Update iam-policy to v2.0.0

README.md

@@ -189,25 +189,30 @@ module "helm_release" {
  service_account_namespace = "echo"
 
  # IAM policy statements to add to the IAM role
- iam_policy_statements = {
- ListMyBucket = {
+ iam_policy = [{
+ statements = [{
+ sid = "ListMyBucket"
  effect = "Allow"
  actions = ["s3:ListBucket"]
  resources = ["arn:aws:s3:::test"]
  conditions = []
  },
- WriteMyBucket = {
+ {
+ sid = "WriteMyBucket"
  effect = "Allow"
  actions = ["s3:PutObject", "s3:GetObject", "s3:DeleteObject"]
  resources = ["arn:aws:s3:::test/*"]
  conditions = []
- },
- }
+ }]
+ }]
 }
 ```
 
-If `var.service_account_name` is set, then `var.name` can be set to "" in order to achieve a shorter name for the IAM
-Role created for the ServiceAccount:
+Typically, the prefix for the full name of the created IAM role for the service account ends with the `name` value,
+supplied either via the `name` or the `context` input. If `service_account_name` is set to something other than `*`,
+the service account name is then appended to this prefix. In the case where `name` and `service_account_name`
+are the same, this leads to a repetition, for a name like `eg-echo-echo`. For this reason, we recommend setting
+`name` to "" when it would otherwise be the same as `service_account_name`:
 
 ```hcl
 module "helm_release" {
@@ -261,7 +266,7 @@ Available targets:
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.0 |
 | <a name="requirement_helm"></a> [helm](#requirement\_helm) | >= 2.2 |
 | <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 2.7.1 |
 
@@ -276,7 +281,7 @@ Available targets:
 
 | Name | Source | Version |
 |------|--------|---------|
-| <a name="module_eks_iam_policy"></a> [eks\_iam\_policy](#module\_eks\_iam\_policy) | cloudposse/iam-policy/aws | 1.0.1 |
+| <a name="module_eks_iam_policy"></a> [eks\_iam\_policy](#module\_eks\_iam\_policy) | cloudposse/iam-policy/aws | 2.0.0 |
 | <a name="module_eks_iam_role"></a> [eks\_iam\_role](#module\_eks\_iam\_role) | cloudposse/eks-iam-role/aws | 2.1.1 |
 | <a name="module_this"></a> [this](#module\_this) | cloudposse/label/null | 0.25.0 |
 
@@ -313,11 +318,13 @@ Available targets:
 | <a name="input_enabled"></a> [enabled](#input\_enabled) | Set to false to prevent the module from creating any resources | `bool` | `null` | no |
 | <a name="input_environment"></a> [environment](#input\_environment) | ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT' | `string` | `null` | no |
 | <a name="input_force_update"></a> [force\_update](#input\_force\_update) | Force resource update through delete/recreate if needed. Defaults to `false`. | `bool` | `null` | no |
+| <a name="input_iam_override_policy_documents"></a> [iam\_override\_policy\_documents](#input\_iam\_override\_policy\_documents) | List of IAM policy documents (as JSON strings) that are merged together into the exported document with higher precedence.<br>In merging, statements with non-blank SIDs will override statements with the same SID<br>from earlier documents in the list and from other "source" documents. | `list(string)` | `null` | no |
+| <a name="input_iam_policy"></a> [iam\_policy](#input\_iam\_policy) | IAM policy as list of Terraform objects, compatible with Terraform `aws_iam_policy_document` data source<br>except that `source_policy_documents` and `override_policy_documents` are not included.<br>Use inputs `iam_source_policy_documents` and `iam_override_policy_documents` for that. | <pre>list(object({<br> policy_id = optional(string, null)<br> version = optional(string, null)<br> statements = list(object({<br> sid = optional(string, null)<br> effect = optional(string, null)<br> actions = optional(list(string), null)<br> not_actions = optional(list(string), null)<br> resources = optional(list(string), null)<br> not_resources = optional(list(string), null)<br> conditions = optional(list(object({<br> test = string<br> variable = string<br> values = list(string)<br> })), [])<br> principals = optional(list(object({<br> type = string<br> identifiers = list(string)<br> })), [])<br> not_principals = optional(list(object({<br> type = string<br> identifiers = list(string)<br> })), [])<br> }))<br> }))</pre> | `null` | no |
 | <a name="input_iam_policy_enabled"></a> [iam\_policy\_enabled](#input\_iam\_policy\_enabled) | Whether to create and attach an IAM policy to the created IAM role | `bool` | `true` | no |
-| <a name="input_iam_policy_statements"></a> [iam\_policy\_statements](#input\_iam\_policy\_statements) | DEPRECATED, use `iam_source_policy_documents` instead: IAM policy (as `map(string)`)for the service account. | `any` | `{}` | no |
+| <a name="input_iam_policy_statements"></a> [iam\_policy\_statements](#input\_iam\_policy\_statements) | Deprecated: Use `iam_policy` instead.<br>List or Map of IAM policy statements to use in the policy.<br>This can be used with `iam_source_policy_documents` and `iam_override_policy_documents`<br>and with or instead of `iam_source_json_url`. | `any` | `{}` | no |
 | <a name="input_iam_role_enabled"></a> [iam\_role\_enabled](#input\_iam\_role\_enabled) | Whether to create an IAM role. Setting this to `true` will also replace any occurrences of `{service_account_role_arn}` in `var.values_template_path` with the ARN of the IAM role created by this module. | `bool` | `false` | no |
-| <a name="input_iam_source_json_url"></a> [iam\_source\_json\_url](#input\_iam\_source\_json\_url) | IAM source json policy to download. The downloaded policy will be combined with `iam_source_policy_statements`. | `string` | `null` | no |
-| <a name="input_iam_source_policy_documents"></a> [iam\_source\_policy\_documents](#input\_iam\_source\_policy\_documents) | List of JSON IAM policy documents that are merged together into role's policy. Statements defined in `source_policy_documents` or `source_json` must have unique sids. | `list(string)` | `null` | no |
+| <a name="input_iam_source_json_url"></a> [iam\_source\_json\_url](#input\_iam\_source\_json\_url) | URL of the IAM policy (in JSON format) to download and use as `source_json` argument.<br>This is useful when using a 3rd party service that provides their own policy.<br>Statements in this policy will be overridden by statements with the same SID in `iam_override_policy_documents`. | `string` | `null` | no |
+| <a name="input_iam_source_policy_documents"></a> [iam\_source\_policy\_documents](#input\_iam\_source\_policy\_documents) | List of IAM policy documents (as JSON strings) that are merged together into the exported document.<br>Statements defined in `iam_source_policy_documents` must have unique SIDs and be distinct from SIDs<br>in `iam_policy` and deprecated `iam_policy_statements`.<br>Statements in these documents will be overridden by statements with the same SID in `iam_override_policy_documents`. | `list(string)` | `null` | no |
 | <a name="input_id_length_limit"></a> [id\_length\_limit](#input\_id\_length\_limit) | Limit `id` to this many characters (minimum 6).<br>Set to `0` for unlimited length.<br>Set to `null` for keep the existing setting, which defaults to `0`.<br>Does not affect `id_full`. | `number` | `null` | no |
 | <a name="input_keyring"></a> [keyring](#input\_keyring) | Location of public keys used for verification. Used only if `verify` is true. Defaults to `/.gnupg/pubring.gpg` in the location set by `home`. | `string` | `null` | no |
 | <a name="input_kubernetes_namespace"></a> [kubernetes\_namespace](#input\_kubernetes\_namespace) | The namespace to install the release into. Defaults to `default`. | `string` | `null` | no |
@@ -391,6 +398,7 @@ Are you using this project or any of our other projects? Consider [leaving a tes
 
 Check out these related projects.
 
+- [terraform-aws-iam-policy](https://github.com/cloudposse/terraform-aws-iam-policy/) - Terraform module to create an IAM Policy document from Terraform inputs.
 - [terraform-aws-eks-iam-role](https://github.com/cloudposse/terraform-aws-eks-iam-role/) - Terraform module to provision an EKS IAM Role for Service Account.
 - [terraform-null-label](https://github.com/cloudposse/terraform-null-label) - Terraform module designed to generate consistent names and tags for resources. Use terraform-null-label to implement a strict naming convention.
 

README.yaml

@@ -36,6 +36,9 @@ badges:
 
 # List any related terraform modules that this module may be used with or that this module depends on.
 related:
+ - name: "terraform-aws-iam-policy"
+ description: "Terraform module to create an IAM Policy document from Terraform inputs."
+ url: "https://github.com/cloudposse/terraform-aws-iam-policy/"
  - name: "terraform-aws-eks-iam-role"
  description: "Terraform module to provision an EKS IAM Role for Service Account."
  url: "https://github.com/cloudposse/terraform-aws-eks-iam-role/"
@@ -161,25 +164,30 @@ usage: |-
  service_account_namespace = "echo"
 
  # IAM policy statements to add to the IAM role
- iam_policy_statements = {
- ListMyBucket = {
+ iam_policy = [{
+ statements = [{
+ sid = "ListMyBucket"
  effect = "Allow"
  actions = ["s3:ListBucket"]
  resources = ["arn:aws:s3:::test"]
  conditions = []
  },
- WriteMyBucket = {
+ {
+ sid = "WriteMyBucket"
  effect = "Allow"
  actions = ["s3:PutObject", "s3:GetObject", "s3:DeleteObject"]
  resources = ["arn:aws:s3:::test/*"]
  conditions = []
- },
- }
+ }]
+ }]
  }
  ```
 
- If `var.service_account_name` is set, then `var.name` can be set to "" in order to achieve a shorter name for the IAM
- Role created for the ServiceAccount:
+ Typically, the prefix for the full name of the created IAM role for the service account ends with the `name` value,
+ supplied either via the `name` or the `context` input. If `service_account_name` is set to something other than `*`,
+ the service account name is then appended to this prefix. In the case where `name` and `service_account_name`
+ are the same, this leads to a repetition, for a name like `eg-echo-echo`. For this reason, we recommend setting
+ `name` to "" when it would otherwise be the same as `service_account_name`:
 
  ```hcl
  module "helm_release" {

docs/terraform.md

@@ -3,7 +3,7 @@
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.0 |
 | <a name="requirement_helm"></a> [helm](#requirement\_helm) | >= 2.2 |
 | <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 2.7.1 |
 
@@ -18,7 +18,7 @@
 
 | Name | Source | Version |
 |------|--------|---------|
-| <a name="module_eks_iam_policy"></a> [eks\_iam\_policy](#module\_eks\_iam\_policy) | cloudposse/iam-policy/aws | 1.0.1 |
+| <a name="module_eks_iam_policy"></a> [eks\_iam\_policy](#module\_eks\_iam\_policy) | cloudposse/iam-policy/aws | 2.0.0 |
 | <a name="module_eks_iam_role"></a> [eks\_iam\_role](#module\_eks\_iam\_role) | cloudposse/eks-iam-role/aws | 2.1.1 |
 | <a name="module_this"></a> [this](#module\_this) | cloudposse/label/null | 0.25.0 |
 
