Can an instance profile resource in Terraform have multiple inline policies?

funn7J0k3r 0
Viewed 29

I'm trying to convert a Cloud Formation script to Terraform. One of the issues I'm running into in the script Cloud Formation:

"Resources": {
"*******InstanceProfile": {
    "Condition": "IsInstanceProfile",
    "Type": "AWS::IAM::Role",
    "Properties": {
        "AssumeRolePolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Principal": {
                        "Service": "ec2.amazonaws.com"
                    },
                    "Action": "sts:AssumeRole"
                }
            ]
        },
        "Policies": [
            {
                "PolicyName": "********-*******-instance",
                "PolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Action": "sts:AssumeRole",
                            "Effect": "Allow",
                            "Resource": [
                                {
                                    "Fn::Sub": "arn:aws:iam::*:role/${ReadOnlyRole}"
                                },
                                {
                                    "Fn::Sub": "arn:aws:iam::${AWSOrganizationsAccountID}:role/${OrganizationsRole}"
                                }
                            ]
                        }
                    ]
                }
            }
        ],
        "RoleName": {
            "Ref": "AccessName"
        }
    }
}

I am ASSUMING I can use an inline_policy within a resource like in aws_iam_role. Here is my Terraform snippet that I've produced but get errors:

resource "aws_iam_role" "*****_instance_profile" {

 

  assume_role_policy = jsonencode({

    Version = "2012-10-17"

    Statement = [

      {

        Action = "sts:AssumeRole"

        Effect = "Allow"

        Sid    = ""

        Principal = {

          Service = "ec2.amazonaws.com"

        }

      },

    ]

  })

 

  policy = jsonencode({

    Version = "2012-10-17"

    Statement = [

        Action   = ["sts:AssumeRole"]

        Effect   = "Allow"

        Resource = "arn:aws:iam::*:role/${ReadOnlyRole"

     

    ]

  })

}

I guess I'm stuck with adding the resource within the policy. How would anyone handle this conversion? Do you folks think I'm going down the correct path with aws_iam_role? And, if so, how would you handle multiple resources in an inline_policy?

terraform-provider-aws terraform
1 Answers

I would just use the official documentation when adding multiple resources to a policy.

data "aws_iam_policy_document" "example" {
  statement {

    actions = [
      "s3:ListAllMyBuckets",
      "s3:GetBucketLocation",
    ]

    resources = [
      "arn:aws:s3:::*",
    ]
  }

  statement {
    actions = [
      "s3:*",
    ]

    resources = [
      "arn:aws:s3:::${var.s3_bucket_name}/home/&{aws:username}",
      "arn:aws:s3:::${var.s3_bucket_name}/home/&{aws:username}/*",
    ]
  }
}

resource "aws_iam_user" "user" {
  name = "test-user"
}

resource "aws_iam_policy" "policy" {
  name        = "test-policy"
  description = "A test policy"
  policy      = data.aws_iam_policy_document.example.json
}

resource "aws_iam_user_policy_attachment" "test-attach" {
  user       = aws_iam_user.user.name
  policy_arn = aws_iam_policy.policy.arn
}
Leslie Alldridge0
Related