Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit 394d337

Browse files
RafaelWOantonbabenko
andauthored
feat: Use inline instead of managed policies (#615)
Co-authored-by: Anton Babenko <anton@antonbabenko.com>
1 parent 45c6720 commit 394d337

File tree

6 files changed

+36
-107
lines changed

6 files changed

+36
-107
lines changed

‎.pre-commit-config.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
repos:
22
- repo: https://github.com/antonbabenko/pre-commit-terraform
3-
rev: v1.96.1
3+
rev: v1.96.3
44
hooks:
55
- id: terraform_fmt
66
- id: terraform_wrapper_module_for_each

‎README.md

Lines changed: 8 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -690,25 +690,17 @@ No modules.
690690
| Name | Type |
691691
|------|------|
692692
| [aws_cloudwatch_log_group.lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
693-
| [aws_iam_policy.additional_inline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
694-
| [aws_iam_policy.additional_json](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
695-
| [aws_iam_policy.additional_jsons](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
696-
| [aws_iam_policy.async](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
697-
| [aws_iam_policy.dead_letter](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
698-
| [aws_iam_policy.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
699-
| [aws_iam_policy.tracing](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
700-
| [aws_iam_policy.vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
701693
| [aws_iam_role.lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
702-
| [aws_iam_role_policy_attachment.additional_inline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
703-
| [aws_iam_role_policy_attachment.additional_json](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
704-
| [aws_iam_role_policy_attachment.additional_jsons](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
694+
| [aws_iam_role_policy.additional_inline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
695+
| [aws_iam_role_policy.additional_json](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
696+
| [aws_iam_role_policy.additional_jsons](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
697+
| [aws_iam_role_policy.async](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
698+
| [aws_iam_role_policy.dead_letter](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
699+
| [aws_iam_role_policy.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
700+
| [aws_iam_role_policy.tracing](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
701+
| [aws_iam_role_policy.vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
705702
| [aws_iam_role_policy_attachment.additional_many](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
706703
| [aws_iam_role_policy_attachment.additional_one](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
707-
| [aws_iam_role_policy_attachment.async](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
708-
| [aws_iam_role_policy_attachment.dead_letter](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
709-
| [aws_iam_role_policy_attachment.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
710-
| [aws_iam_role_policy_attachment.tracing](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
711-
| [aws_iam_role_policy_attachment.vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
712704
| [aws_lambda_event_source_mapping.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_event_source_mapping) | resource |
713705
| [aws_lambda_function.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function) | resource |
714706
| [aws_lambda_function_event_invoke_config.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function_event_invoke_config) | resource |

‎examples/complete/main.tf

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,8 +54,7 @@ module "lambda_function" {
5454

5555
cloudwatch_logs_log_group_class = "INFREQUENT_ACCESS"
5656

57-
role_path = "/tf-managed/"
58-
policy_path = "/tf-managed/"
57+
role_path = "/tf-managed/"
5958

6059
attach_dead_letter_policy = true
6160
dead_letter_target_arn = aws_sqs_queue.dlq.arn

‎iam.tf

Lines changed: 16 additions & 80 deletions
Original file line numberDiff line numberDiff line change
@@ -131,20 +131,12 @@ data "aws_iam_policy_document" "logs" {
131131
}
132132
}
133133

134-
resource "aws_iam_policy" "logs" {
134+
resource "aws_iam_role_policy" "logs" {
135135
count = local.create_role && var.attach_cloudwatch_logs_policy ? 1 : 0
136136

137137
name = "${local.policy_name}-logs"
138-
path = var.policy_path
138+
role = aws_iam_role.lambda[0].name
139139
policy = data.aws_iam_policy_document.logs[0].json
140-
tags = var.tags
141-
}
142-
143-
resource "aws_iam_role_policy_attachment" "logs" {
144-
count = local.create_role && var.attach_cloudwatch_logs_policy ? 1 : 0
145-
146-
role = aws_iam_role.lambda[0].name
147-
policy_arn = aws_iam_policy.logs[0].arn
148140
}
149141

