-In this lecture,
we will see how to create IAM policies with Terraform and attach it to a user.
All right.
We have successfully created an IAM user called Lucy.
As we learned in the introduction to the IAM lecture,
all users start with the least privilege in AWS.
Lucy does not have any permissions at this point in time.
To add more permissions, we have to attach IAM policies to the user.
In the IAM section,
we saw that permissions are assigned by the means of a policy document
which is in a JSON format.
A simple example for an admin access policy looks like this.
To add permissions, first,
lets create an IAM policy using Terraform by making use
of the aws_iam_policy resource type.
If we look up the argument reference for this resource,
we can see that the only mandatory argument needed
is the policy document in a JSON format.
Let’s first add that resource to our Terraform configuration file.
Let's name it AdminUsers.
How do we add a policy document here?
Well, there are multiple ways to do it.
The first way is to provide the complete JSON document
as the value to the policy argument.
How do we specify the entire JSON file here?
The easiest way is to make use of something called
as a here document or a heredoc which is commonly used
in command line scripting languages such as bash shell script
that allows us to pass in multiple lines in to a command.
The command in our specific case is the policy argument
in to which we want to pass in multiple lines of the JSON document.
Following this is the redirection symbol which the double left arrows
or the double lesser than symbol and after this is a delimiter.
The delimiter can be any string but the most commonly used string
is EOF which stands for end of file.
We can again make use of the same delimiter, which is EOF, to close the file.
Between the delimiters we can pass in any number of lines
that we want to pass in to the command.
In our example, this is the entire JSON document.
We move the entire JSON file containing the policy document
between these delimiters like this.
All right.
We have successfully created the IAM policy resources,
but its not attached to a user at this point in time.
To attach it,
lets make use of another resource block of type aws_iam_user_policy_attachment.
This resource expects the user name to attach the policy
to and the policy_arn which is an attribute exported by the aws_iam_policy resource.
The main.tf can now be modified like this.
The user argument points to the aws_iam_user resource
and the policy_arn points to the aws_iam_policy resource.
We have seen this format earlier when we discussed
about resource dependencies and reference expressions in Terraform.
With that, our configuration is now complete.
We can now run Terraform plan and then apply and the IAM policy
should get attached to the user giving her administrative access to the AWS account.
Before we move on,
let’s look at another way to specify the policy argument when creating
an IAM policy resource.
Instead of specifying the complete JSON file within the main.tf file,
we can make use of a JSON file that can be stored
within the configuration directory and read within the resource block.
For this,
let’s first create a new file called admin-policy.json
in the same directory as the main.tf file.
We then move the policy document into this file.
Once this is done, to load the policy into the policy section,
we make use of a file function and pass in the name of the file
containing the policy enclosed within brackets.
The file function reads a file and returns the contents of it.
As a result, we no longer need the EOF which is the delimiters
or the heredoc syntax that we have used in the previous example.
Once this change has been made,
the rest of the resources can be created just like we saw in the previous example.
That's it for this lecture.
Let’s head over to the hands-on labs and practice
working with IAM using Terraform.