README.yaml

---
#
# This is the canonical configuration for the `README.md`
# Run `make readme` to rebuild the `README.md`
#

# Name of this project
name: terraform-aws-iam-policy-document-aggregator

# Logo for this project
#logo: docs/logo.png

# License of this project
license: "APACHE2"

# Canonical GitHub repo
github_repo: cloudposse/terraform-aws-iam-policy-document-aggregator

# Badges to display
badges:
  - name: "Build Status"
    image: "https://g.codefresh.io/api/badges/pipeline/cloudposse/cloudposse%2Fterraform-aws-iam-policy-document-aggregator%2Flint?type=cf-1"
    url: "https://g.codefresh.io/public/accounts/cloudposse/pipelines/cloudposse/terraform-aws-iam-policy-document-aggregator/lint"
  - name: "Latest Release"
    image: "https://img.shields.io/github/release/cloudposse/terraform-aws-iam-policy-document-aggregator.svg"
    url: "https://github.com/cloudposse/terraform-aws-iam-policy-document-aggregator/releases/latest"
  - name: "Slack Community"
    image: "https://slack.cloudposse.com/badge.svg"
    url: "https://slack.cloudposse.com"

related:
  - name: "terraform-aws-iam-role"
    description: "A Terraform module that creates IAM role with provided JSON IAM polices documents."
    url: "https://github.com/cloudposse/terraform-aws-iam-role"
  - name: "terraform-aws-iam-chamber-s3-role"
    description: "Terraform module to provision an IAM role with configurable permissions to access S3 as chamber backend."
    url: "https://github.com/cloudposse/terraform-aws-iam-chamber-s3-role"

# Short description of this project
description: |-
  Terraform module to aggregate multiple IAM policy documents into single policy document.

# How to use this project
usage: |-
  This example creates a single IAM policy document from multiple IAM policy documents.

  ```hcl
    data "aws_iam_policy_document" "resource_full_access" {
      statement {
        sid       = "FullAccess"
        effect    = "Allow"
        resources = ["arn:aws:s3:::bucketname/path/*"]

        actions = [
          "s3:PutObject",
          "s3:PutObjectAcl",
          "s3:GetObject",
          "s3:DeleteObject",
          "s3:ListBucket",
          "s3:ListBucketMultipartUploads",
          "s3:GetBucketLocation",
          "s3:AbortMultipartUpload",
          ]
      }
    }

    data "aws_iam_policy_document" "base" {
      statement {
        sid = "BaseAccess"

        actions = [
          "s3:ListBucket",
          "s3:ListBucketVersions",
        ]

        resources = ["*"]
        effect    = "Allow"
      }
    }


    module "aggregated_policy" {
      source = "git::https://github.com/cloudposse/terraform-aws-iam-policy-document-aggregator.git?ref=master"
      source_documents = [
        "${data.aws_iam_policy_document.base.json}",
        "${data.aws_iam_policy_document.resource_full_access.json}"
      ]
    }

    resource "aws_iam_role" "default" {
      name                 = "example-role"
      description          = "IAM Role with permissions to perform actions on S3 resources"
    }

    resource "aws_iam_role_policy" "default" {
      name        = "example-policy"
      description = "Allow S3 actions"
      role = "${aws_iam_role.default.id}"
      policy      = "${module.aggregated_policy.result_document}"
    }

  ```

  ### Additional Examples
  The [`example`](./example) directory contains the example.

include:
  - "docs/terraform.md"

# Contributors to this project
contributors:
  - name: "Igor Rodionov"
    github: "goruha"
  - name: "Maxim Mironenko"
    github: "maximmi"