fix: use length on s3_check for updated role policy for s3 read access

Author: bryantbiggs

examples/simple/main.tf

@@ -53,5 +53,7 @@ module "default" {
   kms_alias             = aws_kms_alias.datadog.name
   dd_api_key_secret_arn = data.aws_secretsmanager_secret.datadog_api_key.arn
 
+  depends_on = [aws_kms_alias.datadog]
+
   tags = { Environment = "test" }
 }

modules/log_forwarder/main.tf

@@ -96,7 +96,7 @@ resource "aws_iam_policy" "this" {
     "${path.module}/policy.tmpl",
     {
       vpc_check             = var.subnet_ids != null
-      s3_check              = var.s3_log_bucket_arns != []
+      s3_check              = length(var.s3_log_bucket_arns) > 0
       s3_log_bucket_arns    = jsonencode(var.s3_log_bucket_arns)
       datadog_s3_bucket     = "arn:aws:s3:::${local.bucket_name}"
       dd_api_key_secret_arn = var.dd_api_key_secret_arn

modules/vpc_flow_log_forwarder/main.tf

@@ -59,7 +59,7 @@ resource "aws_iam_policy" "this" {
     "${path.module}/policy.tmpl",
     {
       vpc_check          = var.subnet_ids != null
-      s3_check           = var.s3_log_bucket_arns == []
+      s3_check           = length(var.s3_log_bucket_arns) > 0
       s3_log_bucket_arns = jsonencode(var.s3_log_bucket_arns)
       kms_arn            = data.aws_kms_key.this.arn
     }