Terraform：AWS Redshift IAM角色

Question

我試圖設置將有權訪問羣集的紅移羣集和IAM角色。我正在使用terraform。根據documentation我需要創建一個服務角色並將AmazonS3ReadOnlyAccess策略附加到它。我有以下的配置在我terraform腳本：

resource "aws_iam_role" "my_admin_role" { 
    name = "my-role" 
    policy = <<EOF 
{ 
    "Version": "2012-10-17", 
    "Statement": [ 
    { 
     "Effect": "Allow", 
     "Action": [ 
     "s3:Get*", 
     "s3:List*", 
     "redshift:*" 
     ], 
     "Resource": "*" 
    } 
    ] 
} 
EOF 
} 

但是這給了我一個錯誤：

錯誤：

* aws_iam_role.my_admin_role: "assume_role_policy": required field is not set 
    * aws_iam_role.my_admin_role: : invalid or unknown key: policy 

如何設置紅移一個服務的角色？

Answer 1

你混的資源資源資源的aws_iam_role

resource "aws_iam_role" "test_role" { 
    name = "test_role" 

    assume_role_policy = <<EOF 
{ 
    "Version": "2012-10-17", 
    "Statement": [ 
    { 
     "Action": "sts:AssumeRole", 
     "Principal": { 
     "Service": "ec2.amazonaws.com" 
     }, 
     "Effect": "Allow", 
     "Sid": "" 
    } 
    ] 
} 
EOF 
} 

樣品使用的aws_iam_role和aws_iam_role_policy

使用範例aws_iam_role_policy

resource "aws_iam_role_policy" "test_policy" { 
    name = "test_policy" 
    role = "${aws_iam_role.test_role.id}" 

    policy = <<EOF 
{ 
    "Version": "2012-10-17", 
    "Statement": [ 
    { 
     "Action": [ 
     "ec2:Describe*" 
     ], 
     "Effect": "Allow", 
     "Resource": "*" 
    } 
    ] 
} 
EOF 
}