Skip to content

Commit ec01bf8

Browse files
RafaelWORafaelWO
committed
♻️ Use inline instead of managed policies
* Remove unused variable `policy_path`
1 parent 1d12240 commit ec01bf8

File tree

6 files changed

+33
-114
lines changed

6 files changed

+33
-114
lines changed

‎README.md

Lines changed: 8 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -689,25 +689,17 @@ No modules.
689689
| Name | Type |
690690
|------|------|
691691
| [aws_cloudwatch_log_group.lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
692-
| [aws_iam_policy.additional_inline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
693-
| [aws_iam_policy.additional_json](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
694-
| [aws_iam_policy.additional_jsons](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
695-
| [aws_iam_policy.async](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
696-
| [aws_iam_policy.dead_letter](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
697-
| [aws_iam_policy.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
698-
| [aws_iam_policy.tracing](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
699-
| [aws_iam_policy.vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
700692
| [aws_iam_role.lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
701-
| [aws_iam_role_policy_attachment.additional_inline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
702-
| [aws_iam_role_policy_attachment.additional_json](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
703-
| [aws_iam_role_policy_attachment.additional_jsons](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
693+
| [aws_iam_role_policy.additional_inline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
694+
| [aws_iam_role_policy.additional_json](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
695+
| [aws_iam_role_policy.additional_jsons](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
696+
| [aws_iam_role_policy.async](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
697+
| [aws_iam_role_policy.dead_letter](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
698+
| [aws_iam_role_policy.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
699+
| [aws_iam_role_policy.tracing](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
700+
| [aws_iam_role_policy.vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
704701
| [aws_iam_role_policy_attachment.additional_many](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
705702
| [aws_iam_role_policy_attachment.additional_one](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
706-
| [aws_iam_role_policy_attachment.async](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
707-
| [aws_iam_role_policy_attachment.dead_letter](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
708-
| [aws_iam_role_policy_attachment.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
709-
| [aws_iam_role_policy_attachment.tracing](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
710-
| [aws_iam_role_policy_attachment.vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
711703
| [aws_lambda_event_source_mapping.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_event_source_mapping) | resource |
712704
| [aws_lambda_function.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function) | resource |
713705
| [aws_lambda_function_event_invoke_config.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function_event_invoke_config) | resource |
@@ -828,7 +820,6 @@ No modules.
828820
| <a name="input_policy_json"></a> [policy\_json](#input\_policy\_json) | An additional policy document as JSON to attach to the Lambda Function role | `string` | `null` | no |
829821
| <a name="input_policy_jsons"></a> [policy\_jsons](#input\_policy\_jsons) | List of additional policy documents as JSON to attach to Lambda Function role | `list(string)` | `[]` | no |
830822
| <a name="input_policy_name"></a> [policy\_name](#input\_policy\_name) | IAM policy name. It override the default value, which is the same as role\_name | `string` | `null` | no |
831-
| <a name="input_policy_path"></a> [policy\_path](#input\_policy\_path) | Path of policies to that should be added to IAM role for Lambda Function | `string` | `null` | no |
832823
| <a name="input_policy_statements"></a> [policy\_statements](#input\_policy\_statements) | Map of dynamic policy statements to attach to Lambda Function role | `any` | `{}` | no |
833824
| <a name="input_provisioned_concurrent_executions"></a> [provisioned\_concurrent\_executions](#input\_provisioned\_concurrent\_executions) | Amount of capacity to allocate. Set to 1 or greater to enable, or set to 0 to disable provisioned concurrency. | `number` | `-1` | no |
834825
| <a name="input_publish"></a> [publish](#input\_publish) | Whether to publish creation/change as new Lambda Function Version. | `bool` | `false` | no |

‎examples/complete/main.tf

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,8 +53,7 @@ module "lambda_function" {
5353

5454
cloudwatch_logs_log_group_class = "INFREQUENT_ACCESS"
5555

56-
role_path = "/tf-managed/"
57-
policy_path = "/tf-managed/"
56+
role_path = "/tf-managed/"
5857

5958
attach_dead_letter_policy = true
6059
dead_letter_target_arn = aws_sqs_queue.dlq.arn

‎iam.tf

Lines changed: 16 additions & 80 deletions
Original file line numberDiff line numberDiff line change
@@ -131,20 +131,12 @@ data "aws_iam_policy_document" "logs" {
131131
}
132132
}
133133

134-
resource "aws_iam_policy" "logs" {
134+
resource "aws_iam_role_policy" "logs" {
135135
count = local.create_role && var.attach_cloudwatch_logs_policy ? 1 : 0
136136

