Terraform创建AWS IAM角色报错：MalformedPolicyDocument含禁止字段Resource

问题场景 #

在创建IAM实例配置文件并关联到EC2实例的过程中，执行Terraform时触发报错：创建jenkins_server_role角色失败，错误提示为MalformedPolicyDocument: Has prohibited field Resource。

报错详情 #

aws_iam_role.role: Creating...
Error: failed creating IAM Role (jenkins_server_role): MalformedPolicyDocument: Has prohibited field Resource
status code: 400, request id: c2b8db57-357f-4657-a692-a3e6026a6b7b

with aws_iam_role.role,
on iam.tf line 6, in resource "aws_iam_role" "role":
6: resource "aws_iam_role" "role" Releasing state lock. This may take a few moments...
ERRO[0011] Terraform invocation failed in /home/pluo/works/infra/jenkins
ERRO[0011] 1 error occurred:
        * exit status 1

错误原因 #

核心问题是混淆了IAM角色的信任策略和权限策略：

• 信任策略（assume_role_policy）的作用是定义哪些实体可以扮演该角色，语法中不允许出现Resource字段
• 你把本该属于权限策略的资源声明错误地写进了信任策略里，导致IAM服务无法识别该文档格式

修正方案 #

拆分配置结构，将信任策略和权限策略分离：

1. 信任策略仅保留允许EC2服务扮演角色的声明
2. 单独创建权限策略资源，再通过策略附件关联到IAM角色

修正后的iam.tf代码 #

# 定义IAM实例配置文件
resource "aws_iam_instance_profile" "jenkins_server" {
  name = "jenkins_server"
  role = aws_iam_role.role.name
}

# 定义IAM角色，仅配置信任策略
resource "aws_iam_role" "role" {
  name = "jenkins_server_role"
  path = "/"

  # 信任策略：允许EC2服务扮演该角色
  assume_role_policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "ec2.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}
EOF
}

# 定义权限策略：包含原配置中所有资源操作权限
resource "aws_iam_policy" "jenkins_server_permissions" {
  name        = "jenkins_server_permissions"
  description = "Permissions for Jenkins server to manage cloud resources"
  policy      = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "ec2:*",
            "Effect": "Allow",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "elasticloadbalancing:*",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "cloudwatch:*",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "autoscaling:*",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "iam:CreateServiceLinkedRole",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "iam:AWSServiceName": [
                        "autoscaling.amazonaws.com",
                        "ec2scheduled.amazonaws.com",
                        "elasticloadbalancing.amazonaws.com",
                        "spot.amazonaws.com",
                        "spotfleet.amazonaws.com",
                        "transitgateway.amazonaws.com"
                    ]
                }
            }
        }
    ]
}
EOF
}

# 将权限策略关联到IAM角色
resource "aws_iam_role_policy_attachment" "jenkins_server_attach" {
  role       = aws_iam_role.role.name
  policy_arn = aws_iam_policy.jenkins_server_permissions.arn
}

EC2实例模块代码（无需修改） #

module "ec2" {
  source                       = "terraform-aws-modules/ec2-instance/aws"
  version                      = "4.1.4"

  name                        = var.ec2_name
  ami                         = var.ami
  instance_type               = var.instance_type
  availability_zone           = var.availability_zone
  subnet_id                   = data.terraform_remote_state.vpc.outputs.public_subnets[0]
  vpc_security_group_ids      = [aws_security_group.WebServerSG.id]
  associate_public_ip_address = true

  key_name                    = var.key_name
  monitoring                  = true

  iam_instance_profile        = aws_iam_instance_profile.jenkins_server.name

  enable_volume_tags          = false
  root_block_device = [
    {
      encrypted   = true
      volume_type = "gp3"
      throughput  = 200
      volume_size = 100
      tags = {
        Name = "jenkins_server"
      }
    },
  ]

  tags = {
    Name = "WebServerSG"
  }
}

内容的提问来源于stack exchange，提问作者Gary