Skip to content

Commit 82563cd

Browse files
diodonfrostdiodonfrost
committed
refactor(iam): use data iam_policy_document_policy instead of raw json
Previously, the AWS IAM policy was defined with raw JSON format. The recommended approach to building AWS IAM policy documents within Terraform is the highly customizable aws_iam_policy_document data source. A short list of benefits over other methods include: * Native Terraform configuration - no need to worry about JSON formatting or syntax * Policy layering - create policy documents that combine and/or overwrite other policy documents * Built-in policy error checking This commit replaces raw json iam policy by terraform aws_iam_policy_document data source.
1 parent 22761a1 commit 82563cd

File tree

1 file changed

+128
-142
lines changed

1 file changed

+128
-142
lines changed

‎main.tf‎

Lines changed: 128 additions & 142 deletions
Original file line numberDiff line numberDiff line change
@@ -17,169 +17,162 @@ data "aws_region" "current" {}
1717
################################################
1818

1919
resource "aws_iam_role" "this" {
20-
count = var.custom_iam_role_arn == null ? 1 : 0
21-
name = "${var.name}-scheduler-lambda"
22-
description = "Allows Lambda functions to stop and start ec2 and rds resources"
23-
24-
assume_role_policy = <<EOF
25-
{
26-
"Version": "2012-10-17",
27-
"Statement": [
28-
{
29-
"Action": "sts:AssumeRole",
30-
"Principal": {
31-
"Service": "lambda.amazonaws.com"
32-
},
33-
"Effect": "Allow",
34-
"Sid": ""
35-
}
36-
]
20+
count = var.custom_iam_role_arn == null ? 1 : 0
21+
name = "${var.name}-scheduler-lambda"
22+
description = "Allows Lambda functions to stop and start ec2 and rds resources"
23+
assume_role_policy = data.aws_iam_policy_document.this.json
3724
}
38-
EOF
25+
26+
data "aws_iam_policy_document" "this" {
27+
statement {
28+
actions = ["sts:AssumeRole"]
29+
30+
principals {
31+
type = "Service"
32+
identifiers = ["lambda.amazonaws.com"]
33+
}
34+
}
3935
}
4036

4137
resource "aws_iam_role_policy" "schedule_autoscaling" {
42-
count = var.custom_iam_role_arn == null ? 1 : 0
43-
name = "${var.name}-autoscaling-custom-policy-scheduler"
44-
role = aws_iam_role.this[0].id
45-
46-
policy = <<EOF
47-
{
48-
"Version": "2012-10-17",
49-
"Statement": [
50-
{
51-
"Action": [
52-
"autoscaling:DescribeScalingProcessTypes",
53-
"autoscaling:DescribeAutoScalingGroups",
54-
"autoscaling:DescribeTags",
55-
"autoscaling:SuspendProcesses",
56-
"autoscaling:ResumeProcesses",
57-
"autoscaling:UpdateAutoScalingGroup",
58-
"autoscaling:DescribeAutoScalingInstances",
59-
"autoscaling:TerminateInstanceInAutoScalingGroup",
60-
"ec2:TerminateInstances"
61-
],
62-
"Resource": "*",
63-
"Effect": "Allow"
64-
}
65-
]
38+
count = var.custom_iam_role_arn == null ? 1 : 0
39+
name = "${var.name}-autoscaling-custom-policy-scheduler"
40+
role = aws_iam_role.this[0].id
41+
policy = data.aws_iam_policy_document.schedule_autoscaling.json
6642
}
67-
EOF
43+
44+
data "aws_iam_policy_document" "schedule_autoscaling" {
45+
statement {
46+
actions = [
47+
"autoscaling:DescribeScalingProcessTypes",
48+
"autoscaling:DescribeAutoScalingGroups",
49+
"autoscaling:DescribeTags",
50+
"autoscaling:SuspendProcesses",
51+
"autoscaling:ResumeProcesses",
52+
"autoscaling:UpdateAutoScalingGroup",
53+
"autoscaling:DescribeAutoScalingInstances",
54+
"autoscaling:TerminateInstanceInAutoScalingGroup",
55+
"ec2:TerminateInstances",
56+
]
57+
58+
resources = [
59+
"*",
60+
]
61+
}
6862
}
6963

