Terraform创建AWS IAM角色报错：属性值类型不正确

问题根源 #

aws_iam_role的assume_role_policy字段要求传入JSON格式的策略字符串，但你直接赋值了resource.aws_iam_policy.trust这个完整的资源对象，两者类型不匹配，导致报错。

修正方案 #

你不需要单独创建aws_iam_policy资源来存储信任策略——信任策略是IAM角色的内置属性，直接引用Terraform生成的策略文档JSON即可。

修正后的aws_iam_role资源代码：

resource "aws_iam_role" "github_actions_role" {
  name = "GitHubActionsRole"
  # 直接引用策略文档生成的JSON字符串
  assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
}

完整修正后代码 #

provider "aws" {
    region = "eu-west-1"
    profile = "admin"
}

data "aws_caller_identity" "current" {}

locals {
  account_id = data.aws_caller_identity.current.account_id
}

output "account_id" {
    value = local.account_id  
}

resource "aws_iam_role" "github_actions_role" {
  name = "GitHubActionsRole"
  assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
}

data "aws_iam_policy_document" "assume_role_policy" {
    statement {
      actions = ["sts:AssumeRoleWithWebIdentity"]

      principals {
        type = "Federated"
        identifiers = ["arn:aws:iam::${local.account_id}:oidc-provider/token.actions.githubusercontent.com"]
      }

      condition {
        test = "StringEquals"
        variable = "token.actions.githubusercontent.com:aud"
        values = [ "sts.amazonaws.com" ]
      }

      condition {
        test = "StringEquals"
        variable = "token.actions.githubusercontent.com:sub"
        values = [ "repo:Parthiva/*" ]
      }
    }
}

data "aws_iam_policy" "admin_policy" {
  arn = "arn:aws:iam::aws:policy/AdministratorAccess"
}

resource "aws_iam_role_policy_attachment" "github_actions_role_policy_attach" {
   role       = aws_iam_role.github_actions_role.name
   policy_arn = data.aws_iam_policy.admin_policy.arn
}

额外说明 #

如果你的需求是将信任策略作为独立的可复用IAM策略存在，那么你需要：

1. 先给角色设置一个基础的信任策略（不能留空）
2. 通过aws_iam_role_policy_attachment将独立的信任策略ARN关联到角色
   但对于GitHub Actions的OIDC信任场景，直接用内置的assume_role_policy是更简洁且符合最佳实践的方式。

内容的提问来源于stack exchange，提问作者Parthiva