错误：创建IAM角色s3_access时出错：MalformedPolicyDocument

如何解决错误：创建IAM角色s3_access时出错：MalformedPolicyDocument

运行Terraform Error: Error creating IAM Role s3_access: MalformedPolicyDocument: Has prohibited field Resource status code: 400,时出现此错误，我在IAM角色中缺少什么？我正在使用此角色从s3获取特定文件。我想授予此角色有限的权限，例如仅获取某些存储分区内容

resource "aws_instance" "web" {
  count                       = var.ec2_count
  ami                         = var.ami_id
  instance_type               = var.instance_type
  subnet_id                   = var.subnet_id
  key_name                    = var.key_name
  source_dest_check           = false
  associate_public_ip_address = true
  #user_data                   = "${file("userdata.sh")}"1
  security_groups = [aws_security_group.ec2_sg.id]
  user_data       = "${file("${path.module}/template/userdata.sh")}"
  tags = {
    Name = "Webserver"
  }
}
resource "aws_iam_role" "s3_access" {
  name = "s3_access"

  assume_role_policy = <<EOF
{
    "Version": "2012-10-17","Statement": [
        {
            "Sid": "1","Effect": "Allow","Principal": {
              "Service": "ec2.amazonaws.com"
              },"Action": [
                "s3:ListBucket","s3:GetObjectVersion","s3:GetObject","s3:GetBucketVersioning","s3:GetBucketLocation"
            ],"Resource": [
                "arn:aws:s3:::webserver/*","arn:aws:s3:::webserver"
            ]
        }
    ]
}
EOF

  tags = {
    tag-key = "tag-value"
  }
}
resource "aws_security_group" "ec2_sg" {
  name        = "ec2-sg"
  description = "Allow TLS inbound traffic"
  vpc_id      = var.vpc_id

  ingress {
    description = "incoming for ec2-instance"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "ec2-sg"
  }
}

任何类型的帮助将不胜感激。我曾尝试自己做过，但被困住了。

解决方法

resource "aws_iam_role" "s3_access" {
  name = "s3_access"

  assume_role_policy = <<EOF
{
    "Version": "2012-10-17","Statement": [
        {
            "Sid": "1","Effect": "Allow","Principal": {
              "Service": "ec2.amazonaws.com"
              },"Action": "sts:AssumeRole"            
        }
    ]
}
EOF

  tags = {
    tag-key = "tag-value"
  }
}



resource "aws_iam_role_policy" "s3_access_policy" {

  name = "s3_access_policy"
  
  role = "${aws_iam_role.s3_access.id}"

  policy = <<EOF
{
    "Version": "2012-10-17","Statement": [
        {
            "Sid": "2","Action": [
                "s3:ListBucket","s3:GetObjectVersion","s3:GetObject","s3:GetBucketVersioning","s3:GetBucketLocation"
            ],"Resource": [
                "arn:aws:s3:::webserver/*","arn:aws:s3:::webserver"
            ]
        }
    ]
}
EOF

}