feat: Added support for partition in IAM policies to work in GovCloud (#201)

antonbabenko · web-flow · commit 9a0b0ca5685e · 2021-09-25T12:14:03.000+02:00
diff --git a/README.md b/README.md
@@ -650,6 +650,7 @@ No modules.
 | [aws_iam_policy_document.async](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.dead_letter](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
 | [external_external.archive_prepare](https://registry.terraform.io/providers/hashicorp/external/latest/docs/data-sources/external) | data source |
 
 ## Inputs
diff --git a/iam.tf b/iam.tf
@@ -152,7 +152,7 @@ resource "aws_iam_role_policy_attachment" "dead_letter" {
 data "aws_iam_policy" "vpc" {
   count = local.create_role && var.attach_network_policy ? 1 : 0
 
-  arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaENIManagementAccess"
+  arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/service-role/AWSLambdaENIManagementAccess"
 }
 
 resource "aws_iam_policy" "vpc" {
@@ -178,7 +178,7 @@ resource "aws_iam_role_policy_attachment" "vpc" {
 data "aws_iam_policy" "tracing" {
   count = local.create_role && var.attach_tracing_policy ? 1 : 0
 
-  arn = "arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess"
+  arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/AWSXrayWriteOnlyAccess"
 }
 
 resource "aws_iam_policy" "tracing" {
diff --git a/main.tf b/main.tf
@@ -1,3 +1,5 @@
+data "aws_partition" "current" {}
+
 locals {
   archive_filename    = element(concat(data.external.archive_prepare.*.result.filename, [null]), 0)
   archive_was_missing = element(concat(data.external.archive_prepare.*.result.was_missing, [false]), 0)

Original file line number	Diff line number	Diff line change
`@@ -152,7 +152,7 @@ resource "aws_iam_role_policy_attachment" "dead_letter" {`
`152`	`152`	`data "aws_iam_policy" "vpc" {`
`153`	`153`	`count = local.create_role && var.attach_network_policy ? 1 : 0`
`154`	`154`
`155`		`- arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaENIManagementAccess"`
	`155`	`+ arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/service-role/AWSLambdaENIManagementAccess"`
`156`	`156`	`}`
`157`	`157`
`158`	`158`	`resource "aws_iam_policy" "vpc" {`
`@@ -178,7 +178,7 @@ resource "aws_iam_role_policy_attachment" "vpc" {`
`178`	`178`	`data "aws_iam_policy" "tracing" {`
`179`	`179`	`count = local.create_role && var.attach_tracing_policy ? 1 : 0`
`180`	`180`
`181`		`- arn = "arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess"`
	`181`	`+ arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/AWSXrayWriteOnlyAccess"`
`182`	`182`	`}`
`183`	`183`
`184`	`184`	`resource "aws_iam_policy" "tracing" {`
Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,5 @@`
	`1`	`+data "aws_partition" "current" {}`
	`2`	`+`
`1`	`3`	`locals {`
`2`	`4`	`archive_filename = element(concat(data.external.archive_prepare.*.result.filename, [null]), 0)`
`3`	`5`	`archive_was_missing = element(concat(data.external.archive_prepare.*.result.was_missing, [false]), 0)`