如何通过Terraform为多个手动创建的S3桶批量添加桶策略

由于你的S3桶是手动创建的，Terraform无法直接管理桶本身，但可以通过数据源引用已有桶，再配合for_each循环批量为每个桶添加桶策略，具体实现如下：

步骤1：定义待处理的桶名列表 #

先通过变量定义需要添加策略的三个桶名：

variable "target_s3_buckets" {
  type    = list(string)
  default = ["A", "B", "C"] # 替换为你的实际桶名
}

步骤2：引用已有的S3桶 #

使用aws_s3_bucket数据源加载手动创建的桶信息，供后续资源使用：

data "aws_s3_bucket" "existing" {
  for_each = toset(var.target_s3_buckets)
  bucket   = each.key
}

步骤3：批量创建桶策略（统一策略模板） #

如果三个桶需要使用相同的策略规则，直接用for_each遍历数据源生成策略：

resource "aws_s3_bucket_policy" "batch_policies" {
  for_each = data.aws_s3_bucket.existing
  bucket   = each.value.id
  policy   = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect    = "Allow"
        Principal = {
          AWS = "arn:aws:iam::123456789012:user/your-iam-user" # 替换为你的IAM主体ARN
        }
        Action   = ["s3:GetObject", "s3:ListBucket"]
        Resource = [
          each.value.arn,
          "${each.value.arn}/*"
        ]
      }
    ]
  })
}

步骤4：（可选）为每个桶配置不同策略 #

如果三个桶需要独立的策略规则，可以用map类型变量定义每个桶的专属策略：

variable "bucket_specific_policies" {
  type = map(string)
  default = {
    "A" = jsonencode({
      Version = "2012-10-17"
      Statement = [
        {
          Effect    = "Allow"
          Principal = { AWS = "arn:aws:iam::123456789012:user/user-a" }
          Action    = ["s3:GetObject"]
          Resource  = "${data.aws_s3_bucket.existing["A"].arn}/*"
        }
      ]
    }),
    "B" = jsonencode({
      Version = "2012-10-17"
      Statement = [
        {
          Effect    = "Allow"
          Principal = { AWS = "arn:aws:iam::123456789012:user/user-b" }
          Action    = ["s3:ListBucket"]
          Resource  = data.aws_s3_bucket.existing["B"].arn
        }
      ]
    }),
    "C" = jsonencode({
      Version = "2012-10-17"
      Statement = [
        {
          Effect    = "Allow"
          Principal = "*"
          Action    = ["s3:GetObject"]
          Resource  = "${data.aws_s3_bucket.existing["C"].arn}/*"
          Condition = {
            StringEquals = {
              "s3:Referer" = "https://your-domain.com"
            }
          }
        }
      ]
    })
  }
}

resource "aws_s3_bucket_policy" "specific_policies" {
  for_each = var.bucket_specific_policies
  bucket   = each.key
  policy   = each.value
}

注意事项 #

• 确保Terraform使用的AWS身份具备s3:PutBucketPolicy权限，否则无法修改桶策略。
• 执行前先运行terraform plan确认变更内容，避免意外覆盖原有手动配置的桶策略。
• 如果桶已有策略，Terraform会直接替换为当前定义的策略，若需保留原有规则，请合并到新策略中。

内容的提问来源于stack exchange，提问作者Rizwan Khan A