Terraform创建Step Function时IAM策略报MalformedPolicyDocument错误

数据老陈

2026-9-26

错误原因

你遇到的报错是因为aws_iam_role_policy对应的是IAM角色的权限策略，这类策略规定的是角色本身可以执行哪些操作，不允许出现Principal字段。Principal字段仅可用于角色的信任策略（即assume_role_policy参数，用来规定哪些主体可以扮演该角色）、资源类策略（如S3桶策略、Lambda资源策略）中。

你把Step Functions服务的Principal写进了权限策略，触发了IAM的格式校验错误。

解决步骤

1. 修正`sfn_policy`配置

删除权限策略中包含Principal的那段sts:AssumeRole语句，只保留调用Lambda的权限：

resource "aws_iam_role_policy" "sfn_policy" {
  policy = jsonencode(
{
  "Version": "2012-10-17",
  "Statement": [
    {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "lambda:InvokeFunction",
                "lambda:InvokeAsync"
            ],
            "Resource": "*"
        }
  ]
}
  )
  role = aws_iam_role.processing_lambda_role.id
}

2. 更新角色的信任策略

修改processing_lambda_role的assume_role_policy，添加Step Functions服务作为可信任的主体，允许它扮演该角色：

resource "aws_iam_role" "processing_lambda_role" {
  name = local.processing_lambda_role_name
  path = "/service-role/"

  assume_role_policy = jsonencode({
    Version   = "2012-10-17"
    Statement = [
      {
        Effect    = "Allow"
        Principal = { Service = "lambda.amazonaws.com" }
        Action    = "sts:AssumeRole"
      },
      # 新增Step Functions服务信任规则
      {
        Effect    = "Allow"
        Principal = { Service = "states.amazonaws.com" }
        Action    = "sts:AssumeRole"
      }
    ]
  })
}