Terraform创建AWS RDS实例时monitoring_role_arn无效报错如何解决

你遇到的报错核心是IAM角色配置不符合RDS增强监控的要求，需要修改两处配置：

1. 修正IAM角色的信任策略 #

你当前iam-role.tf中配置的信任实体为ec2.amazonaws.com，仅允许EC2服务代入角色，而RDS增强监控要求信任主体为monitoring.rds.amazonaws.com，修改后的iam-role.tf如下：

# IAM Role for RDS Enhanced Monitoring
resource "aws_iam_role" "test-IAM-Role-RDS" {
  name = "test-IAM-Role-RDS"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Sid    = ""
        Principal = {
          Service = "monitoring.rds.amazonaws.com"
        }
      },
    ]
  })
  tags = {
    Name = "test-IAM-Role-RDS"
  }
}

2. 替换自定义权限策略为AWS托管策略 #

AWS官方提供了预定义的托管策略AmazonRDSEnhancedMonitoringRole，已经包含了RDS增强监控所需的所有权限，比你自定义的策略覆盖更全面，无需自行编写权限规则。
你可以删除原来的iam-role-policy.tf自定义策略资源，新增如下IAM策略绑定配置：

# 绑定RDS增强监控官方托管策略
resource "aws_iam_role_policy_attachment" "rds_monitoring_policy_attach" {
  role       = aws_iam_role.test-IAM-Role-RDS.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole"
}

额外注意事项 #

IAM角色创建和策略绑定后存在秒级的全球同步延迟，修改配置后如果首次apply仍然报错，等待10秒后重新执行terraform apply即可。

内容的提问来源于stack exchange，提问作者arjunbnair