Terraform如何配置main.tf调用IAM模块创建适配多SQS及S3的权限角色

1. 调整SQS模块，暴露输出参数 #

在SQS/目录下新增outputs.tf文件，将队列ARN和关联桶名对外输出，供IAM模块调用：

output "sqs_arn" {
  description = "ARN of the created SQS queue"
  value       = aws_sqs_queue.CloudTrail_SQS.arn
}

output "associated_bucket" {
  description = "S3 bucket name associated with this SQS queue"
  value       = var.cloudtrail_event_log_bucket_name
}

2. 调整IAM模块，支持多资源权限配置 #

2.1 新增IAM模块变量 #

在IAM/目录下新增variables.tf文件，定义接收外部传入的SQS ARN列表、S3桶列表参数：

variable "sqs_arn_list" {
  type        = list(string)
  description = "List of SQS queue ARNs to grant access to"
}

variable "cloudtrail_bucket_list" {
  type        = list(string)
  description = "List of CloudTrail S3 bucket names to grant access to"
}

# 保留你原有需要的变量：role_name、description、account_id、external_id、kms_key_arn

2.2 修改IAM策略文档 #

更新IAM/目录下的aws_iam_policy_document.policy_document配置，适配多资源权限：

data "aws_iam_policy_document" "policy_document"{
  statement{
    actions = [
      "sqs:GetQueueUrl",
      "sqs:ReceiveMessage",
      "sqs:SendMessage"
    ]
    effect = "Allow"
    resources = var.sqs_arn_list # 替换原有单队列ARN配置
  }
  statement {
    actions = ["sqs:ListQueues"]
    effect  = "Allow"
    resources = ["*"]
  }
  statement {
    actions = ["s3:GetObject", "s3:GetBucketLocation"]
    effect = "Allow"
    resources = [
      for bucket in var.cloudtrail_bucket_list : "arn:aws:s3:::${bucket}/*"
    ]
  }
  statement {
    actions = ["s3:ListBucket"]
    effect = "Allow"
    resources = [
      for bucket in var.cloudtrail_bucket_list : "arn:aws:s3:::${bucket}"
    ]
  }
  statement {
    actions = ["kms:Decrypt", "kms:GenerateDataKey","kms:DescribeKey" ]
    effect = "Allow"
    resources = [var.kms_key_arn]
  }
}

2.3 新增策略绑定配置 #

在IAM/iam_role.tf中新增以下配置，将生成的权限策略绑定到IAM角色：

resource "aws_iam_policy" "sqs_s3_access_policy" {
  name        = "${var.role_name}-access-policy"
  description = "Policy for accessing SQS queues and CloudTrail S3 buckets"
  policy      = data.aws_iam_policy_document.policy_document.json
}

resource "aws_iam_role_policy_attachment" "attach_policy" {
  role       = aws_iam_role.access_role.name
  policy_arn = aws_iam_policy.sqs_s3_access_policy.arn
}

3. 修改根目录main.tf，新增IAM模块调用 #

在原有两个SQS模块配置后，新增IAM模块调用，传入SQS ARN和S3桶参数：

module "data_events"{
  source = "../SQS"
  cloudtrail_event_log_bucket_name = "aws-cloudtrail143-sqs-logs"
  sqs_queue_name                   = "CloudTrail_SQS_Data_Event"
  dead_queue_name                  = "CloudTrail_DLQ_Data_Event"
}

module "management_events"{
  source = "../SQS"
  cloudtrail_event_log_bucket_name = "cloudtrail-management-event-logs"
  sqs_queue_name                   = "cloudTrail_SQS_Management_Event"
  dead_queue_name                  = "cloudTrail_DLQ_Management_Event"
}

# 新增IAM模块调用
module "sqs_s3_access_role" {
  source = "../IAM"

  # 传入基础参数，按实际情况修改取值
  role_name        = "cloudtrail-sqs-s3-access-role"
  description      = "Role for accessing CloudTrail SQS queues and S3 buckets"
  account_id       = "你的AWS账号ID"
  external_id      = "你配置的ExternalId"
  kms_key_arn      = "你的KMS密钥ARN"

  # 传入SQS ARN列表，从两个SQS模块输出获取
  sqs_arn_list = [
    module.data_events.sqs_arn,
    module.management_events.sqs_arn
  ]

  # 传入S3桶列表
  cloudtrail_bucket_list = [
    module.data_events.associated_bucket,
    module.management_events.associated_bucket
  ]
}

4. 销毁重建执行命令 #

依次执行以下命令完成部署：

1. 销毁现有资源：terraform destroy
2. 重新初始化模块：terraform init
3. 预览配置变更：terraform plan
4. 确认无误后执行部署：terraform apply

内容的提问来源于stack exchange，提问作者bibi