150142
#####################
@@ -168,20 +160,12 @@ data "aws_iam_policy_document" "dead_letter" {
168160
}
169161
}
170162

171-
resource "aws_iam_policy" "dead_letter" {
163+
resource "aws_iam_role_policy" "dead_letter" {
172164
count = local.create_role && var.attach_dead_letter_policy ? 1 : 0
173165

174166
name = "${local.policy_name}-dl"
175-
path = var.policy_path
167+
role = aws_iam_role.lambda[0].name
176168
policy = data.aws_iam_policy_document.dead_letter[0].json
177-
tags = var.tags
178-
}
179-
180-
resource "aws_iam_role_policy_attachment" "dead_letter" {
181-
count = local.create_role && var.attach_dead_letter_policy ? 1 : 0
182-
183-
role = aws_iam_role.lambda[0].name
184-
policy_arn = aws_iam_policy.dead_letter[0].arn
185169
}
186170

187171
######
@@ -195,20 +179,12 @@ data "aws_iam_policy" "vpc" {
195179
arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/service-role/AWSLambdaENIManagementAccess"
196180
}
197181

198-
resource "aws_iam_policy" "vpc" {
182+
resource "aws_iam_role_policy" "vpc" {
199183
count = local.create_role && var.attach_network_policy ? 1 : 0
200184

201185
name = "${local.policy_name}-vpc"
202-
path = var.policy_path
186+
role = aws_iam_role.lambda[0].name
203187
policy = data.aws_iam_policy.vpc[0].policy
204-
tags = var.tags
205-
}
206-
207-
resource "aws_iam_role_policy_attachment" "vpc" {
208-
count = local.create_role && var.attach_network_policy ? 1 : 0
209-
210-
role = aws_iam_role.lambda[0].name
211-
policy_arn = aws_iam_policy.vpc[0].arn
212188
}
213189

214190
#####################
@@ -222,20 +198,12 @@ data "aws_iam_policy" "tracing" {
222198
arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/AWSXRayDaemonWriteAccess"
223199
}
224200

225-
resource "aws_iam_policy" "tracing" {
201+
resource "aws_iam_role_policy" "tracing" {
226202
count = local.create_role && var.attach_tracing_policy ? 1 : 0
227203

228204
name = "${local.policy_name}-tracing"
229-
path = var.policy_path
205+
role = aws_iam_role.lambda[0].name
230206
policy = data.aws_iam_policy.tracing[0].policy
231-
tags = var.tags
232-
}
233-
234-
resource "aws_iam_role_policy_attachment" "tracing" {
235-
count = local.create_role && var.attach_tracing_policy ? 1 : 0
236-
237-
role = aws_iam_role.lambda[0].name
238-
policy_arn = aws_iam_policy.tracing[0].arn
239207
}
240208

241209
###############################
@@ -259,60 +227,36 @@ data "aws_iam_policy_document" "async" {
259227
}
260228
}
261229

262-
resource "aws_iam_policy" "async" {
230+
resource "aws_iam_role_policy" "async" {
263231
count = local.create_role && var.attach_async_event_policy ? 1 : 0
264232

265233
name = "${local.policy_name}-async"
266-
path = var.policy_path
234+
role = aws_iam_role.lambda[0].name
267235
policy = data.aws_iam_policy_document.async[0].json
268-
tags = var.tags
269-
}
270-
271-
resource "aws_iam_role_policy_attachment" "async" {
272-
count = local.create_role && var.attach_async_event_policy ? 1 : 0
273-
274-
role = aws_iam_role.lambda[0].name
275-
policy_arn = aws_iam_policy.async[0].arn
276236
}
277237

278238
###########################
279239
# Additional policy (JSON)
280240
###########################
281241

282-
resource "aws_iam_policy" "additional_json" {
242+
resource "aws_iam_role_policy" "additional_json" {
283243
count = local.create_role && var.attach_policy_json ? 1 : 0
284244

