如何在无互联网连接的AWS实例中执行Terraform部署并绕过IAM请求超时？

问题背景 #

在无互联网连接的AWS实例中运行Terraform，已完成离线模块配置并成功执行terraform init；尝试部署另一AWS实例时，出现IAM服务GetUser请求超时错误，调试日志如下：

Action=GetUser&Version=2010-05-08
[DEBUG] [aws-sdk-go] DEBUG: Send Request iam/GetUser failed, attempt 0/1, error RequestError: send request failed
caused by: Post "https://iam.amazonaws.com/": dial tcp 52.119.198.223:443: i/o timeout
[DEBUG] [aws-sdk-go] DEBUG: Retrying Request iam/GetUser, attempt 1
[DEBUG] [aws-sdk-go] DEBUG: Request iam/GetUser Details:
Host: iam.amazonaws.com
User-Agent: aws-sdk-go/1.35.19 (go1.14.5; linux; amd64) APN/1.0 HashiCorp/1.0 Terraform/1.2.7 (+https://www.terraform.io)
Content-Length: 33
Authorization: AWS4-HMAC-SHA256 Credential=<MY KEY>/us-east-1/iam/aws4_request, SignedHeaders=content-length;content-type;host;x-amz-date, Signature=2af8836c385a80f3d49d88ac
Content-Type: application/x-www-form-urlencoded; charset=utf-8
X-Amz-Date: 20220823T142231Z
Accept-Encoding: gzip

解决办法 #

• 跳过IAM GetUser验证：在AWS提供者配置中添加skip_get_user = true参数，直接绕过SDK默认的凭证有效性检查（该请求需要公网访问IAM服务）。示例配置：

provider "aws" {
  region        = "us-east-1"
  skip_get_user = true
}

• 配置VPC端点：如果实例处于VPC内，创建对应区域的EC2和IAM VPC端点，让请求通过AWS内部网络路由，无需公网连接。需确保端点服务名称为com.amazonaws.<你的区域>.iam和com.amazonaws.<你的区域>.ec2。
• 确认本地凭证权限：使用的IAM角色或Access Key需具备创建EC2实例的完整权限，且凭证通过实例元数据服务（IAM角色）或本地~/.aws/credentials文件正确加载，避免依赖公网验证流程。

内容的提问来源于stack exchange，提问作者shasi222