variables.tf (2)

216-220: Validate and trim the custom policy JSON to avoid accidental creation with whitespace/invalid JSON

Currently, any non-empty (even whitespace-only) string triggers resource creation and may fail at apply. Add validation and trimspace.

Apply this diff:

 variable "custom_policy_document" {
   description = "JSON policy document for custom permissions to attach to the SSM Agent role. If not provided, no custom policy will be attached."
   type        = string
   default     = ""
+  validation {
+    condition     = var.custom_policy_document == "" || can(jsondecode(trimspace(var.custom_policy_document)))
+    error_message = "custom_policy_document must be empty or a valid JSON IAM policy document."
+  }
 }

---

222-226: Constrain policy name to IAM limits and characters

Guard against invalid characters and excessive length for the name component. This prevents surprises when composing the final name in main.tf.

Apply this diff:

 variable "custom_policy_name" {
   description = "Name for the custom policy. Only used if custom_policy_document is provided."
   type        = string
   default     = "custom-policy"
+  validation {
+    condition     = length(var.custom_policy_name) > 0 && length(var.custom_policy_name) <= 128 && can(regex("^[-_A-Za-z0-9+=,.@]+$", var.custom_policy_name))
+    error_message = "custom_policy_name must be 1–128 chars and match [-_A-Za-z0-9+=,.@]."
+  }
 }

main.tf (1)

142-148: Harden conditional creation and sanitize inputs; add safety check for composed name length

• Use trimspace so whitespace-only input doesn’t create a broken inline policy.
• Trim the policy payload to avoid leading/trailing whitespace.
• Optional: add a lifecycle precondition to ensure the composed name stays within IAM’s 128-char limit.

Apply this diff:

 resource "aws_iam_role_policy" "custom" {
-  count = length(var.custom_policy_document) > 0 ? 1 : 0
+  count = length(trimspace(var.custom_policy_document)) > 0 ? 1 : 0
 
   name   = "${module.role_label.id}-${var.custom_policy_name}"
   role   = aws_iam_role.default.name
-  policy = var.custom_policy_document
+  policy = trimspace(var.custom_policy_document)
+  lifecycle {
+    precondition {
+      condition     = length("${module.role_label.id}-${var.custom_policy_name}") <= 128
+      error_message = "Composed inline policy name exceeds 128 characters. Consider a shorter custom_policy_name."
+    }
+  }
 }

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

Learnt from: gberenice
PR: masterpointio/terraform-aws-tailscale#41
File: main.tf:0-0
Timestamp: 2024-11-21T13:30:01.588Z
Learning: In this Terraform module (`main.tf`), read permissions (`ssm:GetParameter`) for SSM parameters are managed by the SSM Agent module (`masterpointio/ssm-agent/aws`), so adding `ssm:GetParameter` permissions in the custom `ssm_policy` module is unnecessary.