UPDATE: iam_policy_document: Error: InvalidParameter: Invalid parameter: Policy Error: null status code: 400, request id

so I am trying to migrate a non-modular Terraform setup to be made up of modules. I have run into this error. I know it is not a terraform specific error, but Terraform is what I'm using.

The whole structure of all the modules needed to make this happen include these:

%ls

caller_identity     event_rule  event_target    iam_policy_document sns_topic_policy

in the caller_dentity:

ls
main.tf     output.tf   variable.tf

in event_rules:

main.tf     output.tf   variable.tf

in event_target:

main.tf     variable.tf  (i did not seem to need to have an output to be used somewhere else.)

in iam_policy_document:

ls% main.tf     output.tf   variable.tf


data "aws_iam_policy_document" "this" {
  statement {
     actions  = [
      "SNS:GetTopicAttributes",
      "SNS:SetTopicAttributes",
      "SNS:AddPermission",
      "SNS:RemovePermission",
      "SNS:DeleteTopic",
      "SNS:Subscribe",
      "SNS:ListSubscriptionsByTopic",
      "SNS:Publish",
      "SNS:Receive"
    ]

    condition {
       test      = "StringEquals"
      variable = "AWS:SourceOwner"

      values = [
      var.account
      ]
    }

    effect = "Allow"

    principals {
       type         = "AWS"
      identifiers = ["*"]
    }

    resources = [
      var.arn
    ]

    sid = "__default_statement_ID"
  }

  statement {
     actions  = [
      "sns:Publish"
    ]

    effect = "Allow"

    principals {
       type         = "Service"
      identifiers = ["events.amazonaws.com"]
    }

    resources = [
      var.arn
    ]

    sid = "TrustCWEToPublishEventsToMyTopic"
  }
}

in sns_topic_policy:

main.tf     output.tf   variable.tf

resource "aws_sns_topic_policy" "this" {
   arn = var.arn 
   policy = var.policy
}

I started redoing all of them in the order posted, than I would test as I go. when all is said and done there is 4 items terraform needs to build; I know that for sure cause the non-module version is my base

So everything appears to work ok UNTIL I get to the aws_sns_topic_policy.

this is if I pound out sns_topic

        }
    }

Plan: 3 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: 

I hit yes and it completes giving me the output I stated below.

now once I add the sns module, somewhere it goes haywire.

my outputs:

Apply complete! Resources: 0 added, 0 changed, 0 destroyed.

Outputs:

caller_identity_out = 012345678910
cloudwatch_event_rule_out = Detect-Local-User-Creations
iam_policy_document_out = {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "__default_statement_ID",
      "Effect": "Allow",
      "Action": [
        "SNS:Subscribe",
        "SNS:SetTopicAttributes",
        "SNS:RemovePermission",
        "SNS:Receive",
        "SNS:Publish",
        "SNS:ListSubscriptionsByTopic",
        "SNS:GetTopicAttributes",
        "SNS:DeleteTopic",
        "SNS:AddPermission"
      ],
      "Resource": "arn:aws:sns:us-east-1:012345678910:tf-SnsTopic-EmailSNSTopic-9JJZS66CE1CW",
      "Principal": {
        "AWS": "*"
      },
      "Condition": {
        "StringEquals": {
          "AWS:SourceOwner": "012345678910"
        }
      }
    },
    {
      "Sid": "TrustCWEToPublishEventsToMyTopic",
      "Effect": "Allow",
      "Action": "sns:Publish",
      "Resource": "arn:aws:sns:us-east-1:012345678910:tf-SnsTopic-EmailSNSTopic-9JJZS66CE1CW",
      "Principal": {
        "Service": "events.amazonaws.com"
      }
    }
  ]
}

based off what I see, I have no clue what it is referring to. The only way I got this error to go away was with jsonencode. however, this is where the next error came about

iam_policy_document: Error: InvalidParameter: Invalid parameter: Policy Error: null status code: 400,

output.tf file

output "iam_policy_document_out" {
  value = data.aws_iam_policy_document.this.json
}

It was mention jsonencode is not needed, if I take it out this is what happens.

Error received when I changed #policy = jsonencode("module.aws_iam_policy_document.iam_policy_document_out")

policy = "module.aws_iam_policy_document.iam_policy_document_out"

The ERROR::

dLocalUsers]
module.iam_policy_document.data.aws_iam_policy_document.this: Refreshing state...

Error: "policy" contains an invalid JSON: invalid character 'm' looking for beginning of value

  on ../../../modules/cloudwatch/sns_topic_policy/main.tf line 3, in resource "aws_sns_topic_policy" "this":
   3:    policy = var.policy

the latest thing is when I implement the "alternatives" from the answer. I get this error, but I do not see a problem. I cant understand what it is erroring. I have the output working, it is declared in sns_topic.. so either i am missing the obvious, I dont know...

Error: Reference to undeclared module

  on main.tf line 43, in module "sns_topic_policy":
  43:   policy = module.aws_iam_policy_document.iam_policy_document_out.json

No module call named "aws_iam_policy_document" is declared in the root module.