service/iam: iam_principal_policy_simulation data source #25569
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
added
documentation
apparentlymart
force-pushed
the
f-simulate-principal-policy
branch
8 times, most recently
from
d54973c
to
4de5795
Compare
DrFaust92
suggested changes
Jun 25, 2022
This data source wraps the IAM policy simulation API. This was previously a data source with little utility in Terraform, but with the introduction of preconditions and postconditions in Terraform v1.2.3 it can be potentially useful as a way for a configuration to either pre-verify that it seems to be running with credentials that confer sufficient access or to self-check a policy it declares itself to get earlier warning if the policy seems insufficient for its intended purpose. Unfortunately the IAM policy simulator is pretty low-level and requires the caller to figure out all of the relevant details of how a real AWS service would make requests to IAM at runtime in order to construct a fully-realistic simulation, but thankfully in practice it seems like authors could make do with relatively-simple "naive" simulations unless they know they are using more complex IAM policy features, such as custom conditions or interpolations.
apparentlymart
force-pushed
the
f-simulate-principal-policy
branch
from
4de5795
to
0031038
Compare
ewbankkit
removed
the
needs-triage
# Conflicts: # internal/provider/provider.go
github-actions
bot
added
generators
…alPolicySimulationDataSource_basic'.
ewbankkit
approved these changes
Jun 5, 2023
There was a problem hiding this comment.
LGTM 🚀.
% make testacc TESTARGS='-run=TestAccIAMPrincipalPolicySimulationDataSource' PKG=iam
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/iam/... -v -count 1 -parallel 20 -run=TestAccIAMPrincipalPolicySimulationDataSource -timeout 180m
=== RUN TestAccIAMPrincipalPolicySimulationDataSource_basic
=== PAUSE TestAccIAMPrincipalPolicySimulationDataSource_basic
=== CONT TestAccIAMPrincipalPolicySimulationDataSource_basic
--- PASS: TestAccIAMPrincipalPolicySimulationDataSource_basic (27.03s)
PASS
ok github.com/hashicorp/terraform-provider-aws/internal/service/iam 32.824s
|
@apparentlymart Thanks for the contribution 🎉 👏. |
|
This functionality has been released in v5.2.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you! |
|
I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This data source wraps the IAM policy simulation API. This was previously an API action with little utility in Terraform, but with the introduction of preconditions and postconditions in Terraform v1.2.3 it can be potentially useful as a way for a configuration to either pre-verify that it seems to be running with credentials that confer sufficient access or to self-check a policy it declares itself to get earlier warning if the policy seems insufficient for its intended purpose.
Unfortunately the IAM policy simulator is pretty low-level and requires the caller to figure out all of the relevant details of how a real AWS service would make requests to IAM at runtime in order to construct a fully-realistic simulation, but thankfully in practice it seems like authors could make do with relatively-simple "naive" simulations unless they know they are using more complex IAM policy features, such as custom conditions or interpolations. I included some hopefully-realistic examples in the documentation.
Community Note
Output from acceptance testing: