如何用Terraform创建跨dev/test/prod访问S3的通用AWS IAM角色

核心修改说明 #

• 修正原配置中IAM角色信任策略（assume_role_policy）的逻辑错误
• 调整S3权限匹配规则，精确覆盖三个环境的业务存储桶
• 将IAM角色配置从分环境的K8s集群Terraform栈中抽离，作为全局资源仅部署一次，避免重复创建

修改后完整配置 #

####################################
## 通用GO-Service IAM角色配置      ##
####################################

# 通用权限策略：覆盖dev/test/prod三个环境的S3桶权限
resource "aws_iam_policy" "go-service" {
  name = "go-service-global-policy"

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "s3:ListBucket"
        // 此处可添加其他业务需要的S3操作，例如"s3:GetObject"、"s3:PutObject"等
      ],
      "Effect": "Allow",
      // 精确匹配三个环境的桶，也可简化为"arn:aws:s3:::biz-go-download-*"
      "Resource": [
        "arn:aws:s3:::biz-go-download-dev",
        "arn:aws:s3:::biz-go-download-test",
        "arn:aws:s3:::biz-go-download-prod"
      ]
    },
    // 如果需要操作桶内对象，添加如下Statement
    // {
    //   "Action": ["s3:GetObject", "s3:PutObject"],
    //   "Effect": "Allow",
    //   "Resource": "arn:aws:s3:::biz-go-download-*/*"
    // }
  ]
}
EOF
}

# 全局通用IAM角色
resource "aws_iam_role" "go-service" {
  name = "go-service-global-role"

  assume_role_policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowK8sClusterAssumeRole",
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            // AssumeRole的Resource固定为当前角色自身的ARN，无需修改
            "Resource": "${aws_iam_role.go_service.arn}",
            "Principal": {
                // 此处替换为你三个K8s集群的信任主体，例如EKS的OIDC提供商ARN
                // 原配置的s3.amazonaws.com仅适用于S3服务触发角色扮演的场景，根据实际使用场景调整
                "Federated": [
                  "arn:aws:iam::你的AWS账号ID:oidc-provider/oidc.eks.区域.amazonaws.com/id/集群1的OIDC ID",
                  "arn:aws:iam::你的AWS账号ID:oidc-provider/oidc.eks.区域.amazonaws.com/id/集群2的OIDC ID",
                  "arn:aws:iam::你的AWS账号ID:oidc-provider/oidc.eks.区域.amazonaws.com/id/集群3的OIDC ID"
                ]
            }
        }
    ]
}
EOF
}

# 策略绑定
resource "aws_iam_role_policy_attachment" "go-services-attach" {
  role       = aws_iam_role.go-service.name
  policy_arn = aws_iam_policy.go-service.arn 
}

额外注意事项 #

• 如果你使用Terraform Workspace区分环境，可给三个IAM资源添加count = terraform.workspace == "global" ? 1 : 0参数，保证仅在全局工作区创建一次资源
• 通配符*的权限范围更大，若需要最小权限原则，优先使用精确的三个桶ARN列表
• 角色信任策略中的Principal需要根据你实际的使用主体调整，如果是EC2实例、Lambda函数等其他主体使用，对应修改Principal配置即可

内容的提问来源于stack exchange，提问作者Ramesh Mishra