Skip to content

Commit 0bbb9f2

Browse files
bryantbiggsbryantbiggs
committed
fix: Re-add iam-policy module
1 parent 4502dac commit 0bbb9f2

File tree

17 files changed

+521
-59
lines changed

17 files changed

+521
-59
lines changed

‎README.md

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,40 @@ module "iam_oidc_provider" {
8383
}
8484
```
8585

86+
### IAM Policy
87+
88+
Creates an IAM policy.
89+
90+
```hcl
91+
module "iam_policy" {
92+
source = "terraform-aws-modules/iam/aws//modules/iam-policy"
93+
94+
name = "example"
95+
path = "/"
96+
description = "My example policy"
97+
98+
policy = <<-EOF
99+
{
100+
"Version": "2012-10-17",
101+
"Statement": [
102+
{
103+
"Action": [
104+
"ec2:Describe*"
105+
],
106+
"Effect": "Allow",
107+
"Resource": "*"
108+
}
109+
]
110+
}
111+
EOF
112+
113+
tags = {
114+
Terraform = "true"
115+
Environment = "dev"
116+
}
117+
}
118+
```
119+
86120
### IAM ReadOnly Policy
87121

88122
Creates an IAM policy that allows read-only access to the list of AWS services provided.
@@ -248,6 +282,7 @@ module "iam_user" {
248282
- [iam-account](https://github.com/terraform-aws-modules/terraform-aws-iam/tree/master/examples/iam-account) - Set AWS account alias and password policy
249283
- [iam-group](https://github.com/terraform-aws-modules/terraform-aws-iam/tree/master/examples/iam-group) - IAM group with users who are allowed to assume IAM roles in another AWS account and have access to specified IAM policies
250284
- [iam-oidc-provider](https://github.com/terraform-aws-modules/terraform-aws-iam/tree/master/examples/iam-oidc-provider) - Create an OpenID connect provider and IAM role which can be assumed from specified subjects federated from the OIDC provider
285+
- [iam-policy](https://github.com/terraform-aws-modules/terraform-aws-iam/tree/master/examples/iam-policy) - Create an IAM policy
251286
- [iam-read-only-policy](https://github.com/terraform-aws-modules/terraform-aws-iam/tree/master/examples/iam-read-only-policy) - Create IAM read-only policy
252287
- [iam-role](https://github.com/terraform-aws-modules/terraform-aws-iam/tree/master/examples/iam-role) - Create individual IAM role which can be assumed from specified ARNs (AWS accounts, IAM users, etc)
253288
- [iam-role-for-service-accounts](https://github.com/terraform-aws-modules/terraform-aws-iam/tree/master/examples/iam-role-for-service-accounts) - Create IAM role for service accounts (IRSA) for use within EKS clusters

‎docs/UPGRADE-6.0.md

Lines changed: 12 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ If you find a bug, please open an issue with supporting configuration to reprodu
2222
- `iam-group-with-policies` has been renamed to `iam-group`
2323
- `iam-group-with-assumable-roles-policy` has been merged into `iam-group`
2424
- `iam-eks-role` has been removed; `iam-role-for-service-accounts` or [`eks-pod-identity`](https://github.com/terraform-aws-modules/terraform-aws-eks-pod-identity) should be used instead
25-
- `iam-policy` has been removed; the `aws_iam_policy` resource should be used directly instead
2625
- `iam-role-for-service-accounts-eks` has been renamed to `iam-role-for-service-accounts`
2726
- Individual policy creation and attachment has been consolidated under one policy creation and attachment
2827
- Default values that enable permissive permissions have been removed; users will need to be explicit about the scope of access (i.e. ARNs) they provide when enabling permissions
@@ -93,6 +92,8 @@ stateDiagram
9392
