Use list(string) for iam policy document (#23)

* Use `list(string)` for iam policy document to prevent for_each error

Co-authored-by: cloudpossebot <11232728+cloudpossebot@users.noreply.github.com>

README.md

@@ -94,7 +94,7 @@ the registry shows many of our inputs as required when in fact they are optional
 The table below correctly indicates which inputs are required.
 
 
-Here's how to invoke this example module in your projects
+Here's how to invoke this module in your projects
 
 ```hcl
 module "eks_iam_role" {
@@ -117,10 +117,9 @@ module "eks_iam_role" {
  service_account_name = "autoscaler"
  service_account_namespace = "kube-system"
  # JSON IAM policy document to assign to the service account role
- aws_iam_policy_document = data.aws_iam_policy_document.autoscaler.json
+ aws_iam_policy_document = [data.aws_iam_policy_document.autoscaler.json]
 }
 
-
 data "aws_iam_policy_document" "autoscaler" {
  statement {
  sid = "AllowToScaleEKSNodeGroupAutoScalingGroup"
@@ -202,7 +201,7 @@ Available targets:
 | <a name="input_additional_tag_map"></a> [additional\_tag\_map](#input\_additional\_tag\_map) | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`.<br>This is for some rare cases where resources want additional configuration of tags<br>and therefore take a list of maps with tag key, value, and additional configuration. | `map(string)` | `{}` | no |
 | <a name="input_attributes"></a> [attributes](#input\_attributes) | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,<br>in the order they appear in the list. New attributes are appended to the<br>end of the list. The elements of the list are joined by the `delimiter`<br>and treated as a single ID element. | `list(string)` | `[]` | no |
 | <a name="input_aws_account_number"></a> [aws\_account\_number](#input\_aws\_account\_number) | AWS account number of EKS cluster owner. If an AWS account number is not provided, the current aws provider account number will be used. | `string` | `null` | no |
-| <a name="input_aws_iam_policy_document"></a> [aws\_iam\_policy\_document](#input\_aws\_iam\_policy\_document) | JSON string representation of the IAM policy for this service account | `string` | `null` | no |
+| <a name="input_aws_iam_policy_document"></a> [aws\_iam\_policy\_document](#input\_aws\_iam\_policy\_document) | JSON string representation of the IAM policy for this service account as list of string (0 or 1 items).<br>If empty, no custom IAM policy document will be used. If the list contains a single document, a custom<br>IAM policy will be created and attached to the IAM role.<br>Can also be a plain string, but that use is DEPRECATED because of Terraform issues. | `any` | `[]` | no |
 | <a name="input_aws_partition"></a> [aws\_partition](#input\_aws\_partition) | AWS partition: 'aws', 'aws-cn', or 'aws-us-gov' | `string` | `"aws"` | no |
 | <a name="input_context"></a> [context](#input\_context) | Single object for setting entire context at once.<br>See description of individual variables for details.<br>Leave string and numeric variables as `null` to use default value.<br>Individual variable settings (non-null) override settings in context object,<br>except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | <pre>{<br> "additional_tag_map": {},<br> "attributes": [],<br> "delimiter": null,<br> "descriptor_formats": {},<br> "enabled": true,<br> "environment": null,<br> "id_length_limit": null,<br> "label_key_case": null,<br> "label_order": [],<br> "label_value_case": null,<br> "labels_as_tags": [<br> "unset"<br> ],<br> "name": null,<br> "namespace": null,<br> "regex_replace_chars": null,<br> "stage": null,<br> "tags": {},<br> "tenant": null<br>}</pre> | no |
 | <a name="input_delimiter"></a> [delimiter](#input\_delimiter) | Delimiter to be used between ID elements.<br>Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no |
@@ -397,14 +396,16 @@ Check out [our other projects][github], [follow us on twitter][twitter], [apply
 ### Contributors
 
 <!-- markdownlint-disable -->
-| [![Erik Osterman][osterman_avatar]][osterman_homepage]<br/>[Erik Osterman][osterman_homepage] | [![Andriy Knysh][aknysh_avatar]][aknysh_homepage]<br/>[Andriy Knysh][aknysh_homepage] |
-|---|---|
+| [![Erik Osterman][osterman_avatar]][osterman_homepage]<br/>[Erik Osterman][osterman_homepage] | [![Andriy Knysh][aknysh_avatar]][aknysh_homepage]<br/>[Andriy Knysh][aknysh_homepage] | [![RB][nitrocode_avatar]][nitrocode_homepage]<br/>[RB][nitrocode_homepage] |
+|---|---|---|
 <!-- markdownlint-restore -->
 
  [osterman_homepage]: https://github.com/osterman
  [osterman_avatar]: https://img.cloudposse.com/150x150/https://github.com/osterman.png
  [aknysh_homepage]: https://github.com/aknysh
  [aknysh_avatar]: https://img.cloudposse.com/150x150/https://github.com/aknysh.png
+ [nitrocode_homepage]: https://github.com/nitrocode
+ [nitrocode_avatar]: https://img.cloudposse.com/150x150/https://github.com/nitrocode.png
 
 [![README Footer][readme_footer_img]][readme_footer_link]
 [![Beacon][beacon]][website]

README.yaml

@@ -66,7 +66,7 @@ description: |-
 
 # How to use this module. Should be an easy example to copy and paste.
 usage: |-
- Here's how to invoke this example module in your projects
+ Here's how to invoke this module in your projects
 
  ```hcl
  module "eks_iam_role" {
@@ -89,10 +89,9 @@ usage: |-
  service_account_name = "autoscaler"
  service_account_namespace = "kube-system"
  # JSON IAM policy document to assign to the service account role
- aws_iam_policy_document = data.aws_iam_policy_document.autoscaler.json
+ aws_iam_policy_document = [data.aws_iam_policy_document.autoscaler.json]
  }
 
