amazon-web-services - Terraform - 策略中的每条语句都应该只有一个资源

Question

我有一个 aws_iam_policy_document，我试图附加到多个队列。政策文件如下所示:

data "aws_iam_policy_document" "my_policy" {
  statement {
    principals {
      type        = "*"
      identifiers = ["*"]
    }

    actions = [
      "sqs:SendMessage"
    ]

    resources = [
      "${aws_sqs_queue.q1.arn}",
      "${aws_sqs_queue.q2.arn}",
      "...",
      "${aws_sqs_queue.q8.arn}"
    ]

    condition {
      test = "ArnEquals"
      variable = "aws:SourceArn"
      values = [
        "${aws_sns_topic.sns_topic_name.arn}"
      ]
    }
  }
}

当我运行 terraform plan 时，它没有显示任何错误。但是运行 terraform apply 我得到:Policy is invalid。原因:策略中的每条语句都应该只有一个资源。有没有一种方法可以为资源名称放入一个变量，当附加到所述队列时，该变量将替换为队列的名称？

这是我的队列和队列策略的样子:

resource "aws_sqs_queue" "queue_name" {
    name                       = "queue_name_${var.environment}"
    visibility_timeout_seconds = 30
    message_retention_seconds  = 345600
    max_message_size           = 262144
    delay_seconds              = 0
    receive_wait_time_seconds  = 0
}


resource "aws_sqs_queue_policy" "queue_name_policy" {
  queue_url = "${aws_sqs_queue.queue_name.id}"
  policy    = "${data.aws_iam_policy_document.my_policy.json}"
}

Answer 1

Is there a way I can put in a variable for the resource name which gets substituted with the name of the queue when being attached to said queue?

Terraform 有一个使用 count meta-parameter 的循环迭代机制.

我没有用过这么多，目前我无法实际测试下面的代码，所以我可能会犯一个小的免责声明，我认为这应该可行:

variable "number_of_queues" {
  default = 3
}

resource "aws_sqs_queue" "queue_name" {
  count = "${var.number_of_queues}"
  name  = "queue_name_${count.index}"
  // Other properties omitted
}

data "aws_iam_policy_document" "my_policy" {
  count = "${var.number_of_queues}"
  statement {
    resources = [
      "${aws_sqs_queue.queue_name[count.index].arn}",
    ]

    // Other properties omitted
  }
}

resource "aws_sqs_queue_policy" "queue_name_policy" {
  count = "${var.number_of_queues}"
  queue_url = "${aws_sqs_queue.queue_name[count.index].id}"
  policy    = "${data.aws_iam_policy_document.my_policy[count.index].json}"
}

您可能必须使用 lookup() function而不是方括号——不确定。