- `assumable_roles`
9493
- `iam-oidc-provider`
9594
- `additional_thumbprints` - no longer required by GitHub
95+
- `iam-policy`
96+
- None
9697
- `iam-read-only-policy`
9798
- `additional_policy_json` - use `source_inline_policy_documents` or `override_inline_policy_documents` instead
9899
- `iam-role`
@@ -140,6 +141,8 @@ stateDiagram
140141
- `aws_account_id` -> `users_account_id`
141142
- `iam-oidc-provider`
142143
- None
144+
- `iam-policy`
145+
- `create_policy` -> `create`
143146
- `iam-read-only-policy`
144147
- `name_prefix` (string) -> `use_name_prefix` (bool)
145148
- `iam-role`
@@ -179,6 +182,8 @@ stateDiagram
179182
- `enable_mfa_enforcment`
180183
- `iam-oidc-provider`
181184
- None
185+
- `iam-policy`
186+
- None
182187
- `iam-read-only-policy`
183188
- `create`
184189
- `source_policy_documents`
@@ -215,6 +220,9 @@ stateDiagram
215220
- `aws_account_id`
216221
- `iam-oidc-provider`
217222
- None
223+
- `iam-policy`
224+
- `description`
225+
- `path`
218226
- `iam-read-only-policy`
219227
- `description`
220228
- `path`
@@ -246,6 +254,8 @@ stateDiagram
246254
- `group_users` -> `users`
247255
- `iam-oidc-provider`
248256
- None
257+
- `iam-policy`
258+
- None
249259
- `iam-read-only-policy`
250260
- None
251261
- `iam-role`
@@ -786,64 +796,7 @@ terraform state mv "module.iam_group.aws_iam_group_policy_attachment.custom_arns
786796

787797
#### `iam-policy`
788798

789-
##### Before `v5.60`
790-
791-
```hcl
792-
module "iam_policy" {
793-
source = "terraform-aws-modules/iam/aws//modules/iam-policy"
794-
version = "~> 5.60"
795-
796-
name_prefix = "example-"
797-
path = "/"
798-
description = "My example policy"
799-
800-
policy = <<EOF
801-
{
802-
"Version": "2012-10-17",
803-
"Statement": [
804-
{
805-
"Action": [
806-
"ec2:Describe*"
807-
],
808-
"Effect": "Allow",
809-
"Resource": "*"
810-
}
811-
]
812-
}
813-
EOF
814-
}
815-
```
816-
817-
##### After `v6.0`
818-
819-
```hcl
820-
resource "aws_iam_policy" "example" {
821-
name_prefix = "example-"
822-
path = "/"
823-
description = "My example policy"
824-
825-
policy = <<EOF
826-
{
827-
"Version": "2012-10-17",
828-
"Statement": [
829-
{
830-
"Action": [
831-
"ec2:Describe*"
832-
],
833-
"Effect": "Allow",
834-
"Resource": "*"
835-
}
836-
]
837-
}
838-
EOF
839-
}
840-
```
841-
842-
##### State Changes
843-
844-
```sh
845-
terraform state mv "module.iam_policy.aws_iam_policy.policy[0]" aws_iam_policy.example
846-
```
799+
None
847800

848801
#### `iam-read-only-policy`
849802

‎examples/iam-policy/README.md

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
# IAM Policy Example
2+
3+
Configuration in this directory creates IAM policies.
4+
5+
# Usage
6+
7+
To run this example you need to execute:
8+
9+
```bash
10+
$ terraform init
11+
$ terraform plan
12+
$ terraform apply
13+
```
14+
15+
Run `terraform destroy` when you don't need these resources.
16+
17+
<!-- BEGIN_TF_DOCS -->
18+
## Requirements
19+
20+
| Name | Version |
21+
|------|---------|
22+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
23+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.0 |
24+
25+
## Providers
26+
27+
| Name | Version |
28+
|------|---------|
29+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.0 |
30+
31+
## Modules
32+
33+
| Name | Source | Version |
34+
|------|--------|---------|
35+
| <a name="module_iam_policy"></a> [iam\_policy](#module\_iam\_policy) | ../../modules/iam-policy | n/a |
36+
| <a name="module_iam_policy_disabled"></a> [iam\_policy\_disabled](#module\_iam\_policy\_disabled) | ../../modules/iam-policy | n/a |
