嗨，AWS和Terraform专家，我有点像是由我们的前同事手动建立的KMS和IAM关联，但在完成下面所述的kms政策副本时遇到了一个问题：

{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::12345678912345:root"
        },
        "Action": "kms:*",
        "Resource": "*"
    },
    {
        "Effect": "Allow",
        "Principal": {
            "AWS": "ALSKDJFHGNVBCMXJDH0987"
        },
        "Action": "kms:Decrypt",
        "Resource": "*"
    }
]

}

我认为该ALSKDJFHGNVBCMXJDH0987是一个IAM角色，由AWS控制台进行了转换（尚不确定原因）

  {
        "Effect": "Allow",
        "Principal": {
            "AWS": "ALSKDJFHGNVBCMXJDH0987"
        },
        "Action": "kms:Decrypt",
        "Resource": "*"
    }

我使用创建的Terraform脚本遇到此错误：

Error: MalformedPolicyDocumentException: Policy contains a statement with one or more invalid principals.
status code: 400, request id: alsknldkj2-assd-3333-0sdc-askdjaksdjn2

on main.tf line 84, in resource "aws_kms_key" "secrets":
84: resource "aws_kms_key" "secrets" {

顺序有问题吗？还是我什么都没有？附件是我使用的terraform代码：

data "template_file" "my-lambda-policy" {
 template = "${file("policy/lambda.json")}"
  vars = {
      SWAG = var.AWS-SWAG
      STUDENT-BELONGS = var.STUDENT
      STUDENT-TEACHER = var.TEACHER
      ROOM = var.CLASSROOM
  }
}

resource "aws_iam_policy" "my-lambda-pol" {
  name = "my-lambda-policy"
  policy = data.template_file.my-lambda-policy.rendered
}

data "template_file" "my-my-lambda-pol2" {
  template = "${file("policy/lambda2.json")}"
}

resource "aws_iam_policy" "my-lambda-pol2" {
  name = "my-my-lambda-pol2"
  policy = data.template_file.my-my-lambda-pol2.rendered
}

data "template_file" "my-lambda-to-my-kms-policy" {
  template = "${file("policy/kms-lambda.json")}"
  vars = {
      SWAG = var.AWS-SWAG
      KMS_KEY_ID = aws_kms_key.mysecret.id
  }
}

resource "aws_iam_policy" "lambda-to-kms" {
  name = "my-lambda-to-my-kms-policy"
  policy = data.template_file.my-lambda-to-my-kms-policy.rendered
}

resource "aws_iam_role" "the-lambda-role" {
  name = "{STUD_CHAIR}-${STU_SEAG}-${STUDENT-BELONGS}-${STUDENT-TEACHER}"
  assume_role_policy = <<EOF
{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Effect": "Allow",
         "Principal": {
            "Service": "lambda.amazonaws.com"
         },
         "Action": "sts:AssumeRole"
      }
   ]
}
EOF
}

resource "aws_iam_role_policy_attachment" "my-lambda-policy_attachment" {
  policy_arn = aws_iam_policy.my-lambda-pol.arn
  role = aws_iam_role.the-lambda-role.name
}

resource "aws_iam_role_policy_attachment" "my-lambda-pol2_attachment" {
  policy_arn = aws_iam_policy.my-lambda-pol2.arn
  role = aws_iam_role.the-lambda-role.name
}

resource "aws_iam_role_policy_attachment" "kms-attachment" {
  depends_on = [aws_kms_key.mysecret]
  policy_arn = aws_iam_policy.lambda-to-kms.arn
  role = aws_iam_role.the-lambda-role.name
}

data "template_file" "my-kms-policy" {
  template = "${file("policy/my-kms-policy.json")}"
  vars = {
      STUD_CHAIR= "${var.CHAIR}"
      STU_SWAG = "${l{var.SWAG}}"
      STUDENT-BELONGS = "${var.STUDENT}"
      STUDENT-TEACHER = "${var.TEACHER}"
      ROOM = "${var.CLASSROOM}"
  }
}

resource "aws_kms_key" "mysecret" {
  description = "KMS Key for ${var.STUDENT}-${var.TEACHER}-key-${var.CLASSROOM}"
  policy = data.template_file.my-kms-policy.rendered
  depends_on = [aws_iam_role.the-lambda-role]
}

resource "aws_kms_alias" "mysecret" {
  name = "alias/${var.STUDENT}-${var.TEACHER}-key-${var.CLASSROOM}"
  depends_on = [aws_iam_role.the-lambda-role]
  target_key_id = aws_kms_key.mysecret.key_id
}

这就是my-kms-policy.json内部的内容

{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::${ROOM}:root"
        },
        "Action": "kms:*",
        "Resource": "*"
    },
    {
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::${ROOM}:role/${STUD_CHAIR}-${STU_SEAG}-${STUDENT-BELONGS}-${STUDENT-TEACHER}"
        },
        "Action": "kms:Decrypt",
        "Resource": "*"
    }
]
}