137137
name = "${local.policy_name}-logs"
138-
path = var.policy_path
138+
role = aws_iam_role.lambda[0].name
139139
policy = data.aws_iam_policy_document.logs[0].json
140-
tags = var.tags
141-
}
142-
143-
resource "aws_iam_role_policy_attachment" "logs" {
144-
count = local.create_role && var.attach_cloudwatch_logs_policy ? 1 : 0
145-
146-
role = aws_iam_role.lambda[0].name
147-
policy_arn = aws_iam_policy.logs[0].arn
148140
}
149141

150142
#####################
@@ -168,20 +160,12 @@ data "aws_iam_policy_document" "dead_letter" {
168160
}
169161
}
170162

171-
resource "aws_iam_policy" "dead_letter" {
163+
resource "aws_iam_role_policy" "dead_letter" {
172164
count = local.create_role && var.attach_dead_letter_policy ? 1 : 0
173165

174166
name = "${local.policy_name}-dl"
175-
path = var.policy_path
167+
role = aws_iam_role.lambda[0].name
176168
policy = data.aws_iam_policy_document.dead_letter[0].json
177-
tags = var.tags
178-
}
179-
180-
resource "aws_iam_role_policy_attachment" "dead_letter" {
181-
count = local.create_role && var.attach_dead_letter_policy ? 1 : 0
182-
183-
role = aws_iam_role.lambda[0].name
184-
policy_arn = aws_iam_policy.dead_letter[0].arn
185169
}
186170

187171
######
@@ -195,20 +179,12 @@ data "aws_iam_policy" "vpc" {
195179
arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/service-role/AWSLambdaENIManagementAccess"
196180
}
197181

198-
resource "aws_iam_policy" "vpc" {
182+
resource "aws_iam_role_policy" "vpc" {
199183
count = local.create_role && var.attach_network_policy ? 1 : 0
200184

201185
name = "${local.policy_name}-vpc"
202-
path = var.policy_path
186+
role = aws_iam_role.lambda[0].name
203187
policy = data.aws_iam_policy.vpc[0].policy
204-
tags = var.tags
205-
}
206-
207-
resource "aws_iam_role_policy_attachment" "vpc" {
208-
count = local.create_role && var.attach_network_policy ? 1 : 0
209-
210-
role = aws_iam_role.lambda[0].name
211-
policy_arn = aws_iam_policy.vpc[0].arn
212188
}
213189

214190
#####################
@@ -222,20 +198,12 @@ data "aws_iam_policy" "tracing" {
222198
arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/AWSXRayDaemonWriteAccess"
223199
}
224200

225-
resource "aws_iam_policy" "tracing" {
201+
resource "aws_iam_role_policy" "tracing" {
226202
count = local.create_role && var.attach_tracing_policy ? 1 : 0
227203

228204
name = "${local.policy_name}-tracing"
229-
path = var.policy_path
205+
role = aws_iam_role.lambda[0].name
230206
policy = data.aws_iam_policy.tracing[0].policy
231-
tags = var.tags
232-
}
233-
234-
resource "aws_iam_role_policy_attachment" "tracing" {
235-
count = local.create_role && var.attach_tracing_policy ? 1 : 0
236-
237-
role = aws_iam_role.lambda[0].name
238-
policy_arn = aws_iam_policy.tracing[0].arn
239207
}
240208

241209
###############################
@@ -259,60 +227,36 @@ data "aws_iam_policy_document" "async" {
259227
}
260228
}
261229

262-
resource "aws_iam_policy" "async" {
230+
resource "aws_iam_role_policy" "async" {
263231
count = local.create_role && var.attach_async_event_policy ? 1 : 0
264232

265233
name = "${local.policy_name}-async"
266-
path = var.policy_path
234+
role = aws_iam_role.lambda[0].name
267235
policy = data.aws_iam_policy_document.async[0].json
268-
tags = var.tags
269-
}
270-
271-
resource "aws_iam_role_policy_attachment" "async" {
272-
count = local.create_role && var.attach_async_event_policy ? 1 : 0
273-
274-
role = aws_iam_role.lambda[0].name
275-
policy_arn = aws_iam_policy.async[0].arn
276236
}
277237

278238
###########################
279239
# Additional policy (JSON)
280240
###########################
281241

282-
resource "aws_iam_policy" "additional_json" {
242+
resource "aws_iam_role_policy" "additional_json" {
283243
count = local.create_role && var.attach_policy_json ? 1 : 0
284244