-
  data "aws_iam_policy_document" "autoscaler" {
  statement {
  sid = "AllowToScaleEKSNodeGroupAutoScalingGroup"
@@ -133,3 +132,5 @@ contributors:
  github: "osterman"
  - name: "Andriy Knysh"
  github: "aknysh"
+ - name: "RB"
+ github: "nitrocode"

docs/terraform.md

@@ -37,7 +37,7 @@
 | <a name="input_additional_tag_map"></a> [additional\_tag\_map](#input\_additional\_tag\_map) | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`.<br>This is for some rare cases where resources want additional configuration of tags<br>and therefore take a list of maps with tag key, value, and additional configuration. | `map(string)` | `{}` | no |
 | <a name="input_attributes"></a> [attributes](#input\_attributes) | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,<br>in the order they appear in the list. New attributes are appended to the<br>end of the list. The elements of the list are joined by the `delimiter`<br>and treated as a single ID element. | `list(string)` | `[]` | no |
 | <a name="input_aws_account_number"></a> [aws\_account\_number](#input\_aws\_account\_number) | AWS account number of EKS cluster owner. If an AWS account number is not provided, the current aws provider account number will be used. | `string` | `null` | no |
-| <a name="input_aws_iam_policy_document"></a> [aws\_iam\_policy\_document](#input\_aws\_iam\_policy\_document) | JSON string representation of the IAM policy for this service account | `string` | `null` | no |
+| <a name="input_aws_iam_policy_document"></a> [aws\_iam\_policy\_document](#input\_aws\_iam\_policy\_document) | JSON string representation of the IAM policy for this service account as list of string (0 or 1 items).<br>If empty, no custom IAM policy document will be used. If the list contains a single document, a custom<br>IAM policy will be created and attached to the IAM role.<br>Can also be a plain string, but that use is DEPRECATED because of Terraform issues. | `any` | `[]` | no |
 | <a name="input_aws_partition"></a> [aws\_partition](#input\_aws\_partition) | AWS partition: 'aws', 'aws-cn', or 'aws-us-gov' | `string` | `"aws"` | no |
 | <a name="input_context"></a> [context](#input\_context) | Single object for setting entire context at once.<br>See description of individual variables for details.<br>Leave string and numeric variables as `null` to use default value.<br>Individual variable settings (non-null) override settings in context object,<br>except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | <pre>{<br> "additional_tag_map": {},<br> "attributes": [],<br> "delimiter": null,<br> "descriptor_formats": {},<br> "enabled": true,<br> "environment": null,<br> "id_length_limit": null,<br> "label_key_case": null,<br> "label_order": [],<br> "label_value_case": null,<br> "labels_as_tags": [<br> "unset"<br> ],<br> "name": null,<br> "namespace": null,<br> "regex_replace_chars": null,<br> "stage": null,<br> "tags": {},<br> "tenant": null<br>}</pre> | no |
 | <a name="input_delimiter"></a> [delimiter](#input\_delimiter) | Delimiter to be used between ID elements.<br>Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no |

examples/complete/main.tf

@@ -14,12 +14,11 @@ module "autoscaler_role" {
  # Rather than create a whole cluster, just fake the OIDC URL
  # eks_cluster_oidc_issuer_url = module.eks_cluster.eks_cluster_identity_oidc_issuer
  eks_cluster_oidc_issuer_url = "https://oidc.eks.us-west-2.amazonaws.com/id/FEDCBA9876543210FEDCBA9876543210"
- aws_iam_policy_document = data.aws_iam_policy_document.autoscaler.json
+ aws_iam_policy_document = [data.aws_iam_policy_document.autoscaler.json]
 
