resource "aws_iam_role"
IAM Roleを作成する
code:hcl(rb)
resource "aws_iam_role" "example" {
name = "example-role"
assume_role_policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Effect = "Allow"
Principal = {
Service = "ec2.amazonaws.com" # 例：EC2がこのロールを引き受ける
}
Action = "sts:AssumeRole"
}
]
})
}
name
IAMロールの名前
assume_role_policy
Trust Policyを書く
つまり、常にActionはsts:AssumeRoleになる
例：EC2がS3を読み書きできるロール
code:hcl (rb)
resource "aws_iam_role" "ec2_role" {
name = "ec2-s3-access-role"
assume_role_policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Effect = "Allow"
Principal = {
Service = "ec2.amazonaws.com"
}
Action = "sts:AssumeRole"
}
]
})
}
resource "aws_iam_policy_attachment" "ec2_s3_access" {
name = "ec2-s3-access"
roles = aws_iam_role.ec2_role.name
policy_arn = "arn:aws:iam::aws:policy/AmazonS3FullAccess"
}