How to insert a variable inside an AWS policy in terraform

String interpolation using the ${ ... } syntax is the smallest change from a literal JSON string, but it runs the risk of challenges with producing correct JSON syntax if e.g. the strings being inserted contain backslashes and quote marks that the JSON parser could misinterpret.

Terraform's jsonencode function can be a good compromise, because Terraform has an object syntax that is very similar to JSON and thus the ability to quickly understand what JSON structure it's producing is preserved while at the same time allowing arbitrary Terraform expressions, whose results will be automatically encoded using correct JSON syntax:

  device-status-policy = jsonencode({
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": "iot:Connect",
        "Resource": "${SOMEVAR}/device-status-qa*"
      },
      {
        "Effect": "Allow",
        "Action": [ "iot:Publish", "iot:Receive", "iot:Subscribe" ]
      }
    ]
  })

Note that the above is using a variant form of the Terraform language object syntax which uses colons instead of equals signs; both are valid, and using colons here helps the input resemble JSON and therefore makes it easier to adapt JSON you already wrote (as I did here) without a lot of rewriting.

However, the "${SOMEVAR}/device-status-qa*" sequence is understood by Terraform as a quoted template expression rather than as a literal string, and so it will evaluate SOMEVAR and include the result in the Resource value before serializing the whole resulting string using JSON syntax. Although it seems unlikely in this particular case, if the SOMEVAR result were a string containing a " then the JSON encoding would automatically escape it as \" to ensure that the result is valid syntax.

For larger data structures where it improves readability to factor them out into a separate file, the templatefile function documentation includes some examples of calling jsonencode from inside an external template too, with similar results.

So the only reasonable option I would go for is the following:

Create a file e.g. policy.tpl with the following content:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iot:Connect",
      "Resource": "${SOMEVAR}/device-status-qa*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "iot:Publish",
        "iot:Receive",
        "iot:Subscribe"
      ]
    }
  ]
}

That policy file has the variable you need.

Then you simply reference it and pass the variable in the following way:

device-status-policy = templatefile("file.tpl", { SOMEVAR = var.your_terraform_variable})

Hope that helps

Change $SOMEVAR to ${SOMEVAR}.

Please review the Terraform string interpolation syntax.

Also, I highly recommend using the data source aws_iam_policy_document to define IAM policies, instead of here docs.