全部產品
Search
文件中心

Terraform:使用Terraform建立角色並綁定自訂權限原則

更新時間:Jun 30, 2024

本文介紹如何使用Terraform建立角色並綁定權限原則。

前提條件

在開始之前,請您確保完成以下操作:

操作步驟

  1. 建立RAM角色。

    1. 建立terraform.tf檔案,輸入以下內容,並儲存在當前的執行目錄中。

      resource "alicloud_ram_role" "role" {
        name = "testRole"
        document = <<EOF
          {
            "Statement": [
              {
                "Action": "sts:AssumeRole",
                "Effect": "Allow",
                "Principal": {
                  "Service": [
                    "apigateway.aliyuncs.com",
                    "ecs.aliyuncs.com"
                  ]
                }
              }
            ],
            "Version": "1"
          }
      EOF
        description = "this is a role test."
        force       = true
      }
    2. 運行terraform apply開始建立。

    3. 運行terraform show查看建立的角色。

  2. 建立自訂權限原則。

    1. terraform.tf檔案中增加以下內容。

      resource "alicloud_ram_policy" "policy" {
        policy_name     = "testPolicy"
        policy_document = <<EOF
          {
            "Statement": [
              {
                "Action": [
                  "oss:ListObjects",
                  "oss:GetObject"
                ],
                "Effect": "Deny",
                "Resource": [
                  "acs:oss:*:*:mybucket",
                  "acs:oss:*:*:mybucket/*"
                ]
              }
            ],
              "Version": "1"
          }
      EOF
        description     = "this is a policy test"
        force           = true
      }
    2. 運行terraform apply開始建立。

    3. 運行terraform show查看建立的自訂權限原則。

  3. 為角色綁定權限原則。

    1. terraform.tf檔案中增加以下內容。

      resource "alicloud_ram_role_policy_attachment" "attach" {
        policy_name = alicloud_ram_policy.policy.policy_name
        role_name   = alicloud_ram_role.role.name
        policy_type = alicloud_ram_policy.policy.type
      }
    2. 運行terraform apply開始建立。

    3. 運行terraform show查看角色擁有的自訂許可權。

操作範例

provider "alicloud" {
}

resource "alicloud_ram_role" "role" {
  name        = "testRole"
  document    = <<EOF
    {
      "Statement": [
        {
          "Action": "sts:AssumeRole",
          "Effect": "Allow",
          "Principal": {
            "Service": [
              "apigateway.aliyuncs.com",
              "ecs.aliyuncs.com"
            ]
          }
        }
      ],
      "Version": "1"
    }
EOF
  description = "this is a role test."
  force       = true
}

resource "alicloud_ram_policy" "policy" {
  policy_name     = "testPolicy"
  policy_document = <<EOF
    {
      "Statement": [
        {
          "Action": [
            "oss:ListObjects",
            "oss:GetObject"
          ],
          "Effect": "Deny",
          "Resource": [
            "acs:oss:*:*:mybucket",
            "acs:oss:*:*:mybucket/*"
          ]
        }
      ],
        "Version": "1"
    }
EOF
  description     = "this is a policy test"
  force           = true
}

resource "alicloud_ram_role_policy_attachment" "attach" {
  policy_name = alicloud_ram_policy.policy.policy_name
  role_name   = alicloud_ram_role.role.name
  policy_type = alicloud_ram_policy.policy.type
}