Terraform部署AWS Step Function时states.amazonaws.com无权扮演角色问题

问题的核心是你混淆了IAM角色两类策略的作用：

1. 信任策略（即Terraform aws_iam_role 资源的assume_role_policy参数）：作用是定义哪些实体有权限扮演当前这个IAM角色，你当前的信任策略仅允许Lambda服务lambda.amazonaws.com扮演该角色，没有加入Step Functions的服务主体states.amazonaws.com，因此Step Functions服务无法使用这个角色。
2. 权限策略（即你配置的aws_iam_role_policy资源）：作用是定义当前这个角色被扮演后，可以执行哪些操作。你写在权限策略里的sts:AssumeRole是允许该角色本身去扮演其他角色，和「允许Step Functions服务扮演当前角色」完全无关，因此配置该条规则无法解决问题。

方案1：修改现有角色的信任策略（适合需要复用当前Lambda角色的场景） #

直接在现有角色的信任策略中添加Step Functions服务主体即可：

resource "aws_iam_role" "processing_lambda_role" {
  name = local.name
  path = "/service-role/"

  assume_role_policy = jsonencode({
    Version   = "2012-10-17"
    Statement = [
      {
        Effect    = "Allow"
        Principal = { 
          Service = [
            "lambda.amazonaws.com",
            "states.amazonaws.com"
          ]
        }
        Action    = "sts:AssumeRole"
      }
    ]
  })
}

方案2：为Step Functions创建独立专用角色（权限隔离更规范，推荐） #

单独为Step Function创建专属角色和对应权限，避免和Lambda角色权限混用，同时建议缩小权限资源范围避免过度授权：

# Step Functions专用执行角色
resource "aws_iam_role" "sfn_execution_role" {
  name = "${local.name}-sfn-execution"
  path = "/service-role/"

  assume_role_policy = jsonencode({
    Version   = "2012-10-17"
    Statement = [
      {
        Effect    = "Allow"
        Principal = { Service = "states.amazonaws.com" }
        Action    = "sts:AssumeRole"
      }
    ]
  })
}

# Step Functions专用权限策略
resource "aws_iam_role_policy" "sfn_execution_policy" {
  policy = jsonencode({
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "lambda:InvokeFunction",
          "lambda:InvokeAsync"
        ],
        "Resource": aws_lambda_function.process_zip_files_lambda.arn
      }
    ]
  })
  role = aws_iam_role.sfn_execution_role.id
}

# 替换Step Function的关联角色
resource "aws_sfn_state_machine" "sfn_state_machine_zip_files" {
  name     = local.zip_files_step_function_name
  role_arn = aws_iam_role.sfn_execution_role.arn

  definition = <<EOF
{
  "Comment": "Process Incoming Zip Files",
  "StartAt": "ProcessIncomingZipFiles",
  "States": {
    "ProcessIncomingZipFiles": {
      "Type": "Task",
      "Resource": "${aws_lambda_function.process_zip_files_lambda.arn}",
      "ResultPath": "$.Output",
      "End": true
    }
  }
}
EOF
}

内容的提问来源于stack exchange，提问作者user13067694