如何在Terraform中为两个Amazon SNS Topic复用相同配置？

DevOps 小满

2026-8-20

要让两个SNS Topic复用相同的IAM策略、Topic策略和等待配置，核心是用Terraform的for_each特性批量生成资源，避免重复编写代码。以下是重构后的完整配置：

1. 统一管理待创建的Topic列表

通过本地值定义要创建的Topic名称，后续新增Topic只需修改这个列表：

locals {
  sns_topics = toset(["topic-a", "topic-b"])
}

2. 批量生成SNS Topic

替换原来两个独立的aws_sns_topic资源，用for_each循环创建：

resource "aws_sns_topic" "notification" {
  for_each = local.sns_topics
  name     = each.value
}

3. 为每个Topic生成对应的IAM策略文档

动态关联当前Topic的ARN，确保策略只作用于对应Topic：

data "aws_iam_policy_document" "topic_notification" {
  for_each = local.sns_topics
  version  = "2008-10-17"

  statement {
    sid      = "__default_statement_ID"
    actions  = ["SNS:Publish"]
    effect   = "Allow"
    # 补充你之前截断的默认语句内容（比如主体、资源范围等）
    resources = [aws_sns_topic.notification[each.value].arn]
  }

  statement {
    sid = "allow_snowflake_subscription"
    principals {
      type        = "AWS"
      identifiers = [var.storage_aws_iam_user_arn]
    }

    actions   = ["SNS:Subscribe"]
    resources = [aws_sns_topic.notification[each.value].arn]
  }
}

4. 批量绑定Topic策略

为每个Topic关联对应的IAM策略：

resource "aws_sns_topic_policy" "topic_policy_notification" {
  for_each = local.sns_topics
  arn      = aws_sns_topic.notification[each.value].arn
  policy   = data.aws_iam_policy_document.topic_notification[each.value].json
}

5. 批量配置创建后等待逻辑

确保每个Topic创建完成后等待10秒：

resource "time_sleep" "topic_wait_10s" {
  for_each        = local.sns_topics
  depends_on      = [aws_sns_topic.notification[each.value]]
  create_duration = "10s"
}