如何在AWS中为实例配置文件绑定多个IAM角色及Terraform报错处理

问题核心原因 #

你混淆了IAM角色的信任策略（assume_role_policy）和权限策略的用途，这是报错的根本原因：

• assume_role_policy 是角色的信任策略，仅用于定义「哪些主体可以扮演当前角色」，结构里不允许出现Resource字段，只支持Effect、Action、Principal、Condition这几个核心字段。
• 你引用的AmazonSSMManagedInstanceCore是AWS托管的权限策略，用于给角色分配操作AWS资源的权限，内部包含Resource字段，不能直接放到信任策略里使用。

解决方法 #

1. 把data "aws_iam_policy_document" "ec2_role_policy"里的source_json配置删掉，信任策略仅保留允许EC2服务扮演角色的语句即可。
2. 新增一个IAM角色策略绑定，直接把AmazonSSMManagedInstanceCore托管策略附加到ec2_role上，不需要自己解析策略内容。

修正后的完整代码如下：

resource "aws_instance" "this" {
  # ..
  iam_instance_profile    = aws_iam_instance_profile.this.name
}

resource "aws_iam_instance_profile" "this" {
  name = "ec2-profile"
  role = aws_iam_role.ec2_role.name
}

resource "aws_iam_role" "ec2_role" {
  name               = "ec2-role"
  assume_role_policy = data.aws_iam_policy_document.ec2_role_policy.json
}

# 自定义权限策略绑定
resource "aws_iam_policy" "ec2_policy" {
  name   = "ec2-policy"
  policy = data.aws_iam_policy_document.ec2_use_role_policy.json
}

resource "aws_iam_role_policy_attachment" "attach_custom" {
  role       = aws_iam_role.ec2_role.name
  policy_arn = aws_iam_policy.ec2_policy.arn
}

# 新增SSM托管权限策略绑定，直接使用ARN即可
resource "aws_iam_role_policy_attachment" "attach_ssm" {
  role       = aws_iam_role.ec2_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
}

data "aws_iam_policy_document" "ec2_role_policy" {
  statement {
    effect = "Allow"
    principals {
      identifiers = ["ec2.amazonaws.com"]
      type        = "Service"
    }
    actions = ["sts:AssumeRole"]
  }
}

data "aws_iam_policy_document" "ec2_use_role_policy" {
  statement {
    effect    = "Allow"
    actions   = ["sts:AssumeRole"]
    resources = ["arn:aws:iam::12313113231:role/s3-role"]
  }
}

内容的提问来源于stack exchange，提问作者Miantian