7064
resource "aws_iam_role_policy" "schedule_spot" {
71-
count = var.custom_iam_role_arn == null ? 1 : 0
72-
name = "${var.name}-spot-custom-policy-scheduler"
73-
role = aws_iam_role.this[0].id
74-
75-
policy = <<EOF
76-
{
77-
"Version": "2012-10-17",
78-
"Statement": [
79-
{
80-
"Action": [
81-
"ec2:DescribeInstances",
82-
"ec2:TerminateSpotInstances"
83-
],
84-
"Resource": "*",
85-
"Effect": "Allow"
86-
}
87-
]
65+
count = var.custom_iam_role_arn == null ? 1 : 0
66+
name = "${var.name}-spot-custom-policy-scheduler"
67+
role = aws_iam_role.this[0].id
68+
policy = data.aws_iam_policy_document.schedule_spot.json
8869
}
89-
EOF
70+
71+
data "aws_iam_policy_document" "schedule_spot" {
72+
statement {
73+
actions = [
74+
"ec2:DescribeInstances",
75+
"ec2:TerminateSpotInstances",
76+
]
77+
78+
resources = [
79+
"*",
80+
]
81+
}
9082
}
9183

9284
resource "aws_iam_role_policy" "schedule_ec2" {
93-
count = var.custom_iam_role_arn == null ? 1 : 0
94-
name = "${var.name}-ec2-custom-policy-scheduler"
95-
role = aws_iam_role.this[0].id
96-
97-
policy = <<EOF
98-
{
99-
"Version": "2012-10-17",
100-
"Statement": [
101-
{
102-
"Action": [
103-
"ec2:StopInstances",
104-
"ec2:StartInstances",
105-
"autoscaling:DescribeAutoScalingInstances"
106-
],
107-
"Resource": "*",
108-
"Effect": "Allow"
109-
}
110-
]
85+
count = var.custom_iam_role_arn == null ? 1 : 0
86+
name = "${var.name}-ec2-custom-policy-scheduler"
87+
role = aws_iam_role.this[0].id
88+
policy = data.aws_iam_policy_document.schedule_ec2.json
11189
}
112-
EOF
90+
91+
data "aws_iam_policy_document" "schedule_ec2" {
92+
statement {
93+
actions = [
94+
"ec2:StopInstances",
95+
"ec2:StartInstances",
96+
"autoscaling:DescribeAutoScalingInstances",
97+
]
98+
99+
resources = [
100+
"*",
101+
]
102+
}
113103
}
114104

115105
resource "aws_iam_role_policy" "schedule_rds" {
116-
count = var.custom_iam_role_arn == null ? 1 : 0
117-
name = "${var.name}-rds-custom-policy-scheduler"
118-
role = aws_iam_role.this[0].id
119-
120-
policy = <<EOF
121-
{
122-
"Version": "2012-10-17",
123-
"Statement": [
124-
{
125-
"Action": [
126-
"rds:StartDBCluster",
127-
"rds:StopDBCluster",
128-
"rds:StartDBInstance",
129-
"rds:StopDBInstance",
130-
"rds:DescribeDBClusters"
131-
],
132-
"Effect": "Allow",
133-
"Resource": "*"
134-
}
135-
]
106+
count = var.custom_iam_role_arn == null ? 1 : 0
107+
name = "${var.name}-rds-custom-policy-scheduler"
108+
role = aws_iam_role.this[0].id
109+
policy = data.aws_iam_policy_document.schedule_rds.json
136110
}
137-
EOF
111+
112+
data "aws_iam_policy_document" "schedule_rds" {
113+
statement {
114+
actions = [
115+
"rds:StartDBCluster",
116+
"rds:StopDBCluster",
117+
"rds:StartDBInstance",
118+
"rds:StopDBInstance",
119+
"rds:DescribeDBClusters",
120+
]
121+
122+
resources = [
123+
"*",
124+
]
125+
}
138126
}
139127

