How to escape HCL string containing ${aws:username} in ${jsonencode(terraform template)}?

Viewed 191

Is there a possibility to process through jsonencode this macros ${aws:username} in a template?

I'm trying to pass variable: Owner = ["$${aws:username}"] or Owner = ["&{aws:username}"] to terraform template but I have got error:

  1. in case &&: Error: failed to render : <template_file>:1,400-401: Extra characters after interpolation expression; Expected a closing brace to end the interpolation expression, but found extra characters.
  2. in case &- jsonencoded to "\u0026{aws:username}" which doesn't work in IAM
locals {
  enforce_tag = {
    Environment = ["development", "production", "rnd", ]
    Project     = ["snooper", "tom"]
    Owner       = ["$${aws:username}"]
  }
}

data "template_file" "enforcetags" {
  template = templatefile("${path.module}/enforcetags_iterate_over_map.tpl",
    {
      key_tag   = [for key, value in local.enforce_tag : key]
      value_tag = local.enforce_tag
    }
  )
}

Template:

${jsonencode(
    {
        "Version" = "2012-10-17",
        "Statement" = [
            {
                "Sid" = "VisualEditor0",
                "Effect" = "Allow",
                "Action" = "ec2:*",
                "Resource" = "*",
                "Condition" = {
                    "ForAllValues:StringEquals" = {
                        "aws:TagKeys" : key_tag
                    },
                    "StringEqualsIfExists" = {
                        for key in key_tag : "aws:RequestTag/${key}" => value_tag[key]
                    }
                }
            }
        ]
    }
)}

I'm expecting to get JSON like this:

{
    "Statement": [
        {
            "Action": "ec2:*",
            "Condition": {
                "ForAllValues:StringEquals": {
                    "aws:TagKeys": [
                        "Environment",
                        "Owner",
                        "Project"
                    ]
                },
                "StringEqualsIfExists": {
                    "aws:RequestTag/Environment": [
                        "development",
                        "production",
                        "rnd"
                    ],
                    "aws:RequestTag/Owner": [
                        "${aws:username}"
                    ],
                    "aws:RequestTag/Project": [
                        "snooper",
                        "tom"
                    ]
                }
            },
            "Effect": "Allow",
            "Resource": "*",
            "Sid": "VisualEditor0"
        }
    ],
    "Version": "2012-10-17"
}

Thank you in advance.

Solution: Matt and Martin inspired me to rework my code.

resource "aws_iam_policy" "ec2_enforce_tags" {
  name        = "ec2_creating_enforce_tags"
  path        = "/"
  description = "To enforce predefined and corresponding keys and tags creating EC2 resources"
  policy = templatefile("${path.module}/enforcetags_iterate_over_map.tpl",
    {
      key_tag   = [for key, value in local.enforce_tag : key]
      value_tag = local.enforce_tag
    }
  )
  tags = {
     Type              = "enforce"
  }
}
0 Answers
Related