  context = module.this.context
 }
 
-
 data "aws_iam_policy_document" "autoscaler" {
  statement {
  sid = "AllowToScaleEKSNodeGroupAutoScalingGroup"
@@ -55,12 +54,11 @@ module "cert-manager_role" {
  # Rather than create a whole cluster, just fake the OIDC URL
  # eks_cluster_oidc_issuer_url = module.eks_cluster.eks_cluster_identity_oidc_issuer
  eks_cluster_oidc_issuer_url = "https://oidc.eks.us-west-2.amazonaws.com/id/FEDCBA9876543210FEDCBA9876543210"
- aws_iam_policy_document = data.aws_iam_policy_document.cert-manager.json
+ aws_iam_policy_document = [data.aws_iam_policy_document.cert-manager.json]
 
  context = module.this.context
 }
 
-
 data "aws_iam_policy_document" "cert-manager" {
  statement {
  sid = "GrantListHostedZonesListResourceRecordSets"
@@ -74,7 +72,6 @@ data "aws_iam_policy_document" "cert-manager" {
  }
 }
 
-
 data "aws_iam_policy" "cert-manager" {
  arn = module.cert-manager_role.service_account_policy_arn
 }

main.tf

@@ -26,6 +26,9 @@ locals {
 
  service_account_long_id = format("%v@%v", coalesce(var.service_account_name, "all"), coalesce(var.service_account_namespace, "all"))
  service_account_id = trimsuffix(local.service_account_long_id, format("@%v", var.service_account_name))
+
+ # Try to return the first element, if that doesn't work, try the tostring approach
+ aws_iam_policy_document = try(var.aws_iam_policy_document[0], tostring(var.aws_iam_policy_document), "{}")
 }
 
 data "aws_caller_identity" "current" {}
@@ -76,15 +79,15 @@ data "aws_iam_policy_document" "service_account_assume_role" {
 }
 
 resource "aws_iam_policy" "service_account" {
- for_each = var.aws_iam_policy_document != null ? toset(compact([module.service_account_label.id])) : []
+ for_each = length(var.aws_iam_policy_document) > 0 ? toset(compact([module.service_account_label.id])) : []
  name = each.value
  description = format("Grant permissions to EKS ServiceAccount %s", local.service_account_id)
- policy = coalesce(var.aws_iam_policy_document, "{}")
+ policy = local.aws_iam_policy_document
  tags = module.service_account_label.tags
 }
 
 resource "aws_iam_role_policy_attachment" "service_account" {
- for_each = var.aws_iam_policy_document != null ? toset(compact([module.service_account_label.id])) : []
+ for_each = length(var.aws_iam_policy_document) > 0 ? toset(compact([module.service_account_label.id])) : []
  role = aws_iam_role.service_account[each.value].name
  policy_arn = aws_iam_policy.service_account[each.value].arn
 }

outputs.tf

@@ -24,16 +24,16 @@ output "service_account_role_arn" {
 }
 
 output "service_account_policy_name" {
- value = local.enabled && var.aws_iam_policy_document != null ? values(aws_iam_policy.service_account)[0].name : null
+ value = local.enabled && length(var.aws_iam_policy_document) > 0 ? values(aws_iam_policy.service_account)[0].name : null
  description = "IAM policy name"
 }
 
 output "service_account_policy_id" {
- value = local.enabled && var.aws_iam_policy_document != null ? values(aws_iam_policy.service_account)[0].id : null
+ value = local.enabled && length(var.aws_iam_policy_document) > 0 ? values(aws_iam_policy.service_account)[0].id : null
  description = "IAM policy ID"
 }
 
 output "service_account_policy_arn" {
- value = local.enabled && var.aws_iam_policy_document != null ? values(aws_iam_policy.service_account)[0].arn : null
+ value = local.enabled && length(var.aws_iam_policy_document) > 0 ? values(aws_iam_policy.service_account)[0].arn : null
  description = "IAM policy ARN"
 }

variables.tf

@@ -21,9 +21,14 @@ variable "aws_partition" {
 }
 
 variable "aws_iam_policy_document" {
- type = string
- default = null
- description = "JSON string representation of the IAM policy for this service account"
+ type = any
+ default = []
+ description = <<-EOT
+ JSON string representation of the IAM policy for this service account as list of string (0 or 1 items).
+ If empty, no custom IAM policy document will be used. If the list contains a single document, a custom
+ IAM policy will be created and attached to the IAM role.
+ Can also be a plain string, but that use is DEPRECATED because of Terraform issues.
+ EOT
 }
 
 variable "eks_cluster_oidc_issuer_url" {