285245
name = local.policy_name
286-
path = var.policy_path
246+
role = aws_iam_role.lambda[0].name
287247
policy = var.policy_json
288-
tags = var.tags
289-
}
290-
291-
resource "aws_iam_role_policy_attachment" "additional_json" {
292-
count = local.create_role && var.attach_policy_json ? 1 : 0
293-
294-
role = aws_iam_role.lambda[0].name
295-
policy_arn = aws_iam_policy.additional_json[0].arn
296248
}
297249

298250
#####################################
299251
# Additional policies (list of JSON)
300252
#####################################
301253

302-
resource "aws_iam_policy" "additional_jsons" {
254+
resource "aws_iam_role_policy" "additional_jsons" {
303255
count = local.create_role && var.attach_policy_jsons ? var.number_of_policy_jsons : 0
304256

305257
name = "${local.policy_name}-${count.index}"
306-
path = var.policy_path
258+
role = aws_iam_role.lambda[0].name
307259
policy = var.policy_jsons[count.index]
308-
tags = var.tags
309-
}
310-
311-
resource "aws_iam_role_policy_attachment" "additional_jsons" {
312-
count = local.create_role && var.attach_policy_jsons ? var.number_of_policy_jsons : 0
313-
314-
role = aws_iam_role.lambda[0].name
315-
policy_arn = aws_iam_policy.additional_jsons[count.index].arn
316260
}
317261

318262
###########################
@@ -383,18 +327,10 @@ data "aws_iam_policy_document" "additional_inline" {
383327
}
384328
}
385329

386-
resource "aws_iam_policy" "additional_inline" {
330+
resource "aws_iam_role_policy" "additional_inline" {
387331
count = local.create_role && var.attach_policy_statements ? 1 : 0
388332

389333
name = "${local.policy_name}-inline"
390-
path = var.policy_path
334+
role = aws_iam_role.lambda[0].name
391335
policy = data.aws_iam_policy_document.additional_inline[0].json
392-
tags = var.tags
393-
}
394-
395-
resource "aws_iam_role_policy_attachment" "additional_inline" {
396-
count = local.create_role && var.attach_policy_statements ? 1 : 0
397-
398-
role = aws_iam_role.lambda[0].name
399-
policy_arn = aws_iam_policy.additional_inline[0].arn
400336
}

‎main.tf

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -154,16 +154,16 @@ resource "aws_lambda_function" "this" {
154154
aws_cloudwatch_log_group.lambda,
155155

156156
# Before the lambda is created the execution role with all its policies should be ready
157-
aws_iam_role_policy_attachment.additional_inline,
158-
aws_iam_role_policy_attachment.additional_json,
159-
aws_iam_role_policy_attachment.additional_jsons,
157+
aws_iam_role_policy.additional_inline,
158+
aws_iam_role_policy.additional_json,
159+
aws_iam_role_policy.additional_jsons,
160+
aws_iam_role_policy.async,
161+
aws_iam_role_policy.dead_letter,
162+
aws_iam_role_policy.logs,
163+
aws_iam_role_policy.tracing,
164+
aws_iam_role_policy.vpc,
160165
aws_iam_role_policy_attachment.additional_many,
161166
aws_iam_role_policy_attachment.additional_one,
162-
aws_iam_role_policy_attachment.async,
163-
aws_iam_role_policy_attachment.logs,
164-
aws_iam_role_policy_attachment.dead_letter,
165-
aws_iam_role_policy_attachment.vpc,
166-
aws_iam_role_policy_attachment.tracing,
167167
]
168168
}
169169

‎variables.tf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -578,6 +578,8 @@ variable "attach_policies" {
578578
default = false
579579
}
580580

581+
# TODO: DEPRECATED: Remove this variable in the next major version
582+
# tflint-ignore: all
581583
variable "policy_path" {
582584
description = "Path of policies to that should be added to IAM role for Lambda Function"
583585
type = string

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /