Allow Version Selection in policy_document data sources

[hikerspath]

Having used terraform for a while now, we have some configs running that we don't necessarily want to have torn down by terraform if switching to use of the newer (v0.7.7+) aws_iam_policy_document data source. Presently we are running a pre-defined version that has been called out in heredoc format. If we switch to use of the data source, we are forced to a specific version that is hard-coded into the app.

I could totally see having this be something that is defaulted in the app, but not something that is hard-coded as then both of us have more to maintain / be aware of...

• You would need to be aware if AWS ever changed / upgraded the version and release a new version with the change (which would not be backwards compatible to running configs)
• We would need to know if you ever changed the version so that the policy and all its dependancies would not be impacted with a terraform apply.

Terraform Version

• v0.8.8

Affected Resource(s)

• aws_iam_policy_document

Terraform Configuration Files

Below I have placed what we presently have called out and what is available to call out in the new configuration style. Specifically it is the 'Version:' options that I am speaking about.

Existing Policy Definition

resource "aws_iam_role" "lambda_assume_role" {
  name = "lambda_assume_role"

  assume_role_policy = <<EOF
{
  "Version": "2008-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF
}

New Policy Document Format

data "aws_iam_policy_document" "lambda_assume_role" {
  statement {
    actions = [ "sts:AssumeRole" ]

    principals {
      type = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

References

• http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html#Version (Available Versions)
• https://github.com/hashicorp/terraform/blob/master/builtin/providers/aws/data_source_aws_iam_policy_document.go#L96 (Code Segment)
• provider/aws: Fix issue when changing map-public-ip in Subnets #1234
• https://www.terraform.io/docs/providers/aws/d/iam_policy_document.html

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.