如何将AWS CloudFormation的YAML Join格式转换为Terraform兼容格式？

你遇到的核心问题是：CloudFormation的!Join、!Ref是其专属内置函数，Terraform无法识别，且直接将这些语法写入JSON字符串会导致JSON格式非法（!不是JSON的合法起始字符）。

以下是两种可行的修正方案：

方案1：在JSON文档中直接使用Terraform插值 #

先通过Terraform数据源获取当前AWS账号ID，再在策略文档的JSON中插入该值完成ARN拼接：

# 获取当前AWS账号ID
data "aws_caller_identity" "current" {}

module "my_policy" {
  source = "../modules/policy"

  policy = {
    name        = "my_access"
    description = "my access account"
    path        = "/"
    document    = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "MyBeanstalkPermissions",
      "Effect": "Allow",
      "Action": [
        "elasticbeanstalk:CreateApplicationVersion",
        "elasticbeanstalk:DeleteApplicationVersion",
        "elasticbeanstalk:UpdateEnvironment",
        "elasticbeanstalk:CreateStorageLocation",
        "elasticbeanstalk:Check*",
        "elasticbeanstalk:Describe*",
        "elasticbeanstalk:List*",
        "elasticbeanstalk:RequestEnvironmentInfo",
        "elasticbeanstalk:RetrieveEnvironmentInfo",
        "elasticbeanstalk:RestartAppServer",
        "elasticbeanstalk:UpdateApplication",
        "elasticbeanstalk:UpdateApplicationVersion"
      ],
      "Resource": "arn:aws:elasticbeanstalk:*:${data.aws_caller_identity.current.account_id}:*"
    }
  ]
}
EOF
  }
}

方案2：用Terraform的jsonencode构造策略文档（更规范） #

将策略定义为Terraform原生对象，用jsonencode转换为合法JSON字符串，同时用Terraform的format函数完成ARN拼接：

data "aws_caller_identity" "current" {}

module "my_policy" {
  source = "../modules/policy"

  policy = {
    name        = "my_access"
    description = "my access account"
    path        = "/"
    document    = jsonencode({
      Version = "2012-10-17"
      Statement = [
        {
          Sid = "MyBeanstalkPermissions"
          Effect = "Allow"
          Action = [
            "elasticbeanstalk:CreateApplicationVersion",
            "elasticbeanstalk:DeleteApplicationVersion",
            "elasticbeanstalk:UpdateEnvironment",
            "elasticbeanstalk:CreateStorageLocation",
            "elasticbeanstalk:Check*",
            "elasticbeanstalk:Describe*",
            "elasticbeanstalk:List*",
            "elasticbeanstalk:RequestEnvironmentInfo",
            "elasticbeanstalk:RetrieveEnvironmentInfo",
            "elasticbeanstalk:RestartAppServer",
            "elasticbeanstalk:UpdateApplication",
            "elasticbeanstalk:UpdateApplicationVersion"
          ]
          Resource = format("arn:aws:elasticbeanstalk:*:%s:*", data.aws_caller_identity.current.account_id)
        }
      ]
    })
  }
}

关键说明 #

• data "aws_caller_identity" "current"：Terraform内置数据源，用于获取当前执行上下文的AWS账号ID，替代CloudFormation的!Ref "AWS::AccountId"。
• 方案2的jsonencode会自动处理JSON格式的合法性，避免手动编写JSON时的语法错误，同时能无缝集成Terraform的函数和变量。

内容的提问来源于stack exchange，提问作者Gilroy