285245
name = local.policy_name
286-
path = var.policy_path
246+
role = aws_iam_role.lambda[0].name
287247
policy = var.policy_json
288-
tags = var.tags
289-
}
290-
291-
resource "aws_iam_role_policy_attachment" "additional_json" {
292-
count = local.create_role && var.attach_policy_json ? 1 : 0
293-
294-
role = aws_iam_role.lambda[0].name
295-
policy_arn = aws_iam_policy.additional_json[0].arn
296248
}
297249

298250
#####################################
299251
# Additional policies (list of JSON)
300252
#####################################
301253

302-
resource "aws_iam_policy" "additional_jsons" {
254+
resource "aws_iam_role_policy" "additional_jsons" {
303255
count = local.create_role && var.attach_policy_jsons ? var.number_of_policy_jsons : 0
304256

305257
name = "${local.policy_name}-${count.index}"
306-
path = var.policy_path
258+
role = aws_iam_role.lambda[0].name
307259
policy = var.policy_jsons[count.index]
308-
tags = var.tags
309-
}
310-
311-
resource "aws_iam_role_policy_attachment" "additional_jsons" {
312-
count = local.create_role && var.attach_policy_jsons ? var.number_of_policy_jsons : 0
313-
314-
role = aws_iam_role.lambda[0].name
315-
policy_arn = aws_iam_policy.additional_jsons[count.index].arn
316260
}
317261

318262
###########################
@@ -383,18 +327,10 @@ data "aws_iam_policy_document" "additional_inline" {
383327
}
384328
}
385329

386-
resource "aws_iam_policy" "additional_inline" {
330+
resource "aws_iam_role_policy" "additional_inline" {
387331
count = local.create_role && var.attach_policy_statements ? 1 : 0
388332

389333
name = "${local.policy_name}-inline"
390-
path = var.policy_path
334+
role = aws_iam_role.lambda[0].name
391335
policy = data.aws_iam_policy_document.additional_inline[0].json
392-
tags = var.tags
393-
}
394-
395-
resource "aws_iam_role_policy_attachment" "additional_inline" {
396-
count = local.create_role && var.attach_policy_statements ? 1 : 0
397-
398-
role = aws_iam_role.lambda[0].name
399-
policy_arn = aws_iam_policy.additional_inline[0].arn
400336
}

‎main.tf

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -153,16 +153,16 @@ resource "aws_lambda_function" "this" {
153153
aws_cloudwatch_log_group.lambda,
154154

155155
# Before the lambda is created the execution role with all its policies should be ready
156-
aws_iam_role_policy_attachment.additional_inline,
157-
aws_iam_role_policy_attachment.additional_json,
158-
aws_iam_role_policy_attachment.additional_jsons,
156+
aws_iam_role_policy.additional_inline,
157+
aws_iam_role_policy.additional_json,
158+
aws_iam_role_policy.additional_jsons,
159+
aws_iam_role_policy.async,
160+
aws_iam_role_policy.dead_letter,
161+
aws_iam_role_policy.logs,
162+
aws_iam_role_policy.tracing,
163+
aws_iam_role_policy.vpc,
159164
aws_iam_role_policy_attachment.additional_many,
160165
aws_iam_role_policy_attachment.additional_one,
161-
aws_iam_role_policy_attachment.async,
162-
aws_iam_role_policy_attachment.logs,
163-
aws_iam_role_policy_attachment.dead_letter,
164-
aws_iam_role_policy_attachment.vpc,
165-
aws_iam_role_policy_attachment.tracing,
166166
]
167167
}
168168

‎variables.tf

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -572,12 +572,6 @@ variable "attach_policies" {
572572
default = false
573573
}
574574

575-
variable "policy_path" {
576-
description = "Path of policies to that should be added to IAM role for Lambda Function"
577-
type = string
578-
default = null
579-
}
580-
581575
variable "number_of_policy_jsons" {
582576
description = "Number of policies JSON to attach to IAM role for Lambda Function"
583577
type = number

‎wrappers/main.tf

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,6 @@ module "wrapper" {
9292
policy_json = try(each.value.policy_json, var.defaults.policy_json, null)
9393
policy_jsons = try(each.value.policy_jsons, var.defaults.policy_jsons, [])
9494
policy_name = try(each.value.policy_name, var.defaults.policy_name, null)
95-
policy_path = try(each.value.policy_path, var.defaults.policy_path, null)
9695
policy_statements = try(each.value.policy_statements, var.defaults.policy_statements, {})
9796
provisioned_concurrent_executions = try(each.value.provisioned_concurrent_executions, var.defaults.provisioned_concurrent_executions, -1)
9897
publish = try(each.value.publish, var.defaults.publish, false)

0 commit comments

Comments
 (0)