Skip to content

Commit 7b9bda8

Browse files
committed
fix review issues
1 parent 593ea17 commit 7b9bda8

File tree

4 files changed

+9
-15
lines changed

4 files changed

+9
-15
lines changed

.gitignore

Lines changed: 0 additions & 3 deletions
This file was deleted.

docs/rules/aws_iam_policy_attachment_exclusive_attachment.md

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
# aws_iam_policy_attachment_exclusive_attachment
22

3-
Consider alternative resources to `aws_iam_policy_attachment`.
3+
This rule checks whether the `aws_iam_policy_attachment` resource is used.
4+
5+
The `aws_iam_policy_attachment` resource creates exclusive attachments for IAM policies. Within the entire AWS account, all users, roles, and groups that a single policy is attached to must be specified by a single aws_iam_policy_attachment resource.
46

57
## Configuration
68

@@ -23,12 +25,12 @@ $ tflint
2325
1 issue(s) found:
2426
Warning: Consider aws_iam_role_policy_attachment, aws_iam_user_policy_attachment, or aws_iam_group_policy_attachment instead. (aws_iam_policy_attachment_has_alternatives)
2527
on template.tf line 2:
26-
2: name "test_attachment"
28+
2: resource "aws_iam_policy_attachment" "attachment" {
2729
```
2830
2931
## Why
3032
31-
The `aws_iam_policy_attachment` resource creates exclusive attachments of IAM policies. Across the entire AWS account, all the users/roles/groups to which a single policy is attached must be declared by a single `aws_iam_policy_attachment` resource. This means that even any users/roles/groups that have the attached policy via any other mechanism (including other Terraform resources) will have that attached policy revoked by this resource. https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy_attachment
33+
The [`aws_iam_policy_attachment`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy_attachment) resource creates exclusive attachments of IAM policies. Across the entire AWS account, all the users/roles/groups to which a single policy is attached must be declared by a single `aws_iam_policy_attachment` resource. This means that even any users/roles/groups that have the attached policy via any other mechanism (including other Terraform resources) will have that attached policy revoked by this resource.
3234
3335
## How To Fix
3436

rules/aws_iam_policy_attachment_exclusive_attachment.go

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -52,15 +52,10 @@ func (r *AwsIAMPolicyAttachmentExclusiveAttachmentRule) Check(runner tflint.Runn
5252
}
5353

5454
for _, resource := range resources.Blocks {
55-
attribute, exists := resource.Body.Attributes[r.attributeName]
56-
if !exists {
57-
continue
58-
}
59-
6055
runner.EmitIssue(
6156
r,
62-
"Consider aws_iam_role_policy_attachment, aws_iam_user_policy_attachment, or aws_iam_group_policy_attachment instead.",
63-
attribute.Expr.Range(),
57+
"Within the entire AWS account, all users, roles, and groups that a single policy is attached to must be specified by a single aws_iam_policy_attachment resource. Consider aws_iam_role_policy_attachment, aws_iam_user_policy_attachment, or aws_iam_group_policy_attachment instead.",
58+
resource.DefRange,
6459
)
6560

6661
if err != nil {

rules/aws_iam_policy_attachment_exclusive_attachment_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,8 @@ resource "aws_iam_policy_attachment" "attachment" {
3030
Message: "Consider aws_iam_role_policy_attachment, aws_iam_user_policy_attachment, or aws_iam_group_policy_attachment instead.",
3131
Range: hcl.Range{
3232
Filename: "resource.tf",
33-
Start: hcl.Pos{Line: 3, Column: 9},
34-
End: hcl.Pos{Line: 3, Column: 26},
33+
Start: hcl.Pos{Line: 2, Column: 1},
34+
End: hcl.Pos{Line: 2, Column: 50},
3535
},
3636
},
3737
},

0 commit comments

Comments
 (0)