IAM role 기본 실습

resource "aws_iam_role" "hello" {
  name               = "hello-iam-role"
  path               = "/"
  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF

}

resource "aws_iam_role_policy" "hello_s3" {
  name   = "hello-s3-download"
  role   = aws_iam_role.hello.id
  policy = <<EOF
{
  "Statement": [
    {
      "Sid": "AllowAppArtifactsReadAccess",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": [
        "*"
      ],
      "Effect": "Allow"
    }
  ]
}
EOF

}

resource "aws_iam_instance_profile" "hello" {
  name = "hello-profile"
  role = aws_iam_role.hello.name
}

  + create

Terraform will perform the following actions:

  # aws_iam_instance_profile.hello will be created
  + resource "aws_iam_instance_profile" "hello" {
      + arn         = (known after apply)
      + create_date = (known after apply)
      + id          = (known after apply)
      + name        = "hello-profile"
      + path        = "/"
      + role        = "hello-iam-role"
      + unique_id   = (known after apply)
    }

  # aws_iam_role.hello will be created
  + resource "aws_iam_role" "hello" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "ec2.amazonaws.com"
                        }
                      + Sid       = ""
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + max_session_duration  = 3600
      + name                  = "hello-iam-role"
      + path                  = "/"
      + unique_id             = (known after apply)
    }

  # aws_iam_role_policy.hello_s3 will be created
  + resource "aws_iam_role_policy" "hello_s3" {
      + id     = (known after apply)
      + name   = "hello-s3-download"
      + policy = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = [
                          + "s3:GetObject",
                        ]
                      + Effect   = "Allow"
                      + Resource = [
                          + "*",
                        ]
                      + Sid      = "AllowAppArtifactsReadAccess"
                    },
                ]
            }
        )
      + role   = (known after apply)
    }

Plan: 3 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

aws_iam_role.hello: Creating...
aws_iam_role.hello: Creation complete after 2s [id=hello-iam-role]
aws_iam_instance_profile.hello: Creating...
aws_iam_role_policy.hello_s3: Creating...
aws_iam_role_policy.hello_s3: Creation complete after 2s [id=hello-iam-role:hello-s3-download]
aws_iam_instance_profile.hello: Creation complete after 3s [id=hello-profile]

Apply complete! Resources: 3 added, 0 changed, 0 destroyed.