Difference between revisions of "Terraform resource: aws iam policy"

From wikieduonline
Jump to navigation Jump to search
Tags: Mobile web edit, Mobile edit
 
(16 intermediate revisions by 2 users not shown)
Line 1: Line 1:
 
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy
 
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy
 +
 +
 +
[[aws_iam_policy]] + [[aws_iam_role]] -> [[aws_iam_role_policy_attachment]]
  
 
== Examples ==
 
== Examples ==
Line 10: Line 13:
 
   # Terraform's "jsonencode" function converts a
 
   # Terraform's "jsonencode" function converts a
 
   # Terraform expression result to valid JSON syntax.
 
   # Terraform expression result to valid JSON syntax.
−
   policy = jsonencode({
+
   policy = [[jsonencode]]({
 
     Version = "2012-10-17"
 
     Version = "2012-10-17"
 
     Statement = [
 
     Statement = [
Line 23: Line 26:
 
   })
 
   })
 
  }
 
  }
−
 
  
 
=== Basic example ===
 
=== Basic example ===
Line 30: Line 32:
 
   [[policy]] = "${data.[[aws_iam_policy_document]].your_policy_name[[.json]]}"
 
   [[policy]] = "${data.[[aws_iam_policy_document]].your_policy_name[[.json]]}"
 
  }
 
  }
 +
 +
== DynamoDB example ==
 +
resource "aws_iam_policy" "dynamodb_example" {
 +
  name = "${var.environment}-dynamodb_example"
 +
  policy = jsonencode({
 +
    Version = "2012-10-17"
 +
    Statement = [
 +
      {
 +
        Action = [
 +
          "[[dynamodb:Scan]]",
 +
          "[[dynamodb:GetItem]]",
 +
          "[[dynamodb:BatchGetItem]]",
 +
          "[[dynamodb:Query]]",
 +
          "[[dynamodb:PutItem]]",
 +
          "[[dynamodb:UpdateItem]]",
 +
          "[[dynamodb:DeleteItem]]",
 +
          "[[dynamodb:BatchWriteItem]]"
 +
        ]
 +
        Effect  = "Allow"
 +
        Resource = "*"
 +
      },
 +
      {
 +
        Action = [
 +
          "logs:CreateLogGroup",
 +
          "logs:CreateLogStream",
 +
          "logs:PutLogEvents"
 +
        ]
 +
        Effect  = "Allow"
 +
        Resource = "*"
 +
      }
 +
    ]
 +
  })
 +
}
 +
 +
== Errors ==
 +
*<code>[[Error: Deleting IAM policy]] ../.. is not authorized to perform: [[iam:DeletePolicyVersion]] on resource</code>
 +
 +
== Policies ==
 +
* [[AWS: Denies access to AWS based on the requested Region]]
  
 
== Related ==
 
== Related ==
 
* [[AWS policy]]
 
* [[AWS policy]]
 
* <code>[[aws_iam_user]]</code>
 
* <code>[[aws_iam_user]]</code>
−
* <code>[[aws_iam_policy_document]]</code>
+
* [[Terraform data source]]: <code>[[aws_iam_policy_document]]</code>
 +
* [[kms:Decrypt]]
 +
* [[ecr:]] [[ecr:BatchGetImage]]
 +
* [[ECS execution policy]]
 +
* [[AWS managed policy: AmazonECSTaskExecutionRolePolicy]]
 +
* <code>[[s3:]]</code>
  
 
== See also ==
 
== See also ==
 +
* {{aws_iam_policy}}
 
* {{terraform aws iam resources}}
 
* {{terraform aws iam resources}}
  
 
[[Category:Terraform]]
 
[[Category:Terraform]]

Latest revision as of 11:23, 14 June 2024

Examples[edit]

Official example[edit]

resource "aws_iam_policy" "policy" {
 name        = "test_policy"
 path        = "/"
 description = "My test policy"

 # Terraform's "jsonencode" function converts a
 # Terraform expression result to valid JSON syntax.
 policy = jsonencode({
   Version = "2012-10-17"
   Statement = [
     {
       Action = [
         "ec2:Describe*",
       ]
       Effect   = "Allow"
       Resource = "*"
     },
   ]
 })
}

Basic example[edit]

resource "aws_iam_policy" "your_resource_name" {
  name   = "your_policy_name"
  policy = "${data.aws_iam_policy_document.your_policy_name.json}"
}

DynamoDB example[edit]

resource "aws_iam_policy" "dynamodb_example" {
 name = "${var.environment}-dynamodb_example"
 policy = jsonencode({
   Version = "2012-10-17"
   Statement = [
     {
       Action = [
         "dynamodb:Scan",
         "dynamodb:GetItem",
         "dynamodb:BatchGetItem",
         "dynamodb:Query",
         "dynamodb:PutItem",
         "dynamodb:UpdateItem",
         "dynamodb:DeleteItem",
         "dynamodb:BatchWriteItem"
       ]
       Effect   = "Allow"
       Resource = "*"
     },
     {
       Action = [
         "logs:CreateLogGroup",
         "logs:CreateLogStream",
         "logs:PutLogEvents"
       ]
       Effect   = "Allow"
       Resource = "*"
     }
   ]
 })
}

Errors[edit]

Policies[edit]

Related[edit]

See also[edit]

Retrieved from "https://www.wikieduonline.com/index.php?title=Terraform_resource:_aws_iam_policy&oldid=328067"

Advertising: