Use list(string) for iam policy document

[nitrocode]

what

• Use list(string) for iam policy document

why

This module runs into the dreaded for_each error

│ The "for_each" value depends on resource attributes that cannot be determined until apply, so Terraform
│ cannot predict how many instances will be created. To work around this, use the -target argument to
│ first apply only the resources that the for_each depends on.

The way it is triggered is if the var.aws_iam_policy_document supplied contains a JSON document that requires another submodule to be applied.

This was seen in a teleport cluster component which provisioned

1. teleport-backend submodule which returns DynamoDB and S3 resource arns
2. Raw policy document json is constructed with the DynamoDB and S3 resource arns
3. helm-release module takes input of the policy document
   • iam-policy module takes statements from the policy document
   • eks-iam-role module takes input from iam-module and throws an error because (1) isn't applied

This fix was tested locally using a forked module of terraform-aws-helm-release which uses this feature branch

references

• https://github.com/cloudposse/terraform-aws-iam-policy
• https://github.com/cloudposse/terraform-aws-helm-release
• The list(string) method is used in the new version of the Security Group module to avoid this same situation

  Input id renamed to target_security_group_id. Again id by itself is too vague. Converted to list to conform to new standard pattern that optional inputs which are used in conditionals are passed as list elements. See Hashicorp recommendation

commands

# Use current tests where the iam policy doc is a string
terraform plan -var-file=fixtures.us-east-2.tfvars > stdout.string.plan 2>&1

# Modify test inputs where the iam policy doc is a list(string)
terraform plan -var-file=fixtures.us-east-2.tfvars > stdout.list.plan 2>&1

# no diff between
diff stdout.string.plan stdout.list.plan

[nitrocode]

/test all

[nitrocode]

/test all

[nitrocode]

/test all

[nitrocode]

/test all