@@ -55,11 +55,13 @@
 | <a name="input_enabled"></a> [enabled](#input\_enabled) | Set to false to prevent the module from creating any resources | `bool` | `null` | no |
 | <a name="input_environment"></a> [environment](#input\_environment) | ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT' | `string` | `null` | no |
 | <a name="input_force_update"></a> [force\_update](#input\_force\_update) | Force resource update through delete/recreate if needed. Defaults to `false`. | `bool` | `null` | no |
+| <a name="input_iam_override_policy_documents"></a> [iam\_override\_policy\_documents](#input\_iam\_override\_policy\_documents) | List of IAM policy documents (as JSON strings) that are merged together into the exported document with higher precedence.<br>In merging, statements with non-blank SIDs will override statements with the same SID<br>from earlier documents in the list and from other "source" documents. | `list(string)` | `null` | no |
+| <a name="input_iam_policy"></a> [iam\_policy](#input\_iam\_policy) | IAM policy as list of Terraform objects, compatible with Terraform `aws_iam_policy_document` data source<br>except that `source_policy_documents` and `override_policy_documents` are not included.<br>Use inputs `iam_source_policy_documents` and `iam_override_policy_documents` for that. | <pre>list(object({<br> policy_id = optional(string, null)<br> version = optional(string, null)<br> statements = list(object({<br> sid = optional(string, null)<br> effect = optional(string, null)<br> actions = optional(list(string), null)<br> not_actions = optional(list(string), null)<br> resources = optional(list(string), null)<br> not_resources = optional(list(string), null)<br> conditions = optional(list(object({<br> test = string<br> variable = string<br> values = list(string)<br> })), [])<br> principals = optional(list(object({<br> type = string<br> identifiers = list(string)<br> })), [])<br> not_principals = optional(list(object({<br> type = string<br> identifiers = list(string)<br> })), [])<br> }))<br> }))</pre> | `null` | no |
 | <a name="input_iam_policy_enabled"></a> [iam\_policy\_enabled](#input\_iam\_policy\_enabled) | Whether to create and attach an IAM policy to the created IAM role | `bool` | `true` | no |
-| <a name="input_iam_policy_statements"></a> [iam\_policy\_statements](#input\_iam\_policy\_statements) | DEPRECATED, use `iam_source_policy_documents` instead: IAM policy (as `map(string)`)for the service account. | `any` | `{}` | no |
+| <a name="input_iam_policy_statements"></a> [iam\_policy\_statements](#input\_iam\_policy\_statements) | Deprecated: Use `iam_policy` instead.<br>List or Map of IAM policy statements to use in the policy.<br>This can be used with `iam_source_policy_documents` and `iam_override_policy_documents`<br>and with or instead of `iam_source_json_url`. | `any` | `{}` | no |
 | <a name="input_iam_role_enabled"></a> [iam\_role\_enabled](#input\_iam\_role\_enabled) | Whether to create an IAM role. Setting this to `true` will also replace any occurrences of `{service_account_role_arn}` in `var.values_template_path` with the ARN of the IAM role created by this module. | `bool` | `false` | no |
-| <a name="input_iam_source_json_url"></a> [iam\_source\_json\_url](#input\_iam\_source\_json\_url) | IAM source json policy to download. The downloaded policy will be combined with `iam_source_policy_statements`. | `string` | `null` | no |
-| <a name="input_iam_source_policy_documents"></a> [iam\_source\_policy\_documents](#input\_iam\_source\_policy\_documents) | List of JSON IAM policy documents that are merged together into role's policy. Statements defined in `source_policy_documents` or `source_json` must have unique sids. | `list(string)` | `null` | no |
+| <a name="input_iam_source_json_url"></a> [iam\_source\_json\_url](#input\_iam\_source\_json\_url) | URL of the IAM policy (in JSON format) to download and use as `source_json` argument.<br>This is useful when using a 3rd party service that provides their own policy.<br>Statements in this policy will be overridden by statements with the same SID in `iam_override_policy_documents`. | `string` | `null` | no |
+| <a name="input_iam_source_policy_documents"></a> [iam\_source\_policy\_documents](#input\_iam\_source\_policy\_documents) | List of IAM policy documents (as JSON strings) that are merged together into the exported document.<br>Statements defined in `iam_source_policy_documents` must have unique SIDs and be distinct from SIDs<br>in `iam_policy` and deprecated `iam_policy_statements`.<br>Statements in these documents will be overridden by statements with the same SID in `iam_override_policy_documents`. | `list(string)` | `null` | no |
 | <a name="input_id_length_limit"></a> [id\_length\_limit](#input\_id\_length\_limit) | Limit `id` to this many characters (minimum 6).<br>Set to `0` for unlimited length.<br>Set to `null` for keep the existing setting, which defaults to `0`.<br>Does not affect `id_full`. | `number` | `null` | no |
 | <a name="input_keyring"></a> [keyring](#input\_keyring) | Location of public keys used for verification. Used only if `verify` is true. Defaults to `/.gnupg/pubring.gpg` in the location set by `home`. | `string` | `null` | no |
 | <a name="input_kubernetes_namespace"></a> [kubernetes\_namespace](#input\_kubernetes\_namespace) | The namespace to install the release into. Defaults to `default`. | `string` | `null` | no |

examples/complete/versions.tf

@@ -1,5 +1,5 @@
 terraform {
- required_version = ">= 1.0"
+ required_version = ">= 1.3.0"
 
  required_providers {
  aws = {

main.tf

@@ -13,13 +13,17 @@ locals {
 
 module "eks_iam_policy" {
  source = "cloudposse/iam-policy/aws"
- version = "1.0.1"
+ version = "2.0.0"
 
  enabled = local.iam_policy_enabled
 
- iam_source_policy_documents = var.iam_source_policy_documents
- iam_source_json_url = var.iam_source_json_url
- iam_policy_statements = var.iam_policy_statements
+ iam_policy = var.iam_policy
+ iam_source_policy_documents = var.iam_source_policy_documents
+ iam_override_policy_documents = var.iam_override_policy_documents
+ iam_source_json_url = var.iam_source_json_url
+
+ # iam_policy_statements is deprecated, can be list or map
+ iam_policy_statements = var.iam_policy_statements
 
  context = module.this.context
 }