amazon-s3 - Terraform aws_iam_policy_document 条件正确的语法

Question

这部分存储桶策略如何写成 aws_iam_policy_document？

    "Condition": {
        "StringEquals": {
            "s3:x-amz-acl": "bucket-owner-full-control",
            "aws:SourceAccount": "xxxxxxxxxxxx"
        },
        "ArnLike": {
            "aws:SourceArn": "arn:aws:s3:::my-tf-test-bucket"
        }

和

condition {
  test = "StringEquals"
  values = []
  variable = ""
}

帮助 :)。

Answer 1

aws_iam_policy_document 支持嵌套的 condition 指令。以下 Terraform 配置应该会有所帮助:

data "aws_iam_policy_document" "iam_policy_document" {
  condition {
    test = "StringEquals"

    values = [
      "bucket-owner-full-control"
    ]

    variable = "s3:x-amz-acl"
  }

  condition {
    test = "StringEquals"

    values = [
      "xxxxxxxxxxxx"
    ]

    variable = "aws:SourceAccount"
  }

  condition {
    test = "ArnLike"

    values = [
      "arn:aws:s3:::my-tf-test-bucket"
    ]

    variable = "aws:SourceArn"
  }
}