140128
resource "aws_iam_role_policy" "schedule_cloudwatch" {
141-
count = var.custom_iam_role_arn == null ? 1 : 0
142-
name = "${var.name}-cloudwatch-custom-policy-scheduler"
143-
role = aws_iam_role.this[0].id
144-
145-
policy = <<EOF
146-
{
147-
"Version": "2012-10-17",
148-
"Statement": [
149-
{
150-
"Action": [
151-
"cloudwatch:DisableAlarmActions",
152-
"cloudwatch:EnableAlarmActions"
153-
],
154-
"Effect": "Allow",
155-
"Resource": "*"
156-
}
157-
]
129+
count = var.custom_iam_role_arn == null ? 1 : 0
130+
name = "${var.name}-cloudwatch-custom-policy-scheduler"
131+
role = aws_iam_role.this[0].id
132+
policy = data.aws_iam_policy_document.schedule_cloudwatch.json
158133
}
159-
EOF
134+
135+
data "aws_iam_policy_document" "schedule_cloudwatch" {
136+
statement {
137+
actions = [
138+
"cloudwatch:DisableAlarmActions",
139+
"cloudwatch:EnableAlarmActions",
140+
]
141+
142+
resources = [
143+
"*",
144+
]
145+
}
160146
}
161147

162148
resource "aws_iam_role_policy" "resource_groups_tagging_api" {
163-
count = var.custom_iam_role_arn == null ? 1 : 0
164-
name = "${var.name}-resource-groups-tagging-api-scheduler"
165-
role = aws_iam_role.this[0].id
166-
167-
policy = <<EOF
168-
{
169-
"Version": "2012-10-17",
170-
"Statement": [
171-
{
172-
"Action": [
173-
"tag:GetResources"
174-
],
175-
"Effect": "Allow",
176-
"Resource": "*"
177-
}
149+
count = var.custom_iam_role_arn == null ? 1 : 0
150+
name = "${var.name}-resource-groups-tagging-api-scheduler"
151+
role = aws_iam_role.this[0].id
152+
policy = data.aws_iam_policy_document.resource_groups_tagging_api.json
153+
}
154+
155+
data "aws_iam_policy_document" "resource_groups_tagging_api" {
156+
statement {
157+
actions = [
158+
"tag:GetResources",
178159
]
160+
161+
resources = [
162+
"*",
163+
]
164+
}
179165
}
180-
EOF
166+
167+
resource "aws_iam_role_policy" "lambda_logging" {
168+
count = var.custom_iam_role_arn == null ? 1 : 0
169+
name = "${var.name}-lambda-logging"
170+
role = aws_iam_role.this[0].id
171+
policy = var.kms_key_arn == null ? jsonencode(local.lambda_logging_policy) : jsonencode(local.lambda_logging_and_kms_policy)
181172
}
182173

174+
# Local variables are used for make iam policy because
175+
# resources cannot have a null value in aws_iam_policy_document.
183176
locals {
184177
lambda_logging_policy = {
185178
"Version" : "2012-10-17",
@@ -218,13 +211,6 @@ locals {
218211
}
219212
}
220213

221-
resource "aws_iam_role_policy" "lambda_logging" {
222-
count = var.custom_iam_role_arn == null ? 1 : 0
223-
name = "${var.name}-lambda-logging"
224-
role = aws_iam_role.this[0].id
225-
policy = var.kms_key_arn == null ? jsonencode(local.lambda_logging_policy) : jsonencode(local.lambda_logging_and_kms_policy)
226-
}
227-
228214
################################################
229215
#
230216
# LAMBDA FUNCTION

0 commit comments

Comments
 (0)