terraform0.12+ - 如何为 aws_iam_policy_document 创建可重用的语句块？

Question

我有几个aws_iam_policy_document这样的

政策1

data "aws_iam_policy_document" "policy1" {
  statement {
    actions = [
      "rds:DescribeDBSnapshots"
    ]
    resources = [
      "arn:aws:rds:${var.region}:${local.account_id}:db:*
    ]
  }
  statement {
    actions = [
      "rds:RestoreDBInstanceFromDBSnapshot"
    ]
    resources = [
      "arn:aws:rds:${var.region}:${local.account_id}:db:*s",
      "arn:aws:rds:${var.region}:${local.account_id}:snapshot:*"

    ]
  }
}

政策2

data "aws_iam_policy_document" "policy2" {
  statement {
    actions = [
      "rds:DescribeDBInstances",
      "rds:ModifyDBInstance"
    ]
    resources = [
      "arn:aws:rds:${var.region}:${local.account_id}:db:*",
      "arn:aws:rds:${var.region}:${local.account_id}:db:*"
    ]
  }

}

我还有一些政策都有一些变化。

现在我希望能够statement为所有这些策略插入一个相同的块。

它尚未经过测试，但语句将如下所示：

statement {

    action = [
        "ssm:GetParameter" 

    ]
    resources = [

"arn:aws:ssm:${var.region}:${local.account_id}:parameter/lambda/*"
    ]

}

最有效的方法是什么？我想避免将相同的语句块复制并粘贴到所有策略中。

Answer 1

我可以使用source_json关键字。

这是一个例子：

首先，在新的政策文件中定义通用政策

  data "aws_iam_policy_document" "common" {
    statement {

        action = [
            "ssm:GetParameter" 

        ]
        resources = [

    "arn:aws:ssm:${var.region}:${local.account_id}:parameter/lambda/*"
        ]

    }
  }

然后在现有的策略文档中，使用 source_json

data "aws_iam_policy_document" "policy1" {
  source_json = "${data.aws_iam_policy_document.common.json}"
  statement {
     ....
  }
}