Terraform调用jsonencode报仅1个参数错误，如何为AWS IAM角色绑定多策略

• jsonencode 函数仅支持传入1个待序列化为JSON的参数，你传入2个独立策略对象不符合语法要求
• 你混淆了IAM角色的assume_role_policy和权限策略的用途：assume_role_policy是信任策略，仅用于定义哪些主体（服务、账号、用户等）可以代入该角色，不能用来定义角色持有的操作权限

方案1：合并权限语句到单个策略后绑定 #

如果希望用单个自定义策略承载所有权限，直接把两个策略的Statement数组合并即可，示例代码如下：

# 角色定义，assume_role_policy填写正确的信任规则
resource "aws_iam_role" "name" {
  name = "name"
  # 示例信任规则：允许EC2服务代入该角色，可根据实际使用场景修改主体
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "ec2.amazonaws.com"
        }
      }
    ]
  })
}

# 合并多权限的自定义策略
resource "aws_iam_policy" "combined_policy" {
  name        = "combined_test_policy"
  path        = "/"
  description = "合并S3和CloudWatch Logs权限的策略"

  policy = jsonencode({
    Version = "2012-10-17"
    # 直接合并两个权限的Statement到同一个数组
    Statement = [
      {
        Effect   = "Allow"
        Action   = ["s3:*", "s3-object-lambda:*"]
        Resource = "*"
      },
      {
        Effect   = "Allow"
        Action   = ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"]
        Resource = "*"
      }
    ]
  })
}

# 绑定策略到角色
resource "aws_iam_role_policy_attachment" "combined_attach" {
  role       = aws_iam_role.name.name
  policy_arn = aws_iam_policy.combined_policy.arn
}

方案2：创建多个独立策略分别绑定 #

如果希望策略职责拆分，可分别创建两个独立策略，再分别绑定到同一个角色：

# 角色定义和方案1一致
resource "aws_iam_role" "name" {
  name = "name"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "ec2.amazonaws.com"
        }
      }
    ]
  })
}

# S3权限策略
resource "aws_iam_policy" "s3_policy" {
  name        = "s3_full_access_policy"
  path        = "/"
  description = "S3全量操作权限"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect   = "Allow"
        Action   = ["s3:*", "s3-object-lambda:*"]
        Resource = "*"
      }
    ]
  })
}

# CloudWatch Logs权限策略
resource "aws_iam_policy" "logs_policy" {
  name        = "logs_write_policy"
  path        = "/"
  description = "CloudWatch Logs写入权限"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect   = "Allow"
        Action   = ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"]
        Resource = "*"
      }
    ]
  })
}

# 分别绑定两个策略到角色
resource "aws_iam_role_policy_attachment" "s3_attach" {
  role       = aws_iam_role.name.name
  policy_arn = aws_iam_policy.s3_policy.arn
}

resource "aws_iam_role_policy_attachment" "logs_attach" {
  role       = aws_iam_role.name.name
  policy_arn = aws_iam_policy.logs_policy.arn
}

内容的提问来源于stack exchange，提问作者x89