37+
| <a name="module_iam_policy_from_data_source"></a> [iam\_policy\_from\_data\_source](#module\_iam\_policy\_from\_data\_source) | ../../modules/iam-policy | n/a |
38+
39+
## Resources
40+
41+
| Name | Type |
42+
|------|------|
43+
| [aws_iam_policy_document.bucket_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
44+
45+
## Inputs
46+
47+
No inputs.
48+
49+
## Outputs
50+
51+
| Name | Description |
52+
|------|-------------|
53+
| <a name="output_arn"></a> [arn](#output\_arn) | The ARN assigned by AWS to this policy |
54+
| <a name="output_id"></a> [id](#output\_id) | The policy ID |
55+
| <a name="output_name"></a> [name](#output\_name) | The name of the policy |
56+
| <a name="output_policy"></a> [policy](#output\_policy) | The policy document |
57+
<!-- END_TF_DOCS -->

‎examples/iam-policy/main.tf

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
provider "aws" {
2+
region = "eu-west-1"
3+
}
4+
5+
locals {
6+
name = "ex-${basename(path.cwd)}"
7+
8+
tags = {
9+
Example = local.name
10+
GithubRepo = "terraform-aws-iam"
11+
GithubOrg = "terraform-aws-modules"
12+
}
13+
}
14+
15+
################################################################################
16+
# IAM Policy
17+
################################################################################
18+
19+
module "iam_policy" {
20+
source = "../../modules/iam-policy"
21+
22+
name_prefix = "example-"
23+
path = "/"
24+
description = "My example policy"
25+
26+
policy = <<-EOF
27+
{
28+
"Version": "2012-10-17",
29+
"Statement": [
30+
{
31+
"Action": [
32+
"ec2:Describe*"
33+
],
34+
"Effect": "Allow",
35+
"Resource": "*"
36+
}
37+
]
38+
}
39+
EOF
40+
41+
tags = local.tags
42+
}
43+
44+
module "iam_policy_from_data_source" {
45+
source = "../../modules/iam-policy"
46+
47+
name = "example_from_data_source"
48+
path = "/"
49+
description = "My example policy"
50+
51+
policy = data.aws_iam_policy_document.bucket_policy.json
52+
53+
tags = local.tags
54+
}
55+
56+
module "iam_policy_disabled" {
57+
source = "../../modules/iam-policy"
58+
59+
create = false
60+
}
61+
62+
################################################################################
63+
# Supporting resources
64+
################################################################################
65+
66+
data "aws_iam_policy_document" "bucket_policy" {
67+
statement {
68+
sid = "AllowFullS3Access"
69+
actions = ["s3:ListAllMyBuckets"]
70+
resources = ["*"]
71+
}
72+
}

‎examples/iam-policy/outputs.tf

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
################################################################################
2+
# IAM Policy
3+
################################################################################
4+
5+
output "id" {
6+
description = "The policy ID"
7+
value = module.iam_policy.id
8+
}
9+
10+
output "arn" {
11+
description = "The ARN assigned by AWS to this policy"
12+
value = module.iam_policy.arn
13+
}
14+
15+
output "name" {
16+
description = "The name of the policy"
17+
value = module.iam_policy.name
18+
}
19+
20+
output "policy" {
21+
description = "The policy document"
22+
value = module.iam_policy.policy
23+
}

‎examples/iam-policy/variables.tf

Whitespace-only changes.

‎examples/iam-policy/versions.tf

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
terraform {
2+
required_version = ">= 1.0"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">= 4.0"
8+
}
9+
}
10+
}

0 commit comments

Comments
 (0)