如何编写脚本实现Terraform创建的角色策略每10分钟自动循环切换？

Got it, let's figure out how to automate swapping those IAM policies between your Engineering and Finance roles every 10 minutes. Since Terraform works with declarative configurations, we'll need to combine scripted changes to your setup with a scheduler to make this happen automatically. Here's a practical, step-by-step approach:

Instead of directly editing your .tf files each time, we'll use Terraform variables to make policy swapping flexible, then write a script that toggles these variables and runs terraform apply on a schedule.

1. Refactor Your Terraform Config for Easy Swapping #

First, update your setup to use variables for policy ARNs—this avoids manually editing Engineering.tf and Finance.tf every time.

Create a variables.tf file (if you don't have one already):

variable "engineering_policy_arn" {
  type    = string
  default = "arn:aws:iam::aws:policy/AdministratorAccess"
}

variable "finance_policy_arn" {
  type    = string
  default = "arn:aws:iam::aws:policy/Billing"
}

Then update your role policy attachments to reference these variables:
In Engineering.tf:

resource "aws_iam_role_policy_attachment" "engineering_policy" {
  role       = aws_iam_role.engineering.name
  policy_arn = var.engineering_policy_arn
}

In Finance.tf:

resource "aws_iam_role_policy_attachment" "finance_policy" {
  role       = aws_iam_role.finance.name
  policy_arn = var.finance_policy_arn
}

2. Write a Script to Toggle Policies #

Create a shell script (e.g., swap_role_policies.sh) that checks the current policy state and swaps them automatically:

#!/bin/bash

# Update this path to your Terraform working directory
TF_WORKING_DIR="/path/to/your/terraform/project"

# Get the current policy attached to the Engineering role
CURRENT_ENG_POLICY=$(terraform -chdir="$TF_WORKING_DIR" output -raw engineering_policy_arn 2>/dev/null || echo "arn:aws:iam::aws:policy/AdministratorAccess")

if [ "$CURRENT_ENG_POLICY" = "arn:aws:iam::aws:policy/AdministratorAccess" ]; then
  # Swap: Engineering gets Billing, Finance gets AdministratorAccess
  terraform -chdir="$TF_WORKING_DIR" apply -auto-approve \
    -var="engineering_policy_arn=arn:aws:iam::aws:policy/Billing" \
    -var="finance_policy_arn=arn:aws:iam::aws:policy/AdministratorAccess"
else
  # Swap back to original state
  terraform -chdir="$TF_WORKING_DIR" apply -auto-approve \
    -var="engineering_policy_arn=arn:aws:iam::aws:policy/AdministratorAccess" \
    -var="finance_policy_arn=arn:aws:iam::aws:policy/Billing"
fi

# Log the swap for debugging (optional but recommended)
echo "$(date): Policy swap completed. Engineering role now uses: $(terraform -chdir="$TF_WORKING_DIR" output -raw engineering_policy_arn)" >> "$TF_WORKING_DIR/swap_logs.txt"

Make the script executable:

chmod +x swap_role_policies.sh

3. Schedule the Script to Run Every 10 Minutes #

On Linux/macOS (using cron): #

1. Open your crontab editor:

crontab -e

2. Add this line to run the script every 10 minutes:

*/10 * * * * /full/path/to/swap_role_policies.sh

3. Save and exit—cron will automatically start running the script on schedule.

On Windows (using Task Scheduler): #

1. Open Task Scheduler and create a new "Basic Task".
2. Set the trigger to "Daily", then configure it to repeat every 10 minutes for 24 hours.
3. Set the action to "Start a program": if using WSL, point to bash.exe with the script path as an argument; if using PowerShell, convert the shell script to a PowerShell equivalent.
4. Save the task to activate the schedule.

Key Best Practices #

• State Management: Use a remote Terraform state (like S3 with versioning and locking) to avoid conflicts if the script runs while you're making manual changes.
• Permissions: Ensure the user/account running the script has AWS permissions to modify IAM roles and policies, plus access to your Terraform state.
• Test First: Run the script manually once to verify it swaps policies correctly before setting up the scheduler.
• Error Handling: Expand the script with error checking (e.g., check if terraform apply succeeded) and add alerts (like email notifications) if something fails.
• Alternative Workspace Approach: If you prefer not to use variables, create two Terraform workspaces (one for each policy configuration) and swap between them in the script with terraform workspace select.

内容的提问来源于stack exchange，提问作者Morgen Moran Levy