引用共享的IAM策略模块
module "shared_developer_iam" {
  source = "../shared/iam"  # 指向共享策略所在的目录路径
}

# 创建平台安全团队的开发者IAM角色
resource "aws_iam_role" "platform_security_developer" {
  name               = "platform-security-developer-role"
  # 信任策略可根据实际场景调整，比如允许特定IAM用户或服务 AssumeRole
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          AWS = "arn:aws:iam::${var.account_id}:root"
        }
      }
    ]
  })
}

# 将共享策略绑定到团队角色
resource "aws_iam_role_policy_attachment" "platform_security_developer_common" {
  role       = aws_iam_role.platform_security_developer.name
  policy_arn = module.shared_developer_iam.developer_common_policy_arn
}

四、额外场景处理 #

如果共享策略与团队角色属于不同Terraform工作区，可通过远程状态获取策略ARN：

data "terraform_remote_state" "shared_iam" {
  backend = "s3"
  config = {
    bucket = "your-terraform-state-bucket"
    key    = "shared/iam/terraform.tfstate"
    region = "us-east-1"
  }
}

# 关联策略时替换为远程状态输出的ARN
resource "aws_iam_role_policy_attachment" "platform_security_developer_common" {
  role       = aws_iam_role.platform_security_developer.name
  policy_arn = data.terraform_remote_state.shared_iam.outputs.developer_common_policy_arn
}

注意事项 #

• 需先执行共享策略目录的terraform init && terraform apply，确保策略资源创建完成后，再执行团队目录的Terraform操作。
• 可在共享策略中添加变量（如自定义资源列表、权限范围），进一步提升策略的复用灵活性。

内容的提问来源于stack exchange，提问作者sauravdante